DDoSVulnerabilityAnalysisofBitTorrentProtocol.pptVIP

DDoS Vulnerability Analysis of BitTorrent Protocol CS239 projectSpring 2006 Background BitTorrent (BT) P2P file sharing protocol 30% of Internet traffic 6881- top 10 scanned port in the Internet DDoS Distributed – hard to guard against by simply filtering at upstream routers Application level (resources) Network level (bandwidth) How BT works .torrent file (meta-data) Information of files being shared Hashes of pieces of files Trackers (coordinator) http, udp trackers Trackerless (DHT) BT clients (participants) Azureus BitComet uTorrent etc. Online forum (exchange medium) For user to announce and search for .torrent files Communication with trackers Message exchange HTTP/UDP tracker Get peer + announce combined (who is sharing files) Scrapping (information lookup) DHT (trackerless) Ping/response (announcing participation in DHT network) Find node (location peers in DHT network) Get peer (locate who is sharing files) Announce (announce who is sharing files) Vulnerabilities Spoofed information * Both http and udp trackers allow specified IP in announce DHT does not allow specified IP in announce Allow spoofed information on who is participating in DHT network Possible to redirect a lot of DHT query to a victim Compromised tracker Attack illustration Experiments Discussion forum () 1191 newly uploaded .torrent files in 2 days Victim (05) Apache web server (configured to serve 400 clients) tcpdump, netstat Attacker Python script to process .torrent files and contact trackers Zombies Computers running BitTorrent clients in the Internet Statistics Measurements (1) Attacker 1191 torrent files used 30 concurrent threads, contact trackers once Measurements (2) Attacker 1191 torrent files used 40 concurrent threads, contact trackers 10 times Attack ends after 8 hours Measurements (3) 30513 distinct IPs recorded Number of connection attempts per host Retry 3,6,9,… seems a common implementation Measurement (abnormal behavior) Top 15 hosts with highest number of conne