Can someone explain how torrent poisoning attacks work? I am looking for some tutorials on how to do it. What are the countermeasures that someone can use to defend themselves against it?
Torrent poisoning means that peers join the swarm which don't contribute to it and only use up resources.
One method is an evil peer which claims to be seeding the whole file. However, instead of returning valid data, it returns garbage. The clients won't notice this until they received the whole chunk and verified the checksum, which means that they wasted time and bandwidth. Another variant is to accept all requests, but then not send any data at all until the connection times out.
At the same time, the bogus peers request chunks from legitimate seeds even though they don't need them. This takes up bandwidth and connection slots which would otherwise be available to legitimate peers.
By flooding the swarm with a large number of such peers it can become impossible for the leachers to find any real seeds to obtain legit chunks of the file.
This can not be prevented tracker-sided, because each of these interactions is directly between peers. A mechanism for reporting such abusive peers to the tracker or a 3rd party would be counter-productive because it could be abused by the malicious peers to accuse legit peers and knock them off the network. The only possible countermeasure is to have the bit torrent client identify the IP addresses of malicious peers and block any connections with them.
The various techniques (there's not just one) are:
- Decoy insertion
- Index poisoning
- Selective content poisoning
- Eclipse attack
- Uncooperative-peer attack
These techniques are actually best described on Wikipedia's article on Torrent poisoning and it also lists some countermeasures.
As for how to do it, most can be implemented effectively by implementing a torrent client that has the attack behaviour documented in the article or by amending an existing one that is open source.
Of course some techniques such as posting fake files doesn't require such levels of sophistication.
As for mitigation techniques, some torrent clients such as BitComet See "Connection status icons" in the manual simply ban certain peers after enough bad data from them.
It's also worth noting that a lot of the attacks merely slow down the download, they don't prevent it. Also if there are already plenty of other peers it's possible your bad peer might not get chosen to download content from.
If you are concerned about copyrighted or illegal material being distributed via BitTorrent, a more effective technique appears to be monitoring the IP addresses of who is in the swarm available to download from and taking legal action against those addresses. This appears to be the most effective phase of counter-measures against unauthorised distribution of material.