Graffiti Networks: A Subversive, Internet-Scale File Sharing Model. Andrew Pavlo DC401 Rhode Island Defcon Group October 12, 2009

Transcription

1 Graffiti Networks: A Subversive, Internet-Scale File Sharing Model Andrew Pavlo DC401 Rhode Island Defcon Group October 12, 2009

2 Co-Authors Ning Shi (Brown)

3 Outline Open BitTorrent Problems A Subversive Solution Experimental Evaluation Aftermath Lessons Learned Concluding Remarks

4 BitTorrent Overview Leech Seed Tracker Seed Leech Seed

5 Two months later Tracker? Seed Leech Seed Seed

6 Problem Statement How to provide a means for peers to retrieve data long after seeds have disappeared? Requirements: Must provide public access. Must not allow malicious users to destroy data. Must allow all content. Must be free!

7 Case Studies Average time a peer remains connected to swarm after finished downloading = 7 hours Izal et al., Dissecting BitTorrent: Five Months in a Torrent's Lifetime Average life-span of a torrent = 9-13 days Guo et al., Measurements, Analysis, and Modeling of BitTorrent-like Systems Faster departure rates for copyrighted content. Pouwelse et al., The Bittorrent P2P File-sharing System: Measurements and Analysis. 2005

8 BitTorrent Security Problems Swarm participation is public. Private invite-only communities can be breached. Pair-wise communications can identify type of traffic (see SandVine).

9 Graffiti Network Project Distributed file-sharing protocol that utilizes third-party entities as storage sites and data transfer intermediaries: Storage sites are likely unwanted participants. Target abandoned areas of the web. Massive replication provides durability. Strict tit-for-tat: Peers must make a new replica for each piece that they download.

10 Graffiti Network Overview <Encryption Key, Start/Stop Sequence, Checksum> Tracker Binary Data Encrypted Data Base64 Text Seed Leech Seed

11 Graffiti Network Benefits Similar to steganographic data systems: Plausible deniability. Difficult to throttle HTTP traffic. Multi-site subpoenas. Integration with BitTorrent: GN tracker incentivizes network participation through BT peer discovery. Pieces obtained through BT or GN can be shared with either network.

12 Storage Site Alternatives Good: Cloud Resources (Amazon S3), Usenet Better: File upload sites (RapidShare), Free webmail, Image upload services, Message Boards, Pastebins, Blogs. Best: Wikis!

13 Experimental Evaluation Graffiti Network prototype: Tracker: MySQL + Django Client: Python + libtorrent Hybrid BitTorrent + Graffiti system. Goal: Measure the lifespan of data stored on third-party storage sites outside of our control. Use Graffiti Network to store a 700MB Linux ISO

14 MediaWiki Most widely used open-source wiki software: Likely to be many novice users and install-thenforget installations. Default permissions are very lax: Anonymous edits enabled by default. Non-trivial to install CAPTCHA plugins: Default SimpleCAPTCHA is useless.

15 SimpleCAPTCHA Authentication October 12, 2009

16 Discovering Target Sites Scraped two well-known search engines looking for MediaWiki installations: Used phrases indicative of a fresh install + a random word from dictionary. Example: `Configuration settings list squirrels Total Sites Found: +22,000 Probe each site to determine security and whether it is abandoned.

17 Target Site Criteria No Wikimedia Foundation Sites: Example: Wikipedia, Wikitionary, etc. No commercial hosting sites: Example: wikia.com Last update >= 3 months No CAPTCHAS. If requires login, allow registration.

18 Open MediaWiki Sites # of Sites Anonymous Edits: 8,483 Open Registration: 5,983 Puzzle Protection: 1,157 Total Open: 15,623 Total Open+Abandoned: 11,987

19 Experiment Setup Leave a calling card to inform non-network users of the system: Link back to project website using URL containing unique tracking code. Do not modify existing pages. More resilient approach would be to modify homepage and then immediately rollback. Only store one replica per site.

20 Example Replica Random Title+User Exact Revision Calling Card Tracking URL Base64+Encrypted Payload

21 Tracking Page October 12, 2009

22 We turn it on Simulation started April 10 th, 2009 Shutdown on April 11 th, 2009 Only stored 5,646 replicas before I got a call

23 Aftermath Reversed pages (since we couldn t delete). Posted apology. Removed list of open MediaWiki sites. Removed link to source code. Removed Brown logo.

24 Unwanted Notoriety? October 12, 2009

25 Constructive Feedback You should have asked me, I would have let you store the data Not a real-world experiment. You should have ran it in your own local cluster/planetlab Again, not real-world conditions. You should have ran it from Starbucks/Panera Hiding makes it looks like you know you are doing something wrong.

26 Replica Availability April 10 th, 2009 to October 11 th, 2009 percentage 0.6 Total Replicas Removed Replicas with Tracking Click-Throughs # of days since replica created

27 Replica Availability by Protection April 10 th, 2009 to October 11 th, 2009 Puzzle Protected Registration Protected Anonymous Edits percentage # of days since replica created

28 Protection Enhancements recaptcha is the answer: Allow anonymous edits, but require verification. Does not require server-side graphics libraries. Throttle users creating too many pages or posting data larger than threshold. Automatically lock-down abandoned sites: Should be part of all open-source CMS software.

29 Lessons Learned Be careful how you advertise yourself. Consider how your system will affect others. Consult others outside of your project. Be open and upfront about project. Don t pee in the pool!

30 Project Status Checking replica status daily. Two workshop submissions, two rejections: IPTPS 09 WOOT 09 Planning to submit one last time: LEET 10 (April 5 th, 2010)

31 Concluding Remarks Final vindication: The system works! Tread lightly Off probation at the end of this semester!

32 More Information Additional info is available at our website: Source code available through SVN: Questions/Comments?