Olaf van der Spek
OvdSpek at LIACS.NL
Wed Jan 26 03:59:19 EST 2005
Martin Burggraf wrote:
> Olaf van der Spek wrote:
>>Why would the 'attacker' restrict himself to a single torrent (or a
>>single tracker) or only one 'announce'?
> good point... however, I think a DDoS attack requires a certain amount of
> coordination to work and in case of BT the 'attacker' has no guarantee when or
> if the clients are going to connect to the victim. When a torrent gets more
> peers, the possibility that the faked address is in the returned peer list
> decreases, so the best targets are probably relatively small swarms, hence it
> even requires more of those which implies more effort from the bad guy.
> IHMO BT doesn't really guarantee the necessary coordination so the costs are
> not worth it; there are definately more effective methods to carry out a DDoS.
It requires one announce to a tracker to a torrent with a swarm of 50
peers to get the victim IPA in the list for 30 - 45 minutes.
All other peer will announce at least once in those 30 minutes and will
get the victim IPA.
So at the cost of one announce you 'get' 50 TCP connects to the victim.
Isn't that a nice 'attack' multiplier waiting to be abused?
You can announce to as much torrents as you want.
Bigger swarms would also work, but not be more effective.
> I think its just an unnecessary waste of ressources to let the tracker do this
> kind of check.
> Or does someone know of an actual DDoS-Attack with BT which achieved the result?
Yahoo! Groups Links
<*> To visit your group on the web, go to:
<*> To unsubscribe from this group, send an email to:
BitTorrent-unsubscribe at yahoogroups.com
<*> Your use of Yahoo! Groups is subject to:
More information about the BitTorrent