UW Computer Security Research and Course Blog

Summary
BitTorrent is a peer-to-peer communications protocol that has risen in popularity very rapidly.  It is a file-distribution protocol that facilitates transferring large files between peers.  In order to download a certain set of files, a user would typically find a .torrent file which would connect them to a tracker.  This tracker would provide a list of peers that the client can connect to.  BitTorrent’s wild success is due largely to the low cost to the initial content distributors and it’s redundancy.  Peers with complete copies of the files listed in the torrent are known as seeds.  As other peers download from seeds, they acquire parts of the torrent which they inturn upload themselves.  This usually results in increasing numbers of seeds and makes it far easier for other peers to successfully connect and begin downloading.

Given the incredibly low cost for any person to begin distributing content and the low cost of entry for other peers to join in, BitTorrent has become a dominant method of transferring files between computers.  While there are many legitmate uses, BitTorrent has become a very popular and easy way to acquire copyrighted materials.  Previous to BitTorrent, the methods to acquire copyrighted materials were more obscure and less mainstream.

Assets and Goals

• Content distribution network: BitTorrent provides a content distribution model that is very valuable to it’s user.  It provides a convenient way to transfer files for commercial and personal purposes.  Companies use BitTorrent for content delivery to customers.  Examples include 20th Century Fox, Comedy Central, and Blizzard Entertainment which bases it’s updating software for World of Warcraft.
• Accurate file transfers: BitTorrent wants to ensure that files received are authentic, accurate, and have not be forged.
• Privacy: Users may not want others observing the files that they are sharing, or that the fact that they even are sharing files.
• Optimal Network Usage: BitTorrent wants to maximize the effectiveness of client connections and maximize peer upload rates.  By doing so, it allows other peers to download quicker and begin uploading themselves.

Adversaries

• Content producing organizations: Many content producing companies such as motion picture companies and music labels have vocalized their opposition to BitTorrent.  Industry groups as well as individual companies have initiated legal actions against BitTorrent trackers and torrent indexing sites.  A notable recent example would be The Pirate Bay legal case.
• ISPs: The significant amount of traffic that BitTorrent generates gives ISPs a financial incentive to curb that traffic.  A notable example would be Comcast which for a period did substantial traffic shaping on BitTorrent by forging TCP reset packets.  This dramtically slowed download rates.
• Government: Government has an interest in enforcing existing law and investigating illegal activities.  One issue is that in many jurisdictions BitTorrent is used to distribute intellectual property protected by copyright.
• Leechers: Users that are self-interested would be motivated to download as fast as they can while uploading as little as possible.

Weaknesses:

• BitTorrent lacks any sort of anonymity.  All peer IP addresses are visible to other peers.  Media companies have used these IP addresses as evidence while prosecuting BitTorrent users.
• Torrent poisoning: Malicious users can intentionally provide bad chunks to peers.  This is called “torrent poisoning” as it forces clients to redownload chunks.  As these malicious users are continually spreading bad chunks, many peers get bad chunks and continue connecting to other peers.  This dramatically increases the amount of time to download a file.
• Fake Files: BitTorrent’s reliance on .torrent files has resulted in malicious users placing fake torrents on popular indexing sites.  Users are tricked into waiting substantial amounts of time to download something that is useless to them.
• BitTorrent also relies on having enough seeds or other peers that are uploading.  If there are many users downloading at higher rates than they are uploading at, extra seed capacity quickly is taken up and download rates fall.  This results in long download times for most of the peers.  There is even a BitTorrent client that purports to be able to exploit the BitTorrent protocol and allow downloading without uploading.

Potential Defences:

• Encrypting traffic can provide increased privacy from unwanted monitoring from organizations such as a peer’s ISP.  By disguising traffic, specific filters targeting BitTorrent headers can be avoided.
• BitTorrent already includes chunk hashes in the .torrent files so peers know when they receive bad junks.  However, it could be possible to add peer notifications where peers who receive bad chunks could notify others of which peers they are receiving bad chunks from.  These trouble making peers could then be avoided.
• Torrent indexing sites can employ rating systems and/or provide notifications for which users are the original authors.  For examply, some torrent sites will verify that files have been uploaded from the original author’s website.
• Private trackers can be used to encourage upload rates.  Users would be required to register with the tracker which then keeps track of users’ share ratios (uploaded/downloaded).  The tracker can remove peers that have ratios that are too low.
• BitTyrant is a BitTorrent client developed at the University of Washington that proposes a unique way of attempting to address self-interested peers.  BitTyrant peers will still utilize their max upload, but will upload to people sending to them the fastest.  The logic is that this will allow peers with faster upload speeds to get more chunks and seed.  These peers will be able to share faster than self-interested peers which will have capped uploads.  While this was a research attempt at improving BitTorrent performance, community reaction (BitTorrent community, not academic) has ranged from sceptical to hostile.
• IP Blacklisting: The BitTorrent community maintains lists of IP ranges for organizations one likely would not want snooping on traffic.  Although there are a number of issues with this solution, it still does block many peers from unwanted organizations.  One of the most popular blacklisting solutions is PeerGuardian which also can block HTTP traffic.

Evaluation and Conclusion:
BitTorrent and its users do face a number of threats.  These are both technical and legal.  These threats are very real to users.  Fake files, torrent poisoning, and ISP traffic shaping have been shown to be used in practice by the aforementioned adversaries.  The legal threats that have become associated with BitTorrent are not directly a result of BitTorrent, but have come about in an attempt to frighten users from it’s ease of use in acquring copyrighted materials.  BitTorrent continues to evolve in attempt to meet these issues.  Trackerless torrents were introduced to increase redundancy and reduce the impact of tracker failures.  Encryption was introduced and detection tools were developed to detect and counteract BitTorrent traffic shaping.  BitTorrent’s design has proven remarkably resilient and resistent to failure.  The ethics of BitTorrent also continue to rage on.  Critics point to it as a tool of piracy, while proponents point out that it is just a tool that has many legitimate uses.  BitTorrent will likely to continue to be successful barring a major shift in intellectual property law criminalizing things that are currently not illegal.  However, given how far it has spread and the benefits of the technology for all uses including legitimate ones will likely preclude its demise.

Jonathan Fung

Alex Meng