Slashdot Mirror
Researchers Outline Targeted Content Poisoning For P2P Data
Diomidis Spinellis writes "Two USC researchers published a paper in the prestigious IEEE Transactions on Computers that describes a technique for p2p content poisoning targeted exclusively at detected copyright violators. Using identity-based signatures and time-stamped tokens they report a 99.9 percent prevention rate in Gnutella, KaZaA, and Freenet and a 85-98 percent prevention rate on eMule, eDonkey, and Morpheus. Poison-resilient networks based on the BitTorrent protocol are not affected. Also the system can't protect small files, like a single-song MP3. Although the authors don't say so explicitly, my understanding is that the scheme is only useful on commercial p2p distribution systems that adopt the proposed protocol."
Abstract: Today's peer-to-peer (P2P) networks are grossly abused by Illegal distributions of music, games, video streams, and popular software. These abuses have resulted in heavy financial loss in media and content industry. Collusive piracy is the main source of intellectual property violations within the boundary of P2P networks. This problem is resulted from paid clients (colluders) illegally sharing copyrighted content files with unpaid clients (pirates). Such an on-line piracy has hindered the use of open P2P networks for commercial content delivery. We propose a proactive poisoning scheme to stop colluders and pirates from working together in alleged copyright infringements in P2P file sharing. The basic idea is to detect pirates with identity- based signatures and time-stamped tokens. Then we stop collusive piracy without hurting legitimate P2P clients. We developed a new peer authorization protocol (PAP) to distinguish pirates from legitimate clients. Detected pirates will receive poisoned chunks in repeated attempts. A reputation-based mechanism is developed to detect colluders. The system does not slow down legal download from paid clients. The pirates are severely penalized with no chance to download successfully in finite time. Based on simulation results, we find 99.9% success rate in preventing piracy on file-level hashing networks like Gnutella, KaZaA,Area, LimeWire, etc. Our protection scheme achieved 85-98% prevention rate on part-level hashing networks like eMuel, Shareaz, eDonkey, Morpheus, etc. Our new scheme enables P2P technology for building a new generation of content delivery networks (CDNs). These P2P-based CDNs provide faster delivery speed, higher content availability, and cost-effectiveness than using conventional CDNs built with huge network of surrogate servers.
This isn't unbiased in the least. Sure, arguably it is "research" but calling them researchers from an university makes them seem neutral at best.
Taxation is legalized theft, no more, no less.
Actually, poisoning P2P networks as a commercial venture could be prosecuted as theft-by-deception.
Stealing bandwidth is a crime. Downloading songs isn't, if you aren't profiting form it.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
What's to prevent poisoning legal p2p? There are plenty of examples of copyrights being inappropriately asserted. The technology itself doesn't discriminate.
Humans had discovered methods to speedily and automatically transmit mountainous volumes of data. It was a new frontier, a utopia where information was shared peacefully between the people who wanted to see it. And what was its downfall? Not the anarchists, or the communists, or the Islamic fundamentalists, but the so called leaders of the free world.
"We had to do it," they said, "there is such a thing as too much freedom."
Poisoning the well. What an insightful revelation. Surely it's never been done before, maybe they should throw a patent on it.
"In the absence of the ability to establish the attribute of truth they tried to establish the noble attributes."
Poison-resilient networks based on the BitTorrent protocol are not affected.
So, the most effective method of P2P is the one that's immune. Really, Edonkey? who uses that? Find yourself a good private BT tracker and be done with it. There are many to choose from. Not only are they immune to content filtering, but due to ratio requirements and the possibility of getting banned if you misidentify content you upload, they're immune to content poisoning as well as data poisoning and have pretty much guaranteed high speed across the board.
I work for the Department of Redundancy Department.
I was curious as to how they were poisoning Freenet, which should be robust against this with its Forward Error Correcting.
According to the paper, Freenet falls under the category of the "Gnutella family" (p.2). The Freenet Project that I know is in no way related to Gnutella.
Are they referring to a different file sharing program by the name of Freenet, or is this statement of theirs just plain inaccurate?
The paper won't download here, so I'm asking without RTFA, but how can this work against Freenet? Do they discuss Freenet in the paper at all? Freenet does chunk-level hashing, and the network enforces that the data matches the hash at all steps. Nodes returning invalid data will rapidly get dropped by their peers. Attacks like this are something that Freenet is explicitly designed to prevent. Also, the anonymity guarantees that Freenet makes would make it hard (potentially very hard) for them to identify a single user, let alone "collusion".
I'm forced to wonder whether the researchers mention Freenet at all, or if the poster is simply lumping Freenet in with other p2p apps that it has very little in common with. (Bittorrent and Freenet should be similar in some ways to their resistance against this attack, but Freenet's strong anonymity guarantees should make it more resistant. The fact that a node engaged in widespread poisoning will have trouble even staying connected makes Freenet even more resistant.)
These corporate moneymongers are sad that they can only buy 3 boats this year instead of two
lolwut? Why would someone be sad that they could afford more boat than they originally expected?
'mechanical law of nature'
I don't think that phrase means what you think it means.
Plenty of people already do it - heck even the musicians are starting to turn away from RIAA-backing labels. The RIAA however has found another way to keep their businesses alive: government bailouts. Just like GM, Ford, Chrysler and a host of other companies that couldn't cut it in the new world, they are now being funded by the government which just creates a law about who should pay for these old businesses. Who's paying for it now: the radio stations. The government has decided that the radio stations should pay the RIAA for songs they play. Over the years, the labels have paid DJ's to promote their music (payola), gotten free airtime etc. etc. and now they expect the radio stations to pay it all back. They already pushed the internet radio stations to pay more for the right to play any song, now they are pushing the am/fm radio stations to pay for the rights to play any song.
The RIAA has effectively become through lobbying a government agency. They are being allowed to tax anybody who plays or makes public any type of music in any type of way even if the musician or label is not signed with them.
Custom electronics and digital signage for your business: www.evcircuits.com
These guys are from USC, not UCLA. As a UCLA graduate, I am extremely upset that anyone would make this mistake. USC students and professors are smelly, unclean, spoiled children who work for the RIAA. UCLA students and professors are the opposite.
Never, EVER, confuse us again.
Have you ever actually used a bittorent client before?
There is no such thing as an overseeded torrent. There are underseeded torrents, and those are frustrating, but there is no such thing as an overseeded torrent. The general idea with upload ratio requirements is that it encourages you to never stop seeding a torrent. If 100 people are seeding and only 3 are downloading, those three get the file extremely fast, and your bandwidth isn't taxed. If you download enough content that you are on a private tracker, then you should have a number of torrents to share. If you aren't downloading all that much, then it will be easy to keep a 100%+ share ratio. If you ARE downloading a lot, you should still be in the 50% range, and eventually you will hit critical mass and the ammount you download won't be able to keep up with the amount you upload.
It's good for everybody. Plus, if a private tracker has a very high seed rate, chances are the required share ratio will be lowered. It creates a win-win situation.
Remember, no such thing as an overseeded torrent. If you download a lot, you WILL share a lot. If you keep sharing after you download, you will soon be sharing more than you download. People move on, quit sharing, lose their computers, etc.
Your share ratio math ignores a lot of things that reduce the amount of data on the network which occur all the time. It's actually pretty easy to exceed 100% share ratios for everybody on the network. If you can't see how it's because you've locked yourself in a tiny box and completely ignored outside factors which remove data and introduce data without affecting increasing the amount of data a person can download. Whenever someone adds a new download to the tracker, the potential share ratio for everyone in the network increases. Whenever a new member joins, the potential share ratio for everyone on the network increases. Eventually it balances out to 100%, but the network is ever changing so it never actually gets there.
Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
I read the summary as them finding a way to create a p2p network of 'customers' (clients who pay to be in your p2p network where you deliver paid content) and protecting yourself from the 'customers' who 'collude' (e.g. hacked client s/w?) with non paying client s/w to allow non paying customers to get the content. I don't think it's about subverting an existing network, it's about protecting a network from subversion. If so then the techniques could presumably be used for other purposes, poisoning surveillance perhaps.
It's entirely possible that the authors do fundamentally believe in the rights of the copyright industry, but that doesn't mean they might not be frightfully ignorant of any number of closely related technologies.
In fact my experience has shown me that fundamentalists tend to be the most narrowly focused people I meet (whatever their beliefs).
Quack, quack.
As a comp sci grad student, here's what I got from a quick reading of this paper:
Imagine that you're a content provider, with paying users. You've decided to distribute content to your users by running a Gnutella-style network. How do we make sure that only paying users can get our content? After all, it's an open network.
We start by sending some sort of magic timestamp-thing to all of the paying users. I didn't read this part in much detail. Anyway, the paying users can all identify each other somehow. They mention that it maintains privacy.
Some of your paying users (the "Clients") are good, virtuous folk, and they're running the Happy Authorized Gnutella software you gave them. Others (the "Colluders") are running Evil Hacked software. No matter what you do, the Colluders are going to send chunks of your precious data to the "Pirates" (anyone who hasn't paid you).
Normally, we'd expect our Clients to ignore requests from our Pirates. This paper instead suggests: let's obligate the Clients to send poison data to the Pirates! The Pirates won't know which chunks are bad; they'll only find out that the file is corrupt once it's finished downloading. The Pirates won't be able to get a good copy, and they'll give up and go away.
And there's one other great thing: we can set up *fake* Pirates, and check which users aren't giving out the poison they're supposed to! So we've served data to all of the Clients; we've identified all of the Colluders; and we've defeated all of the Pirates.
(Bittorrent has data integrity checks for every chunk, instead of every file; that's why it's not vulnerable to this attack...I mean business model).
In summary: This paper describes a way that a company can charge for distributing their own content on a peer-to-peer network. It only works if they control a centralized "transaction server" thThat's why no one has ever at organizes the entire network, and if they control the software of all the "honest" people. They can't destroy our existing networks with it, and it doesn't prevent anyone from turning around and posting the file to BitTorrent once it's downloaded.
The tone of the paper is definitely not as neutral as I feel it should be. What they're trying to say is "there's no obvious way to charge people for running a Gnutella server, because pirates will eat your lunch. But we think we have a way." But it definitely feels like they're putting moral force behind what's really a network algorithms result.
They already tried this about five years ago with poisoned servers. What happened? The Kad search mechanism was adopted and the servers were useless.
The same thing will happen here, the protocol will change, the poisoners will have wasted a lot of money and achieved nothing.
No sig today...
I'm part way through the research paper, the article summary is just plain wrong.
There is no vulnerability here. They CANNOT poison Gnutella, KaZaA, and Freenet, eMule, eDonkey, Morpheus, or any other existing network with this technique. To quote the paper: Presently none of these P2P networks has built with satisfactory support for copyright protection.
The "problem" they want to "solve" is that existing networks to not possess adequate support for poisoning attacks. This paper proposes creating a NEW additional P2P network. They propose deliberately building in special support to ENABLE poisoning attacks.
While I'm sure the RIAA will eagerly read it over while dreaming of world conquest by releasing their own deliberately crippled "legal P2P network" where they get paid for each authorized client-to-client transfer. As far as most readers here are concerned, this is a completely non-newsworthy story, the contents of this paper are completely irrelevant and harmless. There is absolutely nothing new or surprising about the fact that you can deliberately make your software insecure and you can deliberately leave it vulnerable to poisoning. Yes, a P2P new network could be built Defective By Design.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
So what's wrong by buying a boat, forking out money enough to have people work months and feed their families?
I find this mentality a bit shortsighted: if I would have a pile of money in excess (yes, excess) and would "invest it" (say buy an appartmentblock, cash rent and take from people in that way for my "wellbeing") people don't say a thing.
But when someone aqcuires something, which creates work (luxury items need to be made, people make them, and they're expensive because they're not massproduced, right?) you stimulate an economy and economical activity (people can go to work, do something with their time and get paid) yet that is "wrong" because you can't take a boattrip?
As much I would enjoy excessive luxury as well, spending money stimulates an economy. If you have alot of money, the best thing to "make things happen", and give value is to spend it.
I'm working with banks and wealthmanagement software, I don't have such an abdunce of money as I see passing through our software, yet it creates cashflow and because of that cashflow +100 people here are able to work and drive nice company cars. They are happy. Clients are happy. And those who the people who are happy and comfortable (not excessively) pay to get value from are happy as they can make a business. (80% of the people here order their lunch in a small business who deliver to our office. This means they can bill each day for about 320 to run their business.)
While the economic attitude has proven flawed (growth instead of sustainability and stability). Our economy and wellbeing of those in and around it (you and I buddy) depends on the spending.
I do agree on the point the RIAA is a bunch of greedy bastards. And the value demanded for that music or whatever is not align with the perceived and experienced value delivered. But that is another issue.
Instead of looking down on someone with such a badass boat, ask him you can take a ride, chances are it's a very lonely person misguided trying to acquire wealth sacrificing alot you wouldn't sacrifice. Chances are you get your free ride. I've seen that alot.
I think we can keep recursing like this until someone returns 1
I think he has used torrent before. His complaint about "overseeded" torrents was that *you* get squeezed out from offering any upload on a torrent that has a large ratio of seeders-to-downloaders. If you download some old massively-seeded-and-few-downloaders file, it becomes almost impossible to meet private tracker upload ratios. You could seed for a month and end up with a 0.1 upload ratio.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
There is no need for existing protocols to change. This paper cannot be used to attack them. This paper proposes a new paid-P2P network, one deliberately designed to give a central authority (the RIAA) the power to poison the system.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Ask them. It's been well documented that all this complaining about P2P stuff started when executives were faced with the prospect of telling their shareholders that they failed to meet their projected profit increases. ie: For decades they'd been making more and more money every year, then suddenly when technology created hundreds of other ways to entertain people overnight, they didn't make as much more as they were expecting. (That is: they actually DID make more than the previous years. A lot more, by any sane standard, but not as much more as they had hoped).
They spun around, looking for someone to blame, and rather than noting inconvenient things like increased competition from other media or changes in the way people were spending their time, they heard about Napster, which allowed previous non-customers/non-consumers to jump out of their little section of the Venn-diagram and into the section "non-customer/consumer". They pounced, and pretty much ever since have still been trying to explain to their shareholders that only making four-billion more than last year instead of ten-billion more is because of evil 18th-century sea-fairing thieves.
-- 'The' Lord and Master Bitman On High, Master Of All
That's the empression I got too but that still creates a massive "WHY?" in my head.
Why the need for a 'private' P2P network that's not really private at all? If 'pirates' can get into your network, the problem isn't solved by poisoning.
Even if the content providers used a public network, there must be a better way, such as encryption and key exchanges.
And... And this is the killer: it only takes one person to move content from a 'private' network to a public network and they're fucked.
This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
You make some good points, but I take issue with the very idea that the record industry is made of nothing but millionaires.
Sure, a small percentage of people in that industry -- whether they're artists or executives -- do very well, but that's the case with every industry. The IT and Internet industries have their own share, from hard-working executives to stock option millionaires who were at the right place at the right time. Of course, most people who work in IT aren't millionaires, but that's also the case for the record industry.
Many Slashdotters fly the jolly roger proudly, but we also claim not to like the Top 40 crap put out by the major labels -- so we're probably pirating mostly indie stuff. It's a safe bet that the indie labels have an even lower percentage of millionaires than the big labels. But if you choose to buy a track from a big label on iTunes, it's a bit like giving money to Google -- sure, a tiny portion of it goes to the guys on top, but most of it goes to the 99% of the rest of the people who are paid by the company.
"I do agree on the point the RIAA is a bunch of greedy bastards. And the value demanded for that music or whatever is not align with the perceived and experienced value delivered. But that is another issue."
Value isn't absolute. iTunes has sold billions of tracks. Their recent experiment of raising prices on in-demand tracks was a success -- they're making more money. Online music sellers have a very good understanding of the pricing that the market will bear. I've lost count of the times that a $0.99 track purchase or a $10 album purchase have given me hours and hours of enjoyment. Some folks will always choose to pirate, and many will use class warfare or the old "music is too expensive!" as their rationalization. But when Slashdotters claim that iTunes has it wrong, it's a bit like when Slashdotters claim that Microsoft should release Windows as OSS or that next year will *finally* be the year that Linux takes over the desktop. Microsoft won't, Linux won't, and although it's counterintuitive to many Slashdotters, Apple and the music industry as a whole are still making a metric buttload of money.
Sitting in my day care, the art is decopainted.
My annoyance is that "they" presume my downloading means they are losing money. I've been downloading a lot of recent movies lately, and no surprise, the movies are largely crap piled upon more crap (how they ever scored 7 or higher on imdb.com is a mystery to me). The RIAA/MPAA make the assumption that if I had not downloaded, I would have bought the DVD instead.
They presume wrong.
Out of some 20 movies downloaded there was precisely 1 that I will probably buy on DVD, and that's only because my niece wants to see Hannah Montana in 3D. Otherwise I don't waste my money on Hollyweird's shit unless it's exceptionally good. This past 2008-9 season almost nothing met that criteria. So for them to say, "We lost $400," is completely and totally inaccurate.
They are liars. They lost nothing because I'm not a spender. My money gets invested into the stockmarket, not shiny discs, which probably pisses them off.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
The luxury industry has been linked with reducing the size of the middle class, since it tends to greater a broader disparity between those providing goods and services and those consuming them. You are certainly correct, of course, that spending money will 'stimulate the economy' regardless if it comes from the rich or the poor. The question is the type of economy you want to stimulate. Luxury spending tends to stimulate the segment of industry that sees little return back at the lower end of the wage pools. They reap higher profits, and provide fewer goods and services, thus tending towards increasing the divide in wealth. Spending in the lower end 'consumer grade' market tends to stimulate an industry that will increase growth where more goods and services are produced.
Henry Ford famously paid his employees enough so they could buy the cars they were building. Imagine what might have happened to the auto industry if he had catered only to the rich? Compare also to Walmart, who also wants to pay their employees enough to buy their products.
A steaming cup of soykaf would be real wiz right now.
From each according to his ability, to each according to his need is the way of the future
Ok Comrade.
and attempts to deny this simple mechanical law of nature will only result in even more suffering for us.
Simple law of nature? What the heck are you smoking and why aren't you sharing it? The only law of nature is survival of the fittest. I don't think the gazelle being eaten by a lion volunteered to be eaten because the lion needed food.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
I see that they gave percentages for prevention rates, but not for false positives. As someone who uses P2P legitimately (Linux distros, movies like Star Wreck, SHN and FLAC files the musician wants shared, etc) this pisses me off no end.
A false positive here is simply vandalism. If these researchers release this thing to the public and there are any false positives at all, they deserve to be jailed.
Free Martian Whores!
This is a serious question: If it's not worth wasting your money on to buy, then why on earth did you waste your time downloading and watching it? Either a product is worth the asking price or it's not. If it is worth it to you, buy it. If not, do without...
I absolutely love this observation.
Your point is very valid, and the "greedy millionaires taking money from the poor consumer" is a flawed view.
After reading your post I thought over what the "RIAA" means, as a corporate entity to me and what I know about it, and it's shamefully little.
My own knowledge about the RIAA is limited to what I read on slashdot and on newssites, where it profiles itself as an agressive entity.
Which makes me think it's how the RIAA is out of tune with the needs of todays consumers, putting "measures into place", creating discomfort for users who otherwise would've been perfectly happy. Resulting in a greater need or desire for something more align with current media-consumption, which is direct, efficient, snack-sized. But on the other end, a coorporation with a businessmodel that doesn't apply anymore. Which comes back to the "relative perceived value"; if it's hasslefree, you'll pay more to not go through the hassle you experience otherwise.
I think we can keep recursing like this until someone returns 1
is that you don't know who your peers are. They might not even be "peers" in the everyday commonly-understood sense.
Solution: remove anonymity, or at least replace it with pseudo-anonymity. I don't know who the guy that signs his chunks with keyid 0xDEADBEEF is, but I know he's never sent me garbage in the past. The owner of keyid 0xF00C1000 sends me chunks that don't match up with the rest of the content. My computer has a hard disk. It can remember things like this.
Gnutella blacklists mediasentry IPs. IPs are ephemeral. What they ought to do is use a signed protocol, and blacklist bad signing keys. Or better yet, greylist everyone by default and whitelist the ones who show a history of integrity. No wait, program the client to do all that, and don't distribute any lists at all.
"Believe me!" -- Donald Trump