PeertoPeer Network Attacks

1
Peer-to-Peer Network Attacks

• Author Tracy Harris
• TDC 477

2
Introduction

• P2P file sharing systems have indexes which
  allows users to
• Discover locations of IP addresses
• Port numbers of desired content
• Allow users to search location of desired titles.
  
• The next few slides will give an overview of two
  attacks that affect the P2P network.

3
Index Poisoning Attack

• How the attack works
• This attack inserts massive numbers of bogus
  records in the index for a set of targeted
  titles.
• Falsely advertises copies of the targeted titles.
  
• One of the most common methods for poisoning is
  to use randomly chosen file identifiers.
• Impact
• Failure to locate actual file resulting in a
  display in the GUI more sources needed or
  looking .
• Download of corrupted existing version of file.

4
SDBOT Attack

• How the attack work
• This attack propagates by sending a link to all
  the contacts of an users Instant Messenger.
• A copy of the worm is downloaded onto the system,
  and it also appends a message in an attempt to
  entice the recipient to click the said link and
  download the worm.
• SDBOT is also capable of allowing a remote user
  to access the affected system.
• Impact
• It executes the commands locally on the infected
  machine, providing remote users virtual control
  over affected systems.

5
Conclusion

• Detection Mechanism(s)
• Index Poisoning Attack
• Below are some steps used for detecting an Index
  Poisoning attack
• Create a list of the advertised versions, and for
  each advertised version a list of the distinct
  advertised copies.
• Determine the harvested data which advertised
  versions are poisoned, which are polluted, and
  which are clean.
• Determine the poison and polluted levels, for
  both versions and copies.
• SDBOT Attack
• A combination of the latest DATs and the Engine
  will be able to detect and remove this threat.