Re: ipv6

>From: Olaf van der Spek <[email protected]>
> Martin Burggraf wrote:
> > Olaf van der Spek wrote:
> >>Why would the 'attacker' restrict himself to a single torrent (or a 
> >>single tracker) or only one 'announce'?
> > 
> > good point... however, I think a DDoS attack requires a certain amount of 
> > coordination to work and in case of BT the 'attacker' has no guarantee when or 
> > if the clients are going to connect to the victim. When a torrent gets more 
> > peers, the possibility that the faked address is in the returned peer list 
> > decreases, so the best targets are probably relatively small swarms, hence it 
> > even requires more of those which implies more effort from the bad guy.
> > IHMO BT doesn't really guarantee the necessary coordination so the costs are 
> > not worth it; there are definately more effective methods to carry out a DDoS.
> 
> It requires one announce to a tracker to a torrent with a swarm of 50 
> peers to get the victim IPA in the list for 30 - 45 minutes.
> All other peer will announce at least once in those 30 minutes and will 
> get the victim IPA.
> So at the cost of one announce you 'get' 50 TCP connects to the victim.
> Isn't that a nice 'attack' multiplier waiting to be abused?
> You can announce to as much torrents as you want.
> Bigger swarms would also work, but not be more effective.

Decent, but I think completely insufficient.

The attack swarm will need to have folks actively joining the swarm,
otherwise the peers may well be satisfied with their existing peers. The
attack swarm will also need at least 50 peers to do those 50 connects.
This cuts down the swarms that it is possible to use.

Then there is the raw number of swarms needed for attack. Going for the
pessimistic number, 50 connections for 5 minutes per swarm. So one
connection every 6 seconds. At this rate you need to locate 6000 swarms
to do this DoS.

The identification of trackers is an interesting task. They can be on any
IP address and any port. Then there is the issue of whether they meet the
above qualification. These two I think kill this as a serious attack
vector. If you don't test them for qualification then you'll be wasting
bandwidth on dud attack swarms. If you do test them for qualification
you'll be wasting massive bandwidth doing that testing, and likely less
than 1 in 50 swarms will qualify (based on the data pointed to in a
previous post, stating that small trackers are the rule).

A zombie army could be utilized to do this sort of scan, but once you've
got that army why not directly attack? Might protect your army, but it
will also cut down their attack power.


-- 
(\___(\___(\______          --=> 8-) EHM <=--          ______/)___/)___/)
 \   (    |         [email protected] PGP 8881EF59         |    )   /
  \_  \   |  _____  -O #include <stddisclaimer.h> O-   _____  |   /  _/
    \___\_|_/82 04 A1 3C C7 B1 37 2A*E3 6E 84 DA 97 4C 40 E6\_|_/___/




 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/BitTorrent/

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/