9

Can someone explain how torrent poisoning attacks work? I am looking for some tutorials on how to do it. What are the countermeasures that someone can use to defend themselves against it?

  • I personally use things like Peerblock and whatever other ipfilters are available for your particular torrent client, as a first step in protection. Curious on what others will say though – Goof May 24 '15 at 19:40
  • 7
    I am looking for some tutorials on how to do it? As in, carry out an attack? What color hat are you wearing? This is not a black hat forum. – Atsby May 25 '15 at 0:50
  • 6
    I vote (for what hat he is wearing) for a sparkling green hat with big mickey mouse ears Possibly with propeller... – LvB May 25 '15 at 1:55
  • 2
    @Atsby Reading through questions and answers in this forum there's little to distinguish "black hat" questions from "white hat" questions. We all discuss MiTM and SSLStrip tools as if they didn't also double as attack tools as much as learning tools. If you don't understand how an attack is carried out, how can you hope to protect from it. This is the very essence of the idea of full disclosure. – Steve Sether May 26 '15 at 21:23
  • 3
    I didn't say you had to carry it out, I only said you should understand HOW it's carried out. The full disclosure model has largely won, and thinking in terms of "good guys" and "bad guys" isn't helpful. Pen testing is an accepted practice, and it does exactly what a real world attacker would do, just with a different intent. – Steve Sether May 26 '15 at 21:48
15

Torrent poisoning means that peers join the swarm which don't contribute to it and only use up resources.

One method is an evil peer which claims to be seeding the whole file. However, instead of returning valid data, it returns garbage. The clients won't notice this until they received the whole chunk and verified the checksum, which means that they wasted time and bandwidth. Another variant is to accept all requests, but then not send any data at all until the connection times out.

At the same time, the bogus peers request chunks from legitimate seeds even though they don't need them. This takes up bandwidth and connection slots which would otherwise be available to legitimate peers.

By flooding the swarm with a large number of such peers it can become impossible for the leachers to find any real seeds to obtain legit chunks of the file.

This can not be prevented tracker-sided, because each of these interactions is directly between peers. A mechanism for reporting such abusive peers to the tracker or a 3rd party would be counter-productive because it could be abused by the malicious peers to accuse legit peers and knock them off the network. The only possible countermeasure is to have the bit torrent client identify the IP addresses of malicious peers and block any connections with them.

1

The various techniques (there's not just one) are:

  • Decoy insertion
  • Index poisoning
  • Spoofing
  • Interdiction
  • Selective content poisoning
  • Eclipse attack
  • Uncooperative-peer attack

These techniques are actually best described on Wikipedia's article on Torrent poisoning and it also lists some countermeasures.

As for how to do it, most can be implemented effectively by implementing a torrent client that has the attack behaviour documented in the article or by amending an existing one that is open source.

Of course some techniques such as posting fake files doesn't require such levels of sophistication.

As for mitigation techniques, some torrent clients such as BitComet See "Connection status icons" in the manual simply ban certain peers after enough bad data from them.

It's also worth noting that a lot of the attacks merely slow down the download, they don't prevent it. Also if there are already plenty of other peers it's possible your bad peer might not get chosen to download content from.

If you are concerned about copyrighted or illegal material being distributed via BitTorrent, a more effective technique appears to be monitoring the IP addresses of who is in the swarm available to download from and taking legal action against those addresses. This appears to be the most effective phase of counter-measures against unauthorised distribution of material.

  • Any code that shows how to perform the methods you have listed ? Bcoz otherwise its difficult to get a clear understanding of the process. – Heidi Apr 23 '16 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.