Ratio Vulnerability in BitTorrent Discovered

An anonymous reader writes "The "vulnerability" has been tested on all the major torrent trackers that use the torrentbits source code. The idea is that you will sniff your torrent info using the HTTP Analyzer and with Firefox you will update your stats to the tracker being identified as a client."

Comments

Not such a big deal?

[AC-x]

The way I look at it is this:

Step 1. Load site logs
Step 2. Do a search for these entries
Step 3. Ban any cheaters

I'm sure this it should be pretty easy to tell fake entries from real ones as I'm guessing that the tracker software, with a known IP address, is the only thing that should be accessing that url.

Re:Not such a big deal?

[KPU]

RTFA. They copy what the bittorrent client (running on their computer from their IP address) reports to the tracker. Then all they do is send a falsified version. The logs would show both spoofing and legitimate clients accessing the same url.

What one could do is search the logs for jumps in upload rate. For example, a user might be going 10 kb/s upload for a long time (while getting the file). Then all of a sudden it went to 10 Gb/s and nobody joined the torrent. Further if the sum of all downloads during that period is less than the sum of all uploads then somebody is probably cheating.

BT protocol flaw?

[dancallaghan]

Seems kinda dumb that BT trackers rely on the clients to honestly report their ratios/upload amounts. Is it just this tracker implementation, or does the BT protocol work that way?

IIRC the ed2k network had a similar issue in its infancy, nowadays (with eMule anyway) "upload credit" is maintained as a relationship between each client (i.e. I know how much a person has sent to me, so I know how much I should reward them in my upload queue) -- no potential for abuse that way.

Exploiting Ratios is easy

[AngryScot]

Easy way to get your ratio up is to join a site that only allows you two slots on the tracker at first. Either download two small files and seed them or upload two of your own torrents and stay connected to the tracker so you are using your two tracker slots.

Using azeurus (or any client which stores peer IP's) stop on of your seeding files and connect to a large file you want to download, let your client pick up some IP's or until you are getting the file at a decent speed.

Now stop your download and begin seeding again, when you restart your download you will connect to the clients and your download will be resumed but the tracker will not be updated with the data you are download. AFAIK users who you are leeching off will still be given credit for all the data you upload.

Worked on elite torrents and some of the sites I use now.

Meh..

[EiZei]

Being a formet BT tracker admin we knew of this well over a year ago.

Just download the original client and change the source code if you want to automate the process.

Easy to detect cheaters

[Anonymous Coward]

It is very, very, very easy to detect cheaters on private torrent sites -- which are the only sites where ratios really matter anyway.

Globally, across an entire torrent, the amount of data uploaded can't be greater than the amount downloaded. Think about it for more than three seconds and its rather obvious. Every single client reports their usage to the tracker. Every byte you upload must have been downloaded by another client, who also reports their usage.

And hash fails are counted as downloads by the client, so thats not a factor.

If the torrent admin looks through a torrent and sees Joe Cheater claiming to have uploaded 3.6GB, and it just so happens that the amount uploaded is 3.6GB more than that downloaded...its not hard to work out who's spoofing their stats.

Granted, the situation becomes worse when multiple people are cheating, but it's not too hard to track users who are on multiple torrents and pick out usernames who always appear to be on the torrents with the discrepancies.

I've seen it happen on private sites before, and it will happen again.

The short answer is -- you can fudge your stats all you want. But unless you can find a way to fudge someone elses stats to minus the discrepancy, you'll get caught. And rightly so.

Re:obviousness, and where the vulnerability really

[moonbender]

Ratios is a concept that is pretty stupid with BitTorrent.

Right, stupid as in "people routinely saturate their downstream when ratio is enforced because everyone keeps seeding after having downloaded" and as opposed to smart, non-ratio trackers as in "people often get crappy speeds especially when they're on asymmetric connections because everyone kills the client after having downloaded the file".

BT is kind of self-regulating, upload more and you download more. But the self-regulation only goes so far and offers no incentive whatsoever to actually seeding files. Since a vast majority of the peers are on asymmetric links (e.g. ADSL), there obviously is a need for pure seeds to keep network speed at a high level, because otherwise the maximum network speed would be limited by the total upload speed of the asymmetric links.

Discredits RIAA/MPAA evidence

[cpu_fusion]

If anyone gets hauled to court over their use of BT and these "amount shared" statistics are used as evidence against them, having the data be easily forged should help the defendent.