BitTorrent file sharing using Tor-like hidden services R.J. Ruigrok Delft University of Technology BitTorrent file sharing using Tor-like hidden services by Rob Ruigrok in partial fulfillment of the requirements for the degree of Master of Science in Computer Science at the Delft University of Technology, to be defended publicly on August 31, 2015 at 14:00 PM. Student number: 1371746 Project duration: June 11, 2014 – August 31, 2015 Supervisor: Dr. ir. J. A. Pouwelse Thesis committee: Prof. dr. ir. H. J. Sips, TU Delft Dr. ir. J. A. Pouwelse, TU Delft Dr. ir. S. E. Verwer, TU Delft An electronic version of this thesis is available at http://repository.tudelft.nl/. Preface I would like to thank Johan Pouwelse for his enthusiasm, comments and sugges- tions. Furthermore, I would like to thank Egbert Bouman, Niels Zeilemaker, Elric Milon and Lipu Fei. They were always available for recommendations, and assisted me with the programming work in Tribler. Last but not least, I want to thank my friends, colleagues, family and wife for their support. Rob Ruigrok Delft, The Netherlands August 23, 2015 iii Abstract The Internet is a large public network of networks and computers. When no coun- termeasures are taken, all information and activities taking place on the public Internet are subject to traffic analysis, threatening personal freedom and privacy. The first measure to take is securing all transferred information by applying encryp- tion on it, which makes it at least very hard to tap the contents of the transferred information. But encryption does not add any value when it comes to anonymity. Although the contents of the message are not known (because it is encrypted), it is still possible to track down where a message comes from, and where it is going to by analyzing the network infrastructure. Governments or Internet providers may apply censorship or block any kind of network traffic coming or going from some- where. This is where hidden services come in. The idea of hidden services was described by the authors of Tor (The onion router). The hidden services protocol hides the location of both the sender and receiver by transferring and encrypting messages over multiple hops, without revealing the true identity or contents of the messages in transit. This thesis proposes a design for implementing Tor-like hidden services in a de- centralized peer-to-peer system, enabling the possibility of downloading and seed- ing anonymously. A proof-of-concept will be implemented into Tribler, a BitTorrent client developed at Delft University of Technology. Tribler already supports anony- mous downloading using encryption over circuits with multiple hops, but to make hidden services work, an end-to-end encrypted circuit between both the seeder and downloader needs to be established. This is not as easy as it seems, because the seeder and downloader do not know each other. The implementation details of hidden services are part of this work, as well as experiments on the performance of the system. Furthermore, a number of issues related to transforming the original idea of hidden services into a fully distributed context are solved. v Contents Preface iii Abstract v 1 Introduction 1 1.1 Motivation and contribution . 1 1.2 Document structure . 3 2 Related work 5 2.1 Tor project . 5 2.2 BitTorrent . 6 2.3 Tribler . 7 2.4 Anonymity in Tribler . 8 2.5 Overview of research on anonymous communication . 10 3 Problem Description 17 3.1 Requirements on finding peers. 17 3.2 Boosting performance . 19 3.3 Resilience to attacks . 19 3.4 Acquiring required keys for encryption . 21 3.5 Avoid exit nodes . 21 3.6 Connectability Problem . 22 3.7 Handling churn . 23 3.8 Banning corrupt peers. 23 4 Design and Implementation 25 4.1 Integration into Tribler . 26 4.2 Decentralized discovery of hidden seeders . 27 4.3 Circuit setup . 27 4.4 Dispersy message cells . 27 4.4.1 Setting up Introduction Points . 28 4.4.2 Finding peers to download from . 28 4.4.3 Getting keys . 29 4.4.4 Create end-2-end . 30 4.4.5 Requesting end-to-end connection . 30 4.4.6 Linking end-to-end connection. 31 4.5 Generic overview of message interaction . 32 4.6 Circuit reuse . 33 4.7 Protocol-specific extensions. 34 vii viii Contents 5 Experiments and performance evaluation 39 5.1 Environment specification and assumptions . 39 5.2 Experiments on latency, speed and performance . 40 5.3 Experiment on fault resilience . 46 5.4 Experiment on multi-swarm collaboration . 50 5.5 Concluding remarks on experiments . 52 5.6 Yappi profiling of the system . 53 6 Future work 55 7 Conclusion 57 Appendices 59 A Gumby experiments 61 A.1 hiddenservices-1-gigabyte-1-hop.scenario . 61 A.2 hiddenservices-1-hop-multiple-seeders.scenario . 61 A.3 hiddenservices-1-hop-seeder.scenario . 62 A.4 hiddenservices-2-hop-seeder.scenario . 62 A.5 hiddenservices-3-hop-seeder.scenario . 62 Glossary 63 Bibliography 65 1 Introduction If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place. Eric Schmidt Do people really care about their privacy? When looking at messages shared on social media platforms it seems that most people do not care, and if asked some respond with having nothing to hide. The elders of the Internet are actually warning us for the threat of losing privacy. At the time of writing, a new cold war is emerging. [6] The conflict in Ukraine dominates headlines and the NATO and European Union take countermeasures to withstand upcoming attacks from Russia. But the renewed tensions between east and west differ greatly from tensions in the past. Since the end of the first cold war, the use of Internet became mainstream for both parties, news headlines can spread rapidly. But spying on the Internet advances too, all traffic on the Internet can be intercepted by government agencies, like the US’s Prism [20] and Russia’s Sorm [35] programs. Sharing controversial or political files over the Internet becomes dangerous, as there is a high chance that government officials in your country or abroad are watching over your back, knowing more than you know about yourself. Lots of tools pretend a false sense of security, and are essentially futile. This work contributes the goal of making file-sharing a Putin-proof experience, with nobody knowing who you are and what you’re doing. 1.1. Motivation and contribution The goal of this work is to enhance the use of BitTorrent with security, privacy and anonymity, by mapping the protocol used for Tor hidden services [12] on a peer- to-peer network. The approach differs greatly from its Tor counterpart, as it is fully based on self-organization (without any central servers) in academically-pure P2P 1 2 1. Introduction style. The one way anonymous downloading and streaming functionality was made 1 available to public in 2014, based on prior work described in [28] and [33]. Figure 1.1: Logo of the Tribler software The next logical step is to go beyond anonymous downloading, by default pro- tection of seeders, and without leaking any content in transit. This is established by creating end-to-end encrypted circuits between seeders and downloaders. These circuits should preserve anonymity, but also act fast and reliable. No information is allowed to leak somewhere between the seeder and downloader, and the need for exit nodes should be eliminated as they are scarce. The purpose of this thesis work is pointed out in the following research question: How to achieve a fully-decentralized architecture for anonymous downloading and seeding in BitTorrent? To answer this question, a number of subquestions are formulated: 1. Which existing anonymity protocols are proposed in the past, and how do they evaluate? 2. How to map the ideas and concepts behind Tor hidden services into Tribler? 3. How to work around the connectability problem? 4. What is the performance impact of design decisions within this architecture? A design specification for a proof of concept concerning a system answering the above mentioned research questions is contained in the upcoming chapters. 1.2. Document structure 3 1.2. Document structure 1 The contents of this thesis are as follows. The first chapter 1 starts with an intro- duction on this work, and an overview of research questions and motivation. Chap- ter 2 provides an overview of prior work on anonymity systems on the Internet. The problem description in chapter 3 describes the requirements on the anonymity system for downloading and seeding anonymously in a distributed network. The chosen approach with details about the protocol based on hidden services is de- scribed in chapter 4. In chapter 5 experiments on performance and fault resilience are conducted, combined with insights resulting from the experiments. Chapter 6 proposes improvements for future work on the anonymous system, and chapter 7 concludes this work with the results and consequences achieved on the proposed anonymity system. 2 Related work Privacy may actually be an anomaly. Vint Cerf Making the Internet anonymous is hard to achieve, due to its nature of being public and open to everyone. In the past decades, various theoretical designs for anony- mous peer-to-peer systems have been proposed, but no established peer-to-peer application with a large user-base is currently using any of those designs. This chapter describes the basics of the Tor project (2.1) and BitTorrent and its related terminology (2.2). Furthermore, it contains a describes the Tribler framework (sec- tion 2.3) in which a proof of concept will be implemented.