Slashdot Mirror
Researchers Outline Targeted Content Poisoning For P2P Data
Diomidis Spinellis writes "Two USC researchers published a paper in the prestigious IEEE Transactions on Computers that describes a technique for p2p content poisoning targeted exclusively at detected copyright violators. Using identity-based signatures and time-stamped tokens they report a 99.9 percent prevention rate in Gnutella, KaZaA, and Freenet and a 85-98 percent prevention rate on eMule, eDonkey, and Morpheus. Poison-resilient networks based on the BitTorrent protocol are not affected. Also the system can't protect small files, like a single-song MP3. Although the authors don't say so explicitly, my understanding is that the scheme is only useful on commercial p2p distribution systems that adopt the proposed protocol."
Abstract: Today's peer-to-peer (P2P) networks are grossly abused by Illegal distributions of music, games, video streams, and popular software. These abuses have resulted in heavy financial loss in media and content industry. Collusive piracy is the main source of intellectual property violations within the boundary of P2P networks. This problem is resulted from paid clients (colluders) illegally sharing copyrighted content files with unpaid clients (pirates). Such an on-line piracy has hindered the use of open P2P networks for commercial content delivery. We propose a proactive poisoning scheme to stop colluders and pirates from working together in alleged copyright infringements in P2P file sharing. The basic idea is to detect pirates with identity- based signatures and time-stamped tokens. Then we stop collusive piracy without hurting legitimate P2P clients. We developed a new peer authorization protocol (PAP) to distinguish pirates from legitimate clients. Detected pirates will receive poisoned chunks in repeated attempts. A reputation-based mechanism is developed to detect colluders. The system does not slow down legal download from paid clients. The pirates are severely penalized with no chance to download successfully in finite time. Based on simulation results, we find 99.9% success rate in preventing piracy on file-level hashing networks like Gnutella, KaZaA,Area, LimeWire, etc. Our protection scheme achieved 85-98% prevention rate on part-level hashing networks like eMuel, Shareaz, eDonkey, Morpheus, etc. Our new scheme enables P2P technology for building a new generation of content delivery networks (CDNs). These P2P-based CDNs provide faster delivery speed, higher content availability, and cost-effectiveness than using conventional CDNs built with huge network of surrogate servers.
This isn't unbiased in the least. Sure, arguably it is "research" but calling them researchers from an university makes them seem neutral at best.
Taxation is legalized theft, no more, no less.
Actually, poisoning P2P networks as a commercial venture could be prosecuted as theft-by-deception.
Stealing bandwidth is a crime. Downloading songs isn't, if you aren't profiting form it.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
What's to prevent poisoning legal p2p? There are plenty of examples of copyrights being inappropriately asserted. The technology itself doesn't discriminate.
Humans had discovered methods to speedily and automatically transmit mountainous volumes of data. It was a new frontier, a utopia where information was shared peacefully between the people who wanted to see it. And what was its downfall? Not the anarchists, or the communists, or the Islamic fundamentalists, but the so called leaders of the free world.
"We had to do it," they said, "there is such a thing as too much freedom."
Poisoning the well. What an insightful revelation. Surely it's never been done before, maybe they should throw a patent on it.
"In the absence of the ability to establish the attribute of truth they tried to establish the noble attributes."
I was curious as to how they were poisoning Freenet, which should be robust against this with its Forward Error Correcting.
According to the paper, Freenet falls under the category of the "Gnutella family" (p.2). The Freenet Project that I know is in no way related to Gnutella.
Are they referring to a different file sharing program by the name of Freenet, or is this statement of theirs just plain inaccurate?
The paper won't download here, so I'm asking without RTFA, but how can this work against Freenet? Do they discuss Freenet in the paper at all? Freenet does chunk-level hashing, and the network enforces that the data matches the hash at all steps. Nodes returning invalid data will rapidly get dropped by their peers. Attacks like this are something that Freenet is explicitly designed to prevent. Also, the anonymity guarantees that Freenet makes would make it hard (potentially very hard) for them to identify a single user, let alone "collusion".
I'm forced to wonder whether the researchers mention Freenet at all, or if the poster is simply lumping Freenet in with other p2p apps that it has very little in common with. (Bittorrent and Freenet should be similar in some ways to their resistance against this attack, but Freenet's strong anonymity guarantees should make it more resistant. The fact that a node engaged in widespread poisoning will have trouble even staying connected makes Freenet even more resistant.)
'mechanical law of nature'
I don't think that phrase means what you think it means.
Have you ever actually used a bittorent client before?
There is no such thing as an overseeded torrent. There are underseeded torrents, and those are frustrating, but there is no such thing as an overseeded torrent. The general idea with upload ratio requirements is that it encourages you to never stop seeding a torrent. If 100 people are seeding and only 3 are downloading, those three get the file extremely fast, and your bandwidth isn't taxed. If you download enough content that you are on a private tracker, then you should have a number of torrents to share. If you aren't downloading all that much, then it will be easy to keep a 100%+ share ratio. If you ARE downloading a lot, you should still be in the 50% range, and eventually you will hit critical mass and the ammount you download won't be able to keep up with the amount you upload.
It's good for everybody. Plus, if a private tracker has a very high seed rate, chances are the required share ratio will be lowered. It creates a win-win situation.
Remember, no such thing as an overseeded torrent. If you download a lot, you WILL share a lot. If you keep sharing after you download, you will soon be sharing more than you download. People move on, quit sharing, lose their computers, etc.
Your share ratio math ignores a lot of things that reduce the amount of data on the network which occur all the time. It's actually pretty easy to exceed 100% share ratios for everybody on the network. If you can't see how it's because you've locked yourself in a tiny box and completely ignored outside factors which remove data and introduce data without affecting increasing the amount of data a person can download. Whenever someone adds a new download to the tracker, the potential share ratio for everyone in the network increases. Whenever a new member joins, the potential share ratio for everyone on the network increases. Eventually it balances out to 100%, but the network is ever changing so it never actually gets there.
Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
As a comp sci grad student, here's what I got from a quick reading of this paper:
Imagine that you're a content provider, with paying users. You've decided to distribute content to your users by running a Gnutella-style network. How do we make sure that only paying users can get our content? After all, it's an open network.
We start by sending some sort of magic timestamp-thing to all of the paying users. I didn't read this part in much detail. Anyway, the paying users can all identify each other somehow. They mention that it maintains privacy.
Some of your paying users (the "Clients") are good, virtuous folk, and they're running the Happy Authorized Gnutella software you gave them. Others (the "Colluders") are running Evil Hacked software. No matter what you do, the Colluders are going to send chunks of your precious data to the "Pirates" (anyone who hasn't paid you).
Normally, we'd expect our Clients to ignore requests from our Pirates. This paper instead suggests: let's obligate the Clients to send poison data to the Pirates! The Pirates won't know which chunks are bad; they'll only find out that the file is corrupt once it's finished downloading. The Pirates won't be able to get a good copy, and they'll give up and go away.
And there's one other great thing: we can set up *fake* Pirates, and check which users aren't giving out the poison they're supposed to! So we've served data to all of the Clients; we've identified all of the Colluders; and we've defeated all of the Pirates.
(Bittorrent has data integrity checks for every chunk, instead of every file; that's why it's not vulnerable to this attack...I mean business model).
In summary: This paper describes a way that a company can charge for distributing their own content on a peer-to-peer network. It only works if they control a centralized "transaction server" thThat's why no one has ever at organizes the entire network, and if they control the software of all the "honest" people. They can't destroy our existing networks with it, and it doesn't prevent anyone from turning around and posting the file to BitTorrent once it's downloaded.
The tone of the paper is definitely not as neutral as I feel it should be. What they're trying to say is "there's no obvious way to charge people for running a Gnutella server, because pirates will eat your lunch. But we think we have a way." But it definitely feels like they're putting moral force behind what's really a network algorithms result.
They already tried this about five years ago with poisoned servers. What happened? The Kad search mechanism was adopted and the servers were useless.
The same thing will happen here, the protocol will change, the poisoners will have wasted a lot of money and achieved nothing.
No sig today...
I'm part way through the research paper, the article summary is just plain wrong.
There is no vulnerability here. They CANNOT poison Gnutella, KaZaA, and Freenet, eMule, eDonkey, Morpheus, or any other existing network with this technique. To quote the paper: Presently none of these P2P networks has built with satisfactory support for copyright protection.
The "problem" they want to "solve" is that existing networks to not possess adequate support for poisoning attacks. This paper proposes creating a NEW additional P2P network. They propose deliberately building in special support to ENABLE poisoning attacks.
While I'm sure the RIAA will eagerly read it over while dreaming of world conquest by releasing their own deliberately crippled "legal P2P network" where they get paid for each authorized client-to-client transfer. As far as most readers here are concerned, this is a completely non-newsworthy story, the contents of this paper are completely irrelevant and harmless. There is absolutely nothing new or surprising about the fact that you can deliberately make your software insecure and you can deliberately leave it vulnerable to poisoning. Yes, a P2P new network could be built Defective By Design.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
So what's wrong by buying a boat, forking out money enough to have people work months and feed their families?
I find this mentality a bit shortsighted: if I would have a pile of money in excess (yes, excess) and would "invest it" (say buy an appartmentblock, cash rent and take from people in that way for my "wellbeing") people don't say a thing.
But when someone aqcuires something, which creates work (luxury items need to be made, people make them, and they're expensive because they're not massproduced, right?) you stimulate an economy and economical activity (people can go to work, do something with their time and get paid) yet that is "wrong" because you can't take a boattrip?
As much I would enjoy excessive luxury as well, spending money stimulates an economy. If you have alot of money, the best thing to "make things happen", and give value is to spend it.
I'm working with banks and wealthmanagement software, I don't have such an abdunce of money as I see passing through our software, yet it creates cashflow and because of that cashflow +100 people here are able to work and drive nice company cars. They are happy. Clients are happy. And those who the people who are happy and comfortable (not excessively) pay to get value from are happy as they can make a business. (80% of the people here order their lunch in a small business who deliver to our office. This means they can bill each day for about 320 to run their business.)
While the economic attitude has proven flawed (growth instead of sustainability and stability). Our economy and wellbeing of those in and around it (you and I buddy) depends on the spending.
I do agree on the point the RIAA is a bunch of greedy bastards. And the value demanded for that music or whatever is not align with the perceived and experienced value delivered. But that is another issue.
Instead of looking down on someone with such a badass boat, ask him you can take a ride, chances are it's a very lonely person misguided trying to acquire wealth sacrificing alot you wouldn't sacrifice. Chances are you get your free ride. I've seen that alot.
I think we can keep recursing like this until someone returns 1
That's the empression I got too but that still creates a massive "WHY?" in my head.
Why the need for a 'private' P2P network that's not really private at all? If 'pirates' can get into your network, the problem isn't solved by poisoning.
Even if the content providers used a public network, there must be a better way, such as encryption and key exchanges.
And... And this is the killer: it only takes one person to move content from a 'private' network to a public network and they're fucked.
This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
My annoyance is that "they" presume my downloading means they are losing money. I've been downloading a lot of recent movies lately, and no surprise, the movies are largely crap piled upon more crap (how they ever scored 7 or higher on imdb.com is a mystery to me). The RIAA/MPAA make the assumption that if I had not downloaded, I would have bought the DVD instead.
They presume wrong.
Out of some 20 movies downloaded there was precisely 1 that I will probably buy on DVD, and that's only because my niece wants to see Hannah Montana in 3D. Otherwise I don't waste my money on Hollyweird's shit unless it's exceptionally good. This past 2008-9 season almost nothing met that criteria. So for them to say, "We lost $400," is completely and totally inaccurate.
They are liars. They lost nothing because I'm not a spender. My money gets invested into the stockmarket, not shiny discs, which probably pisses them off.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
The luxury industry has been linked with reducing the size of the middle class, since it tends to greater a broader disparity between those providing goods and services and those consuming them. You are certainly correct, of course, that spending money will 'stimulate the economy' regardless if it comes from the rich or the poor. The question is the type of economy you want to stimulate. Luxury spending tends to stimulate the segment of industry that sees little return back at the lower end of the wage pools. They reap higher profits, and provide fewer goods and services, thus tending towards increasing the divide in wealth. Spending in the lower end 'consumer grade' market tends to stimulate an industry that will increase growth where more goods and services are produced.
Henry Ford famously paid his employees enough so they could buy the cars they were building. Imagine what might have happened to the auto industry if he had catered only to the rich? Compare also to Walmart, who also wants to pay their employees enough to buy their products.
A steaming cup of soykaf would be real wiz right now.
I see that they gave percentages for prevention rates, but not for false positives. As someone who uses P2P legitimately (Linux distros, movies like Star Wreck, SHN and FLAC files the musician wants shared, etc) this pisses me off no end.
A false positive here is simply vandalism. If these researchers release this thing to the public and there are any false positives at all, they deserve to be jailed.
Free Martian Whores!