[bittorrent] DHT: 'Zo' Client

Adrian Ulrich torrent at blinkenlights.ch
Mon Apr 9 03:11:58 EDT 2012


I've noticed a strange client that identifies itself as 'Zo\x00\x05' (and sometimes \x04).
Does someone have an idea on what this client is?

The client creates quite some DHT traffic and seems to like IPv6 for some strange reason:
More than 50% of all queries received via IPv6 are sent by this client.
(However: Most source IPs are Teredo addresses).

These clients are also sending announces with bogus info hashes (google doesn't know about them -> they don't seem to belong to a real torrent).
such as '8eaaaba009ce93f2a678d9fb6dcd39170c5fc1e0':

All clients 'announced' to this info_hash are also using the ZO brand and seem to speak some sort of the BitTorrent protocol...
..but they do not support ut_metadata :-/

So what is this? Is it some kind of Botnet?

The DHT-Queries look normal:

          "y" => "q",
          "a" => {
                   "id" => "7\335\234H\340\177\235\374\332\246\325\341Tc\303\373\203`WK",
                   "token" => "r\22!\@#q\231#\26\$\$\230\30%\203\@W",
                   "port" => 30121,
                   "info_hash" => "\217\223\353\301O\376\27\nk/\371\352I\314]n\312\21\276\237",
                   "seed" => 1
          "q" => "announce_peer",
          "v" => "Zo\0\5",
          "t" => "\37n"

          "y" => "q",
          "a" => {
                   "want" => [
                   "id" => "L\236\332%\242\264kW\347b\220\256\237\354\310s\271\225}\20",
                   "noseed" => 1,
                   "info_hash" => "\216\252\253\240\t\316\223\362\246x\331\373m\3159\27\f_\301\340",
                   "scrape" => 1
          "q" => "get_peers",
          "v" => "Zo\0\5",
          "t" => "D\220"


 RFC 1925:
   (11) Every old idea will be proposed again with a different name and
        a different presentation, regardless of whether it works.

More information about the BitTorrent mailing list