Exploiting and stealing from the BitTorrent network



878 views BitTorrent Internals



P2P networks are prone to exploitation as there is no central authority to keep track of the activity. BitTorrent is not different, and it is easy for Free Riders to exploit it.

Overview

The file is broken into pieces and peers download them piece-by-piece. Seeders are the peers that have the entire file and is uploading the pieces. Leechers are the nodes downloading the file and they talk to seeders and other leechers to complete the download.

Pretend to be a new peer

When a peer joins the network, it talks to the tracker and the tracker sends a list of 50 peers it can talk to. Hence, by pretending to be the new peer, we may collect information about thousands of peers participating in the network.

Having information about a large number of peers in the network enables us to download the pieces faster as we can establish connections with many of them and initiate the download.

Being greedy with piece selection

Peers in a BitTorrent network are supposed to follow the rarest-first policy through it prioritizes the download of the piece that is rarest in the work, but we choose to ignore that.

We can be greedy with the piece selection and download the pieces without any strategy and we grab whichever piece we get from our peers.

Pretend to upload

Periodically, peers in a BitTorrent network inform the tracker about their download and upload statistics. There is no way for the tracker to check if the peer has indeed done the mentioned work.

Hence, we share false bloated numbers with the tracker, making the tracker think we are a “good” peer that is uploading a lot in the network. With this, the tracker will give us a boost and share our IP with a new peer.

Uploading dummy data

Instead of uploading the actual piece, we can also choose to upload dummy data. Although this is not free riding as we are uploading some information because it is not genuine, it is counted as free riding.

The clients upon receiving any piece do an MD5 verification and our dummy data will be caught in that. Peers may choose to block us if they see repetitive failures. Hence, this is risky but we can get a boost in the download speed due to reciprocation.


Arpit Bhayani

Arpit's Newsletter

CS newsletter for the curious engineers

❤️ by 38000+ readers

If you like what you read subscribe you can always subscribe to my newsletter and get the post delivered straight to your inbox. I write essays on various engineering topics and share it through my weekly newsletter.




Other essays that you might like



Be a better engineer

A set of courses designed to make you a better engineer and excel at your career; no-fluff, pure engineering.


Paid Courses

System Design for Beginners

A masterclass that helps early engineers and product managers become great at designing scalable systems.

300+ learners

Details →

System Design Masterclass

A masterclass that helps you become great at designing scalable, fault-tolerant, and highly available systems.

1000+ learners

Details →

Redis Internals

Learn internals of Redis by re-implementing some of the core features in Golang.

98+ learners

Details →

Free Courses

Designing Microservices

A free playlist to help you understand Microservices and their high-level patterns in depth.

823+ learners

Details →

GitHub Outage Dissections

A free playlist to help you learn core engineering from outages that happened at GitHub.

651+ learners

Details →

Hash Table Internals

A free playlist to help you understand the internal workings and construction of Hash Tables.

1027+ learners

Details →

BitTorrent Internals

A free playlist to help you understand the algorithms and strategies that power P2P networks and BitTorrent.

692+ learners

Details →