Attack on P2P torrent network

bittorrent-logo-purple

Unknown attackers are sabotaging popular TV and movie torrents by flooding swarms with IPv6 peers. This new method of peer flooding makes a lot of people think there are issues with torrents. From an anti-piracy point of view it is achieving the purposed effect.

It is unclear who is behind the attacks, but considering the fact that it targets nearly all new TV and movie torrents, it could very well be a novel anti-piracy strategy. In any case, it’s definitely one of the most effective attempts to disrupt BitTorrent downloads in recent years.

The sabotaging technique tries to make it impossible for downloaders to connect to other people by overwhelming BitTorrent swarms with IPv6 peers.

Because of its focus on IPv6, not all users are affected, but those who are sometimes see their download speeds grind to a halt. As a result it can take days to download a file, if at all.

In short the process works as follows. The attacker joins a popular torrent swarm with hundreds, if not thousands of IPv6 addresses. These fake peers request data from real downloaders, quickly filling up their request queues.

The fake peers never exchange any data but keep the client busy until they are banned, as is shown in the screenshot below.

ipv6f
The attack has been confirmed to affect the popular client uTorrent. After a few minutes uTorrent does ban the malicious peers, but this makes little difference as the attackers use so many different IP-addresses.

Because all the fake peers have filled up the connection slots, real peers can no longer connect. This means that hardly any real data is transferred.

“Got unchoke from µTorrent 3.4.3 (12.345.678.9:9999), can’t request immediately because request queue is full”

TF was tipped off by the operator of one of the largest torrent trackers, who informed us that this type of attack is rampant. Many people are complaining about slow download speeds or torrents that are stuck.

Detailed article on  Torrentfreak

Share

Leave a Reply