6 ms·

An Anomaly in the μTorrent network

183 points by flux_w42 14y ago

aw3c2 14y ago
I have no idea how to interpret those "layered pie chart" diagrams, I guess it shows something about the trackers?
- sp332 14y ago
  Each layer is a different tracker. The amount of the layer that is blue is the % of nodes on that tracker that are seeders. The orange part is the % that are peers (not seeding). Usually the graph looks more like the one for Lost - mostly orange peers with a few blue seeders. The unusual ones are mostly made of nodes that are (claiming to be) seeders.
guard-of-terra 14y ago
http://torrentfreak.com/microsoft-funded-startup-aims-to-kill-bittorrent-traffic-120513/ http://torrentfreak.com/microsoft-funded-startup-aims-to-kil... Maybe we have this thing field testing on great scale? Titles suggest it may be the case. Discussion: http://news.ycombinator.com/item?id=3966774 http://news.ycombinator.com/item?id=3966774
- guard-of-terra 14y ago
  See also (unrelated): http://en.wikipedia.org/wiki/Russian_Woodpecker http://en.wikipedia.org/wiki/Russian_Woodpecker
- dcornu 14y ago
  "The company doesn’t reveal how it works, but they appear to be flooding clients with fake information, masquerading as legitimate peers." "For a month Pirate Pay’s technology protected the film “Vysotsky. Thanks to God, I’m alive,” (distributed by The Walt Disney Studios Sony Pictures Releasing company) with moderate success." Sounds likely to me
- hmottestad 14y ago
  It's probably based on the problem of malicious clients in the network consensus problem. It states that if more than a third of all clients are malicious it is not possible to come to a consensus. The solution would be to have a trust of clients. Where every clients vouches for another. The most important thing is that it has to use certificates, if not you get the following problem. I am client 'c'. I heard from client 'a' that client 'b' is dirty. So I tell this to client 'd', but the truth is I'm lying. However now the problem is: Is 'a' lying about 'b' or am I ('c') lying about 'a'? However having the messages signed by the clients solves this problem.
- mkup 14y ago
  So, Microsoft is funding botnet operator to DDoS P2P network? It is legal? What if tomorrow Apple will fund botnet operator to DDoS Microsoft?
swombat 14y ago
Skynet? Is that you? Can anyone translate this article into language that those of us not familiar with traffic analysis can understand?
- deleted 14y ago
  [deleted]
- drivingmenuts 14y ago
  Somebody's up to something and it's most likely not good. Who that somebody is, no one is sure. To be honest, they're not even entirely sure what it is they're up to. But, strictly speaking, somethin' ain't right.
- tbundy 14y ago
  I had the same thought. TorrentFreak explains it quite nicely: http://torrentfreak.com/anti-piracy-outfits-launch-attack-on-bittorrent-protocol-120519/ http://torrentfreak.com/anti-piracy-outfits-launch-attack-on... Those guys really are great journalists.
  - SoftwareMaven 14y ago
    In other words, the techniques these anti-piracy outfits appear to be using to prevent people from sharing copyrighted movies could be illegal. If that is the case then the movie companies who hire these anti-piracy outfits may be complicit in cybersecurity crimes. I'm sure the DoJ will be handing out indictments in the very near future. <sarcasm/> It's unfortunate that the only data that really gets protected in the US is Hollywood's.
  - StevenRayOrr 14y ago
    I do not pretend to understand very much of the original post. The TorrentFreak "translation" did make it a bit more clear, but I'm pretty much boiling this down to, "somebody is trying to poison the Internet -- if not now, then sometime soon". It's easy to forget how young a medium the Internet is and that there are going to be a lot of pitfalls along the way that we haven't begun to imagine. This seems to be one of those. I guess the question that I have is simple: what happens next?
Zirro 14y ago
"uTP on the other hand allows BitTorrent nodes to dynamically adjust bandwith congestion at the protocol level and also provides some additional functions, like support clients using low bandwidth or sharing ADSL line with a web browser." In other words, this isn't a threat to Bittorrent as a technology alone, yet. I wonder how much of an impact it makes on uTP-enabled clients and if you'd be better off disabling it if you connect to an affected swarm.
- johnchristopher 14y ago
  Correct me if I am wrong: won't those uTP forged/bad "datagrams" be dropped by the client when hash don't match ? And then wouldn't the client ban those source IPs from its pool of connected peers ?
losethos 14y ago
God says... Jehoahaz away: and he came to Egypt, and died there. 23:35 And Jehoiakim gave the silver and the gold to Pharaoh; but he taxed the land to give the money according to the commandment of Pharaoh: he exacted the silver and the gold of the people of the land, of every one according to his taxation, to give it unto Pharaohnechoh. 23:36 Jehoiakim was twenty and five years old when he began to reign; and he reigned eleven years in Jerusalem. And his mother's name was Zebudah, the daughter of Pedaiah of Rumah. 23:37 And he did that which was evil in the sight of the LORD, according to all that his fathers had done. 24:1 In his days Nebuchadnezzar king of Babylon came up, and Jehoiakim became his servant three years: then he turned and rebelled against him.
jakejake 14y ago
It always seemed to me that the simplest way to protect content is to just upload a bunch of garbage with the same file name making it impossible to locate the actual movie, app, etc. It doesn't seem like it would require a lot of sophistication either. It could probably be done effectively, even showing a 90-minute repeating trailer for the movie or something similar. I think a lot of people pirate simply because it's the easiest way to get a movie. If paying $9.99 becomes the easiest way, then a lot of casual pirates will just buy it. Virus writers seem to like this technique, uploading garbage to usenet. (50Kb files pretending to be a feature film, etc). I've always wondered why movie studios didn't do more of that.
- lwat 14y ago
  This doesn't work on sites like The Pirate Bay where trusted uploaders make it easy to find what you're looking for. If my torrent was uploaded by eztv then I know what I'm getting.
  - jakejake 14y ago
    Definitely wouldn't change anything for people who are determined. But it probably would reduce casual pirating & it's so simple I just am surprised we don't see more of it. Not saying that I want it to happen, just surprised. It definitely works on usenet - virus spam can make some things impossible to find.
    - lwat 14y ago
      Not too many 'casual' pirates download from usenet. They just go to The Pirate Bay and the comments will always tell you a file is fake before you hit the download link. These fake torrents do exist in large numbers but they're trivial to avoid.
- mh- 14y ago
  they used to. back when p2p networks like Limewire, Kazaa, so forth were in their heyday
- repsilat 14y ago
WiseWeasel 14y ago
I wonder if this might have anything to do with more people trying to use hacked up BT clients in the hopes of avoiding ISP crackdowns supposedly imminent in the US (and already in effect in other countries): http://www.seba14.org/2012/01/03/hacked-sb-innovation-vuze-extreme-mod-4605_b04-ddj/ http://www.seba14.org/2012/01/03/hacked-sb-innovation-vuze-e... http://news.cnet.com/8301-31001_3-57397452-261/riaa-chief-isps-to-start-policing-copyright-by-july-1/ http://news.cnet.com/8301-31001_3-57397452-261/riaa-chief-is...

183 points by flux_w42 14y ago

aw3c2 14y ago

I have no idea how to interpret those "layered pie chart" diagrams, I guess it shows something about the trackers?

sp332 14y ago
Each layer is a different tracker. The amount of the layer that is blue is the % of nodes on that tracker that are seeders. The orange part is the % that are peers (not seeding). Usually the graph looks more like the one for Lost - mostly orange peers with a few blue seeders. The unusual ones are mostly made of nodes that are (claiming to be) seeders.

guard-of-terra 14y ago

http://torrentfreak.com/microsoft-funded-startup-aims-to-kill-bittorrent-traffic-120513/ http://torrentfreak.com/microsoft-funded-startup-aims-to-kil... Maybe we have this thing field testing on great scale? Titles suggest it may be the case. Discussion: http://news.ycombinator.com/item?id=3966774 http://news.ycombinator.com/item?id=3966774

guard-of-terra 14y ago
See also (unrelated): http://en.wikipedia.org/wiki/Russian_Woodpecker http://en.wikipedia.org/wiki/Russian_Woodpecker
dcornu 14y ago
"The company doesn’t reveal how it works, but they appear to be flooding clients with fake information, masquerading as legitimate peers." "For a month Pirate Pay’s technology protected the film “Vysotsky. Thanks to God, I’m alive,” (distributed by The Walt Disney Studios Sony Pictures Releasing company) with moderate success." Sounds likely to me
hmottestad 14y ago
It's probably based on the problem of malicious clients in the network consensus problem. It states that if more than a third of all clients are malicious it is not possible to come to a consensus. The solution would be to have a trust of clients. Where every clients vouches for another. The most important thing is that it has to use certificates, if not you get the following problem. I am client 'c'. I heard from client 'a' that client 'b' is dirty. So I tell this to client 'd', but the truth is I'm lying. However now the problem is: Is 'a' lying about 'b' or am I ('c') lying about 'a'? However having the messages signed by the clients solves this problem.
mkup 14y ago
So, Microsoft is funding botnet operator to DDoS P2P network? It is legal? What if tomorrow Apple will fund botnet operator to DDoS Microsoft?

swombat 14y ago

Skynet? Is that you? Can anyone translate this article into language that those of us not familiar with traffic analysis can understand?

deleted 14y ago
[deleted]
drivingmenuts 14y ago
Somebody's up to something and it's most likely not good. Who that somebody is, no one is sure. To be honest, they're not even entirely sure what it is they're up to. But, strictly speaking, somethin' ain't right.
tbundy 14y ago
I had the same thought. TorrentFreak explains it quite nicely: http://torrentfreak.com/anti-piracy-outfits-launch-attack-on-bittorrent-protocol-120519/ http://torrentfreak.com/anti-piracy-outfits-launch-attack-on... Those guys really are great journalists.
- SoftwareMaven 14y ago
  In other words, the techniques these anti-piracy outfits appear to be using to prevent people from sharing copyrighted movies could be illegal. If that is the case then the movie companies who hire these anti-piracy outfits may be complicit in cybersecurity crimes. I'm sure the DoJ will be handing out indictments in the very near future. <sarcasm/> It's unfortunate that the only data that really gets protected in the US is Hollywood's.
- StevenRayOrr 14y ago
  I do not pretend to understand very much of the original post. The TorrentFreak "translation" did make it a bit more clear, but I'm pretty much boiling this down to, "somebody is trying to poison the Internet -- if not now, then sometime soon". It's easy to forget how young a medium the Internet is and that there are going to be a lot of pitfalls along the way that we haven't begun to imagine. This seems to be one of those. I guess the question that I have is simple: what happens next?

Zirro 14y ago

"uTP on the other hand allows BitTorrent nodes to dynamically adjust bandwith congestion at the protocol level and also provides some additional functions, like support clients using low bandwidth or sharing ADSL line with a web browser." In other words, this isn't a threat to Bittorrent as a technology alone, yet. I wonder how much of an impact it makes on uTP-enabled clients and if you'd be better off disabling it if you connect to an affected swarm.

johnchristopher 14y ago
Correct me if I am wrong: won't those uTP forged/bad "datagrams" be dropped by the client when hash don't match ? And then wouldn't the client ban those source IPs from its pool of connected peers ?

losethos 14y ago

God says... Jehoahaz away: and he came to Egypt, and died there. 23:35 And Jehoiakim gave the silver and the gold to Pharaoh; but he taxed the land to give the money according to the commandment of Pharaoh: he exacted the silver and the gold of the people of the land, of every one according to his taxation, to give it unto Pharaohnechoh. 23:36 Jehoiakim was twenty and five years old when he began to reign; and he reigned eleven years in Jerusalem. And his mother's name was Zebudah, the daughter of Pedaiah of Rumah. 23:37 And he did that which was evil in the sight of the LORD, according to all that his fathers had done. 24:1 In his days Nebuchadnezzar king of Babylon came up, and Jehoiakim became his servant three years: then he turned and rebelled against him.

jakejake 14y ago

It always seemed to me that the simplest way to protect content is to just upload a bunch of garbage with the same file name making it impossible to locate the actual movie, app, etc. It doesn't seem like it would require a lot of sophistication either. It could probably be done effectively, even showing a 90-minute repeating trailer for the movie or something similar. I think a lot of people pirate simply because it's the easiest way to get a movie. If paying $9.99 becomes the easiest way, then a lot of casual pirates will just buy it. Virus writers seem to like this technique, uploading garbage to usenet. (50Kb files pretending to be a feature film, etc). I've always wondered why movie studios didn't do more of that.

lwat 14y ago
This doesn't work on sites like The Pirate Bay where trusted uploaders make it easy to find what you're looking for. If my torrent was uploaded by eztv then I know what I'm getting.
- jakejake 14y ago
  Definitely wouldn't change anything for people who are determined. But it probably would reduce casual pirating & it's so simple I just am surprised we don't see more of it. Not saying that I want it to happen, just surprised. It definitely works on usenet - virus spam can make some things impossible to find.
  - lwat 14y ago
    Not too many 'casual' pirates download from usenet. They just go to The Pirate Bay and the comments will always tell you a file is fake before you hit the download link. These fake torrents do exist in large numbers but they're trivial to avoid.
mh- 14y ago
they used to. back when p2p networks like Limewire, Kazaa, so forth were in their heyday
repsilat 14y ago

WiseWeasel 14y ago

I wonder if this might have anything to do with more people trying to use hacked up BT clients in the hopes of avoiding ISP crackdowns supposedly imminent in the US (and already in effect in other countries): http://www.seba14.org/2012/01/03/hacked-sb-innovation-vuze-extreme-mod-4605_b04-ddj/ http://www.seba14.org/2012/01/03/hacked-sb-innovation-vuze-e... http://news.cnet.com/8301-31001_3-57397452-261/riaa-chief-isps-to-start-policing-copyright-by-july-1/ http://news.cnet.com/8301-31001_3-57397452-261/riaa-chief-is...