Torrent poisoning is intentionally sharing corrupt data or data with misleading, deceiving file names using the BitTorrent protocol. This practice of uploading fake torrents is sometimes carried out by anti-infringement organisations as an attempt to prevent the peer-to-peer (P2P) sharing of copyrighted content, and to gather the IP addresses of downloaders.Cuevas, R. et al. (2010) Is Content Publishing in BitTorrent Altruistic or Profit-Driven? . Proceedings of the 6th International Conference on emerging Networking EXperiments and Technologies (ACM CoNEXT 2010). Philadelphia, USA. 30 November - 3 December 2010.
Methods of attack
Decoy insertion Decoy insertion (or content pollution) is a method by which corrupted versions of a particular file are inserted into the network. This deters users from finding an uncorrupted version and also increases distribution of the corrupted file.Luo et al (2009). An Effective Early Warning Scheme against Pollution Dissemination for Bittorrent . In: Global Telecommunications Conference, 2009. Honolulu, 30 November – 4 December. New Jersey: IEEE. pp. 1 -7. A malicious user pollutes the file by converting it into another format that is indistinguishable from uncorrupted files (e.g. it may have similar or same metadata). In order to entice users to download the decoys, malicious users may make the corrupted file available via high bandwidth connections.Kong, J. et al (2010). A Study of Pollution on Bittorrent . In: The 2nd International Conference on Computer and Automation Engineering. Singapore, 26–28 February 2010. New Jersey: IEEE. pp. 118-122. This method consumes a large amount of computing resources since the malicious server must respond to a large quantity of requests.Kong, J. et al (2010) The Evaluation of Index Poisoning in BitTorrent. In: D. Wen. et al (eds). Proceedings of the Second International Conference on Communication Software and Networks. Singapore. 26–28 February 2010. New Jersey: IEEE. pp. 382-386. As a result, queries return principally corrupted copies such as a blank file or executable files infected with a virus.Santos et al (2010). Choking Polluters in Bittorrent File Sharing Communities . Network Operations and Management Symposium (NOMS) 2010. Osaka, 19–23 April 2010. New Jersey: IEEE. pp. 559-566. There were known cases when a company had created a special version of a game and published it on file sharing services (e.g. Game Dev Tycoon) advertising it as cracked, having undocumented hidden functionality, making it impossible to win this variant of the game.
Index poisoning This method targets the index found in P2P file sharing systems. The index allows users to locate the IP addresses of desired content. Thus, this method of attack makes searching difficult for network users. The attacker inserts a large amount of invalid information into the index to prevent users from finding the correct resource. Invalid information could include random content identifiers or fake IP addresses and port numbers. When a user attempts to download the corrupted content, the server will fail to establish a connection due to the large volume of invalid information. Users will then waste time trying to establish a connection with bogus users thus increasing the average time it takes to download the file. The index poisoning attack requires less bandwidth and server resources than decoy insertion. Furthermore, the attacker does not have to transfer files nor respond to requests. For this reason, index poisoning requires less effort than other methods of attack.
Spoofing Some companies that disrupt P2P file sharing on behalf of content providers create their own software in order to launch attacks. MediaDefender has written their own program which directs users to non-existent locations via bogus search results. As users typically select one of the top five search results only, this method requires users to persevere beyond their initial failed attempts to locate the desired file. The idea is that many users will simply give up their search through frustration.
Interdiction This method of attack prevents distributors from serving users and thus slows P2P file sharing. The attacker's servers constantly connect to the desired file, which floods the provider's upstream bandwidth and prevents other users from downloading the file.
Selective content poisoning Selective content poisoning (also known as proactive or discriminatory content poisoning) attempts to detect copyright violators while allowing legitimate users to continue to enjoy the service provided by an open P2P network. The protocol identifies a peer with its endpoint address while the file index format is changed to incorporate a digital signature. A peer authentication protocol can then establish the legitimacy of a peer when he/she downloads and uploads files. Using identity based signatures, the system enables each peer to identify infringing users without the need for communication with a central authority. The protocol then sends poisoned chunks to these detected users requesting a copyright protected file only. If all legitimate users simply deny download requests from known infringers, the latter can usually accumulate clean chunks from colluders (paid peers who share content with others without authorization). However, this method of content poisoning forces illegitimate users to discard even clean chunks, prolonging their download time.
Voluntary Collective Licensing and the Open Music Model are theoretical systems where users pay a subscription fee for access to a file-sharing network, and are able to legally download and distribute copyright content.von Lohmann, F. (2008) A Better Way Forward: Voluntary Collective Licensing of Music File Sharing . Electronic Frontier Foundation. Retrieved 2011-04-22. Selective content poisoning could potentially be used here to limit access to legitimate and subscribed users, by providing poisoned content to non-subscribed users who attempt to illegitimately use the network.Lou, X., Hwang, K. and Zhou, R. (2007) Integrated Copyright Protection in Peer-to-Peer Networks . In: 27th International Conference on Distributed Computing Systems Workshops (ICDCSW'07). Toronto, Canada. 22–29 June 2007. p. 28
Eclipse attack The eclipse attack (also known as routing-table poisoning), instead of poisoning the network, targets requesting peers directly. In this attack, the attacker takes over the peer's routing table so that they are unable to communicate with any other peer except the attacker. As the attacker replicates the whole network for the targeted peer, they can manipulate them in a number of ways. For example, the attacker can specify which search results are returned. The attacker can also modify file comments. The peer's requests can also be directed back into the network by the attacker and can also be modified. It also checks data randomly for any errors found in that.Locher, T. et al. (2010) Poisoning the Kad Network . In: Kant, K. et al (eds). Distributed Computing and Networking. Heidelberg: Springer. pp. 195-206.
Uncooperative-peer attack In this attack, the attacker joins the targeted swarm and establishes connections with many peers. However, the attacker never provides any chunks (authentic or otherwise) to the peers. A common version of this attack is the "chatty peer" attack. The attacker establishes connection with targeted peers via the required handshake message, followed by a message advertising that they have a number of available chunks. Not only does the attacker never provide any chunks, they also repeatedly resend the handshake and message. These attacks prevent downloads as, essentially, the peer wastes time dealing with the attacker, instead of downloading chunks from others.Dhungel, P. et al. (2008) A Measurement Study of Attacks On Bittorrent Leechers. In: Proceedings of the 7th International Conference on Peer-To-Peer Systems (IPTPS ’08). Tampa Bay, Florida. 25–26 February 2008. Berkeley: USENIX. p.7.
Barriers to torrent poisoning There are several reasons why content providers and copyright holders may not choose torrent poisoning as a method for guarding their content. First, before injecting decoys, content providers have to normally monitor the BitTorrent network for signs that their content is being illegally shared (this includes watching for variations of files and files in compressed formats).
This process can be expensive and time-consuming. As a result, most poisoning is only continued for the first few months following a leak or release.Anderson, N. (2007). Peer-to-peer poisoners: A tour of MediaDefender . Ars Technica. Retrieved 2011-03-30. Second, it is also unlikely that torrent poisoning can be successful in disrupting every illegal download.
Instead, the aim of content providers is to make illegal downloads statistically less likely to be clean and complete, in the hope that users will be discouraged from illegally downloading copyright material. Content providers and copyright holders may decide that the financial outlay is not worth the end result of their efforts.
Countermeasures The methods of attack described above are not particularly effective on their own, as for each measure effective countermeasures have evolved. These measures must be combined in order to have a significant impact on illegal peer-to-peer filesharing using BitTorrent protocols and Torrent files.
BitTorrent is highly resistant to content poisoning (as opposed to index poisoning), as it is able to verify individual file chunks.Lou, X. & Hwang, K. (2006). Adaptive Content Poisoning To Prevent Illegal File Distribution in P2P Networks Retrieved 2011-03-21. Overall, BitTorrent is one of the most resistant P2P filesharing methods to poisoning.Lou, X. and Hwang, K. (2009) Collusive Piracy Prevention in P2P Content Delivery Networks . IEEE Transactions on Computers. 58 (7) pp. 970-983. On private tracker websites, where all posted torrents can be traced to a particular member, poisoned torrents can be quickly labeled and deleted and the poster can be banned, preventing further introduction of poisoned torrents by that user. Public torrent tracker sites have enabled the ability to report if a torrent has been poisoned (or is fake or malicious in any way). Thus torrent files shared by public trackers can have similar levels of quality assurance as Private Tracker websites. Tracker technology (as well as BitTorrent client programs) has improved over time, and many kinds of spoofing that were possible in the past are no longer possible. The BitTorrent protocol uses TCP exclusively, but the newer, widely supported uTP protocol uses UDP,
Legal issues In September 2004, Altnet sued the Recording Industry Association of America, Overpeer, Loudeye, MediaSentry and others, claiming that their spoofing services violated Altnet's patent for a file identification method called TrueNames.Cowley, S. (2004) . PCWorld. Retrieved 2011-04-23.