Slashdot Mirror
Anyone Can Play Big Brother With BitTorrent
An anonymous reader writes "I was at the 3rd USENIX Workshop on Large-Scale Exploits and Emergent Threats yesterday, and there were people from the French Institute for Computer Science who have continuously spied on most BitTorrent users on the Internet for 100 days, from a single machine. They've also identified 70% of all content providers; yes, those guys that insert the new contents into BitTorrent. As a BitTorrent user, I was shocked that anyone with a box connected to the Internet can spy on what everyone is downloading on BitTorrent."
Looks like a good way to earn a paycheck from the RIAA.
If copyright law was more sane we wouldn't have to argue so much about privacy.
Shh.
As a BitTorrent user, I was shocked that anyone with a box connected to the Internet can spy on what everyone is downloading on BitTorrent."
Really? All you have to do is be on the torrent and connect to them.
Did you know when reading you really only look at the first and last letter? Your mind fills in the rest. So that comment just shows where your mind is.
It is an important reminder of just how ignorant most technology users are of the very tools they're using.
[This post removed under the first rule of USENET.]
https://www.eff.org/https-everywhere
You mean to tell me when I connect to a large pool of people, there is a large pool of people there?
from 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
to 45 2F 6E 40 3C DF 10 71 4E 41 DF AA 25 7D 31 3F
This must mean my IP address is being BROADCAST TO THE WORLD! And I thought I had punched the monkey to prevent this.
It's P2P, you can't hide your IP from someone when they ask for a bit of movie file and your computer cheerfully sends it! It's the equivilant of the police walking down your street shouting "Are their any thieves here ?", and you sticking your head out the window to shout back "Yes Me me me! I'm a thief!!" ;-)
The best you can do is not respond to requests from IPs on a block list ... or steal Wifi from a poorly secured neighbour.
Actually, despite the credulousness of the summary poster, if you click through to the abstract you also get this bit:
Perhaps I'm exposing my own ignorance (because I've never felt the need to use Tor myself) but that strikes me as surprising if it's true. And something that even savvy internet users might not think about.
Awesome. Meet any chicks?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
That you can view peers on a BT network is not shocking. What deserves more attention is the fact that they were able to identify IP's of even those users who used Tor. Of course, BT and Tor should never be mixed (to protect the network of those who need privacy for something other than piracy). This just proves it.
Well, things like Javascript can expose the originating IP over Tor to the receiver, so it's probably not a large leap to assume that you can look at torrrent traffic and find the originating IP at the application level.
That said, its a "problem" with the originating application, not Tor specifically. As said on the Tor website "Tor does not automatically make all your communications secure."
Saying you "can spy on what everyone is downloading on BitTorrent" and TFA stating "major privacy threat" are over-the-top and fear-mongering exaggerations.
A more accurate way to state this is: Using BitTorrent will make our IP address public regarding what content is downloaded and shared online from that IP address. When someone monitors the same content, then they can log your IP address. This is obvious from how the protocol works to anyone who looks into privacy questions seriously. Yes, there is less privacy with what you download with BitTorrent compared to a direct download, as other people also sharing the same content can see your IP address.
But remember, with every download method online someone else knows you have downloaded it, with direct downloads and with all the different peer-to-peer distribution options. If you go to Adobe and download the latest Photoshop demo, they know, they log your IP, and usually even ask for even more information about you.
The only a real privacy problem (a "major threat") is for people using BitTorrent for illegal redistribution of content; it is not a major problem for distribution of open licensed or public domain content, businesses or organizations using BitTorrent for distribution to lower costs, or to distribute free content for viral or marketing purposes.
(Disclaimer: our company, ClearBits, does exactly this, offers distribution as a service to others, and we use BitTorrent extensively)
1. Host TOR exit node
...
2. Eavesdrop on traffic
3. Post results
4. Profit!
I'm sure the traffic coming out of TOR is far more interesting than BitTorrent traffic (unless you're a media company).
Yeah, that has been disproven.
There exist pairs of words which are anagrams of each other while still having the same first and last letter. Thus you would not be able to distinguish them if the intervening letters were scrambled. Two examples are protuberantial/perturbational and, even more on point, undefinability/unidentifiably.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
No, it's a pretty simple application of basic undercover investigative technique.
They pretended to be part of the Tor web, joining it at a point where the user's IP address was visible.
People willingly handed them the IP address.
And since the web was fairly limited in size, and connection points were selected randomly, and most users did multiple connections over time, eventually 70% of users willingly handed them the IP address. Since Tor has no way of ensuring trust in its security servers, its security is void. You couldn't have designed it better to funnel users' IP addresses to a spy unless you had only one server in the whole web and faked the rest of the topology.
it was wide-open to being exploited by sting operations.
This is also the reason you should never trust anonymizing proxy servers or Arab sheiks.
There's nothing so useless as a lock with a voice imprint - Lord President Borusa
Thank you for that DUH. Bram Cohen originally designed the protocol to be an ultra-scalable file distribution approach, and every attempt to add security, encryption, or whatever is trying to add something against the grain of its origin. (It may still be worth doing it, in the same sense that steganography may still be worth doing.) Bittorrent is for above-board, everyone-knows-you're-doing-it file distribution. If you want to hide what you're doing, do it with something else.
Yeah, some assholes use Tor for BitTorrent, and it's awful for the network. Then people like me who live behind the Great Firewall of China, get slower-than-molasses browsing of censored web sites (terrible things like Google Pages, Blogger, anything from Taiwan, any page containing a string the PRC doesn't like, etc.). The main use for such work-arounds is usually just for my own research and education, and this is the basic reason that Tor exists. Users who run BitTorrent through Tor are really abusing what is basically a charity for people who need it.
Systemd: the PulseAudio of init systems
Let me tell you a true story very much like the theoretical example you posted. When I was a kid there was a Rolling Stones song I loved, but I had no money to buy the album and my parents hated rock music. Our neighbors had that album, and I used to run to the backyard to listen when they played it. Was I stealing?
From the PDF it says the scanner downloaded pieces of data from all of the 1.2 Million torrents it listened in on. Shame Shame!
As a BitTorrent user, I was shocked that anyone with a box connected to the Internet can spy on what everyone is downloading on BitTorrent."
That's nothing! Imagine how shocked were content providers, when they discovered that anyone with a box connected to the Internet can insert the new contents into BitTorrent!
Incidentally, the CLI interface is fragile, and it can break out into a standard apache directory listing. It also occasionally redirects to an RFC document for some reason. Anyway, there's a log of all tried passwords there. But more interestingly, there's a lot of other stuff elsewhere in the tree, an 18MB text file with a Twitter social connection graph (just a list of name pairs), and a monitor/ directory with what looks like GSM/email/p2p monitoring stuff. Can't access most of it except an auto-refreshing IRC monitoring page though.
Somebody is using it for something it seems.
True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
The article goes into a lot of detail about how they identify those users who are on VPN, Proxy, tor, etc. They've also identified over 10,000 IPs that "monitor" only, from a few data centers in the United States. If you're using BT, you should definitely read this article..
I was just thinking that in the year 2010, how is it possible for a Slashdot reader not to know that Bittorrent is not private?
Let's say I find myself a man to play the guitar at dinnertime each night. It's now the end of the week, and he has the "expectation" of income. He was deprived of the use of his time, and I enjoyed the fruits of his labour. If I choose to not pay him, have I not stolen from him?
That depends. What does your contract say? If the contract states that you give him a certain amount of money on the condition that he plays for you, and after he plays you refuse to turn over the money, then you are indeed stealing from him—that's his money you're withholding. One can envision other circumstances, including the absence of any contract (not necessarily written), where refusal of payment would not be theft. The expectation is not enough, by itself.
If I'm not stealing in the second case, I'm not stealing in the first.
In the second case you explicitly did not agree in advance to pay him. This changes matters. If you did agree to such in the first case then the situations are not analogous.
he was deprived of the use of his time
Perhaps, but not by you. The decision to spend his time playing or recording his performances was his own. You have not deprived him of any additional time by listening. He was under no obligation to make his recordings available to you without first arranging for payment. Only the existence of a voluntary contract would create an obligation on your part for payment after the fact.
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat