2

In P2P systems where performance and response times are critical individual clients are susceptible to DDOS by publicly exposing their IPs. While there are various mitigation solutions available at ISP level or with paid for VPNs (e.g. for pro e-sports enthusiasts) these are not readily affordable by casual users or small indie developers.

Any suggestions or advice on the latest research in this area?

Maksim Kneller
  • 21
  • 1
  • 2
    The problem with DDoS is that you need control over multiple routes of entry. With a single end user, the solution is to contact your ISP to ask them to handle the problem: they have the tools to help. – schroeder Mar 31 '15 at 18:22
  • @schroeder, agree about working with ISPs as the ultimate solution. It would be easy with a centralized server, but in a P2P system individual users aren't likely to have the knowhow. On the other hand, with many users the chance of any single user being targeted decreases significantly. – Maksim Kneller Mar 31 '15 at 19:38
  • 1
    @schroeder true in theory, in reality most (all?) residential ISPs don't care (and their "technical" support doesn't even know what a DoS attack is). I guess in theory you could sue them for not providing something you pay for, but the attacks often don't last long enough for a legal action to be possible. Another option is just to trash their crap router, stick a PC with tcpdump in its place and log all attacker's IPs. Then, just contact their ISPs one by one and they'll cooperate (no one likes a compromised machine on their network). –  Apr 01 '15 at 15:27
  • @AndréDaniel but you also just said that ISPs don't care. How is contacting each one by one supposed to work? – schroeder Apr 01 '15 at 16:45
  • @schroeder I meant contacting the ISPs of the attacking hosts. They are often business-grade ISPs or hosting providers which take quick action once you notify them of a compromised host on their network. –  Apr 01 '15 at 17:17
  • @AndréDaniel assuming the attacking nodes are servers? – schroeder Apr 01 '15 at 18:07
  • @schroeder that's usually the case, at least with the script kiddie "booters" you can rent for a few bucks. –  Apr 01 '15 at 18:34

1 Answers1

1

A potential solution could be to rely on intermediary servers and don't allow P2P communication for untrusted clients.

Let's say it's a chat program (like Skype), the client at the same time becomes an intermediary server on the network and is able to relay data between other clients.

For someone to contact you, he first must look up the IP of the intermediary node(s) you are connected to (through a DHT or something similar) and then send everything they want to say to you to that node, which will relay it to you. No possibility of DoS here as bringing down the node won't do any good and your client will immediately reconnect to a different one.

Once that data reaches you (through the intermediary), let's say it was a contact/chat request and you accepted it. At this point, you trust that person to not do anything malicious and give them your IP (through the intermediary as always), and then he connects directly to you. Also, if it was a contact request, your client also saves their public key which means the next time the person goes online this entire process will be done automatically and your client will give them your IP right away (through an intermediary as always).

This can eventually be thwarted by flooding the network with malicious clients (which will act as intermediary nodes but won't respect the confidentiality of other node's IPs) but once the software gets popular and there are enough legitimate nodes it'll be very hard to do that (think about a sybil attack on Tor).

  • Thanks André! It sounds like you are describing a broker server for tracking participating peers. In a multiplayer game, for example, joining peers will establish their initial connection to this server and recieve a list of current participants to connect to directly afterwards. My concern is that after the direct connection between the peers is established and one peer turns malicious against another can anything be done to thwart/divert the attack? Is there a way to hide/obfuscate the true IPs in an open-source P2P system like a web application? – Maksim Kneller Apr 01 '15 at 16:28
  • @MaxK Your new scenario here doesn't sound like DDoS anymore. Are you worried about a Distributed attack or a single threat? – schroeder Apr 01 '15 at 16:44
  • At the moment a single threat occuring when a malicious peer joins into a group of other peers. With P2P this malicious peer will have access to the full list of other peers' IPs and can initiate a DDoS attack aginst either one of them. I don't see anyway to avoid this possibility other than to rely on "herd immunity" if the P2P network is large enough. I was considering having each peer rotate through a list of proxy servers when detecting a flood of messages indicating possible DDoS but that might affect performance. – Maksim Kneller Apr 01 '15 at 16:50
  • @MaxK I was talking about a P2P chat client alternative. In case of a game, most of them use a central server anyway so the players never connect to each other (nor that they need to - in a game a central server is needed to coordinate everything otherwise every player may do different things depending on his latency to other players). –  Apr 01 '15 at 17:21