Presentation from October 2010:
As a method for quick and efficient sharing of files, many computer users have turned towards P2P applications to obtain information and media that they require at home and on the job. With transmissions occurring over non-HTTP connections, even many technically savvy users don't realize just how easily their downloads and habits can be tracked and monitored across a network. This technical talk will delve into the network and file system forensic artifacts of P2P applications, focusing more towards BitTorrent but also including other relevant protocols. It will show what artifacts are left behind, and how some can be hidden away by knowledgeable users. It will also cover many of the new legal challenges that P2P users face and some of the newest protocol implementations created to bypass these legal restrictions. This information is focused towards forensics examiners and network administrators that wish to mitigate the risks of P2P communications, though the information is appropriate for all audiences and skill levels. This is a similar talk to one given at the DoD Cyber Crime Conference, GFIRST, and in briefings to the U.S. DoJ and various law enforcement agencies, though recreated for BSides Delaware.
2. Who Am I?
Senior Consultant with cmdLabs
Former Deputy Lead Technical Engineer
Defense Cyber Investigations Training Academy
Author/coauthor of seven InfoSec books
4. Kazaa
• 2006 - After ruling of ``MGM Studios, Inc. v.
Grokster, Ltd”, Kazaa settled their lawsuits
w/ US copyright owners ($100mil+)
• Sold operations to Australian company –
which was then sued and lost by ARIA
• Now maintains a respectable business…
5. BitTorrent
• The Pirate Bay
– Trial ended Apr 2009
– All four operators found guilty
– 1 Year prison + 3.5mil USD fine
– Appeals finished 19 Oct 2010
– Results due 26 Nov
Oink’s Pink Palace (OiNK)
– First BitTorrent case in U.K.
– Shutdown down in 2007 by International Federation of the
Phonographic Industry (IFPI) and British Phonographic Industry
(BPI)
– Ruled not-guilty by jury, 15 Jan 2010, allowed to keep £200K of
site donations
6. LimeWire
• May 2010 – Charged with copyright
infringement, inducing others to
copyright infringement
• Oct 2010 – Under court order injunction
to C&D services
7. RIAA v. Law Enforcement
• LE loves P2P
– Helps find low-hanging fruit (ICAC)
• RIAA hates P2P
– Disallow low-hanging fruit
• If there is no venue for low-hanging
fruit, they’ll climb the tree
8. Oh #$^@!
• Avionics / network info from President’s
Marine One helicopter leaked*
– Leaked by DoD contractor over Gnutella
(LimeWire)
• Prompted passage of HR 1319*
– Informed P2P User Act
– Requires apps to warn you of sharing entire
hard drive
http://news.cnet.com/8301-10787_3-10184785-60.html
http://www.opencongress.org/bill/111-h1319/show
10. Kazaa
• Yes! It’s still in use!
– Official Kazaa client is 100% legal content
– Kazaa Lite / Resurrection are unofficial networks
– Basically a dead client due to legal scrutiny
… for now
11. Kazaa
• Proprietary protocol for peer-to-peer
communications and searching
• Downloads are through standard HTTP GET requests
GET /.hash=ba01cf58b0216f7ebfea389d17456a17f1e5ffff
HTTP/1.1
Host: 43.19.1.6:2218
UserAgent: KazaaClient Jul 27 2004 21:14:16
X-Kazaa-Username: my-k-lite.com
X-Kazaa-Network: KaZaA
X-Kazaa-IP: 10.1.15.1:1485
X-Kazaa-SupernodeIP: 69.81.20.135:2783
13. LimeWire
• Primary client for Gnutella Network
– Currently DOA
– FrostWire best alternative
• Still dead-ish
• Used an open leaf-node system
– Allowed for nodes to see all search terms passed
through them
– Source of hilarity
• #1 Network for CP (no, not THAT CP)
– See Operation Fairplay
16. BitTorrent
• One of the newest, most popular P2P apps
• Currently accounts for between 30-55% of all
Internet traffic
– In U.S.: 53% of all upstream traffic*
– In Latin America: 73% of all upstream traffic
http://torrentfreak.com/bittorrent-still-dominates-global-internet-traffic-101026/
18. Torrent Web Sites
• The vast majority are public web sites where
anyone can download
– The Pirate Bay (TPB) (www.thepiratebay.org)
– BTJunkie (www.btjunkie.org)
– ISO Hunt (www.isohunt.com)
– Torrent Reactor (www.torrentreactor.net)
– Linux Tracker (www.linuxtracker.org)
– Legal Torrents (www.legaltorrents.com)
19. Torrent Web Sites
• Many private torrent sites require user
accounts and are very secretive
• Most revolve around types of media
– Educational:
• BitMe (www.bitme.org)
– Music:
• What CD? (what.cd)
– TV
• HDBits (www.HDBits.org)
25. The .torrent file
• Text based file includes:
– Tracker address
– Creation date (# secs since 1-1-1970)
– File names and sizes
– Client used to create torrent
• The actual network is identified by a SHA-1 of
this file called an Info Hash
• All data is “Bencoded”, a format used to
transmit various types of data in a simple file
format
27. The .torrent file
• Announce : http://inferno.demonoid.com:3397/announce
• Azureus_properties
– dht_backup_enable = 1
• Comment = www.meganova.org, Fast, Clean…
• Created by = WWW.MEGANOVA.ORG
• Creation date = 1169407014
• Encoding = UTF-84
• Info
– Files
• Length = 47
• Path = Torrent downloaded from Demonoid.com.txt
• Length = 63138
• Path = iPhone.mp3
– Name = iPhone Ringtone
– Piece length = 32768
– Pieces = piece data
28. Magnet Links
• Replacement for .torrent files
– Became popular over 2009
• All torrent details are in URI format:
magnet:?
xt=urn:btih:b8d738781bb770735f71f2ae21b588f04
9cd8381dn=Windows+7tr=http://tracker.thepir
atebay.org/announce
– xt = eXact Topic = Uniform Resource Name:
BitTorrent Info Hash
– dn = Display Name
– tr = Tracker Address
29. Present Day
• That’s all now nearly obsolete
– Many trackers and web hosts are being
dismantled due to legal pressures
– Even greater decentralization is being
used to avoid single points of failure
– Modern file sharers use a combination of
Magnet links and Tracker-less
communications to bypass points of
failure
30. Distributed Hash Tables (DHT)
• Technically a Distributed Sloppy Hash Table (DSHT)
– A.K.A. UDP Tracker
• Used primarily for Peer Discovery
• Peer becomes tracker, based on Kademlia protocol
– Each peer maintains routing table of known
good nodes
• Known good = active in last 15 minutes
– If no routing table exists, client ‘bootstraps’ into
larger table (router.utorrent.com,
router.bittorrent.com, dht.aelitis.com)
• IP addresses for swarm are stored in routing table
31. Distributed Hash Tables (DHT)
• The routing table for a particular torrent is housed in
only ONE node – whatever node’s own SHA-1 name is
closest to the Info Hash Key
• Info Hash:
2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
• Node SHA-1:
2fd4e1c67a2d28fced849ee1bb76e7391b93e23b
200
120 275
175
65 15
32. Distributed Hash Tables (DHT)
• To find closest pair, distance between Info Hash
and Node SHA1 is compared as:
• Distance = x XOR y
• X = 93eb12 = 100100111110101100010010
• Y1 = 93e23b = 100100111110001000111011
• Y2 = 93e21a = 100100111110001000011010
• x XOR y1 = 000000000000100100101001 = 2345
• x XOR y2 = 000000000000100100010000 = 2320
• Y2 is closest to X
33. Distributed Hash Tables (DHT)
• Allows for completely decentralized peer discovery
– Trackers are not longer required to find peers
– Ratios are not enforceable
• Side effects include:
– Long lookup times
– High(er) rate of dead peers in routing tables
– More Hit-and-run leechers
• http://www.bittorrent.org/beps/bep_0005.html
• http://www.torrentfreak.com/common-bittorrent-dht-myths-091024/
• http://www.tribler.org/trac/wiki/Khashmir
• http://www.iseclab.org/papers/securecomm08_overbot.pdf
35. Peer Communication
• Starts with “handshake” b/w peers
– Peers share their unique IDs and Info Hash
of the network they’re in
– Normally uses TCP 6881-6889
• Custom Peer Wire Protocol (PWP)
– request – requests a specified data block
– piece – sends a requested data block
– have – notifies a peer that you have a data
block available to send
36. Peer Communication
• Data Transmissions
– The entire data session is broken down into pieces
(256KB, 512KB, 1MB, etc)
– Each piece is sent in blocks of data normally
16,384 (16KB) in size
– Each block refers to a particular piece and its
beginning offset within that piece
37. Saving Files
• Stream treated as one large set of data
– Offset “lengths” in .Torrent tell where to
differentiate files
• Blocks are downloaded randomly
– Rarest are normally downloaded first
File 1 File 2 File 3
38. Carving Data from Network Captures
• How do you extract the files that have been
transferred from a network capture?
– Humanly impossible impractical
• Prior to sending data, the entire data set is broken
down into 1MB “pieces”
• Data is transferred directly b/w peers in 16KB
chunks, denoted by a particular piece and the
starting offset in that piece
39. Carving Data from Network Captures
• Can you automatically carve BitTorrent
data?
– CoolMiner from FBI will do it
• Requires a few hours of processing, but
will produce the original files that were
downloaded across the network stream
– AccessData SilentRunner?
42. BitTorrent Client Forensics
• BitTorrent (Mainline) client (ver. 5.3) –
– Installs by default to: C:Program FilesBitTorrent
– By default, listens on port 6881
– By default, saves data from “active” downloads to
%USERPROFILE%Application DataBitTorrentincomplete
– Copies of original .torrents are renamed to their Info Hash
value and stored in: %USERPROFILE%Application
DataBitTorrentdatametainfo
• Files remain even after download is completed
45. BitTorrent Client Forensics
• BitTorrent 6.X/7.X and µTorrent client
– All versions of BitTorrent 6.X and above are
just a re-branded version of µTorrent
– µTorrent provides one of the smallest and
most compact clients, and is currently one
of the most popular clients in usage
– The two clients are virtually identical in
nearly every way
46. BitTorrent Client Forensics
• µTorrent client (ver. 2.0.4) –
– Installs by default to: C:Program FilesuTorrent
– Slim client composed of just two files: utorrent.exe and
uninstall.exe
– On install, picks a random port
– By default, downloads are stored in: %USERPROFILE
%DocumentsDownloads
– Copies of original torrents are stored in:
%USERPROFILE%AppDataRoaminguTorrent
%USERPROFILE%Application DatauTorrent (XP)
• Files remain only while client is active in torrent
48. BitTorrent Client Forensics
• BitTorrent 7.1
– Same information as uTorrent, just stored in:
%UserProfile%AppDataRoamingBitTorrent
%UserProfile%Application DataBitTorrent (XP)
– Addition of “BTDNA” - a service that allegedly
allows BT to use ISP’s bandwidth “kindly”
• Reverse Analysis
http://wefixedtheglitch.tumblr.com/post/22786974
49. BitTorrent Client Forensics
• Vuze Client
– Java-based client
available for all major
OSs
– Aggressive dev team
– Open-source
– Numerous plug-ins
51. BitTorrent Client Forensics
• Vuze client (ver. 4.5.1.0) –
– Installs by default to: C:Program FilesVuze
– On install, picks a random port from 49152–65534
– By default, downloads are stored in %USERPROFILE
%My DocumentsAzureus Downloads
– Copies of original torrents are stored in:
%USERPROFILE%AppDataRoamingAzureusactive
• File is renamed to 40-byte Info Hash value + ‘.dat’
• Files remain only while client is active in torrent
%USERPROFILE%AppDataRoamingAzureustorrents
• Files remain even after download is completed
52. BitTorrent Client Forensics
• Vuze client (ver. 4.5.1.0) –
– Configuration settings are stored in:
%USERPROFILE%AppDataRoamingAzureusazureus.config
– Very cryptic file, but contains many interesting items:
7:ASN BGP14:151.196.0.0/16 (Autonomous System Number)
7:ASN ASN46:VZGNI-TRANSIT - Verizon Internet Services Inc.
17:Default save path20:C:DownloadsAzureus
15:TCP.Listen.Porti50692e
15:UDP.Listen.Porti50692e
23:UDP.NonData.Listen.Porti50692e
53. BitTorrent Client Forensics
• Vuze client (ver. 4.5.1.0) –
– Client also stores historical statistics in:
%USERPROFILE%AppDataRoamingAzureusazureus.statistics
14:download_counti3e (3 total downloads)
10:downloadedi2706532e (2,706,532 total bytes downloaded)
8:uploadedi26389e (26,389 total bytes uploaded)
6:uptimei20859e (Seconds client has been active)
56. Torrent Co-location
• Subscription services to download torrents at
remote site
• Most based upon TorrentFlux web-app
• Peer Harbor – www.peerharbor.com
– (formerly Torrent2FTP)
– Remote site downloads your torrents and sends to you
via FTP
57. IPREDator
• VPN service run by ThePirateBay to avoid
recent Swedish law IPRED
– Intellectual Property Rights Enforcement Directive
• Went live November 2009 for €5 ($7)/month
– Prevents ISPs from logging usage statistics
58. Private Trackers
• Private torrent trackers require invitations to join
• Most have regular, brief, open registration periods
• Tracker Checker (trackerchecker.com)
automatically looks for trackers in “open
registration”
59. Brian Baskin
Contact Us:
e-mail: contact@cmdlabs.com
p: 443.451.7330
www.cmdlabs.com
1101 E. 33rd Street, Suite C301
Baltimore, MD 21218