P2P Forensics


Published on

Presentation from October 2010:

As a method for quick and efficient sharing of files, many computer users have turned towards P2P applications to obtain information and media that they require at home and on the job. With transmissions occurring over non-HTTP connections, even many technically savvy users don't realize just how easily their downloads and habits can be tracked and monitored across a network. This technical talk will delve into the network and file system forensic artifacts of P2P applications, focusing more towards BitTorrent but also including other relevant protocols. It will show what artifacts are left behind, and how some can be hidden away by knowledgeable users. It will also cover many of the new legal challenges that P2P users face and some of the newest protocol implementations created to bypass these legal restrictions. This information is focused towards forensics examiners and network administrators that wish to mitigate the risks of P2P communications, though the information is appropriate for all audiences and skill levels. This is a similar talk to one given at the DoD Cyber Crime Conference, GFIRST, and in briefings to the U.S. DoJ and various law enforcement agencies, though recreated for BSides Delaware.

Published in: Technology
  • Be the first to comment

No Downloads
Total Views
On Slideshare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

P2P Forensics

  1. 1. P2P ForensicsYour Admin Knows Your Download Habits Brian Baskin
  2. 2. Who Am I? Senior Consultant with cmdLabs Former Deputy Lead Technical Engineer  Defense Cyber Investigations Training Academy Author/coauthor of seven InfoSec books
  3. 3. Legalities
  4. 4. Kazaa• 2006 - After ruling of ``MGM Studios, Inc. v. Grokster, Ltd”, Kazaa settled their lawsuits w/ US copyright owners ($100mil+)• Sold operations to Australian company – which was then sued and lost by ARIA• Now maintains a respectable business…
  5. 5. BitTorrent• The Pirate Bay – Trial ended Apr 2009 – All four operators found guilty – 1 Year prison + 3.5mil USD fine – Appeals finished 19 Oct 2010 – Results due 26 Nov Oink’s Pink Palace (OiNK) – First BitTorrent case in U.K. – Shutdown down in 2007 by International Federation of the Phonographic Industry (IFPI) and British Phonographic Industry (BPI) – Ruled not-guilty by jury, 15 Jan 2010, allowed to keep £200K of site donations
  6. 6. LimeWire• May 2010 – Charged with copyright infringement, inducing others to copyright infringement• Oct 2010 – Under court order injunction to C&D services
  7. 7. RIAA v. Law Enforcement• LE loves P2P – Helps find low-hanging fruit (ICAC)• RIAA hates P2P – Disallow low-hanging fruit• If there is no venue for low-hanging fruit, they’ll climb the tree
  8. 8. Oh #$^@!• Avionics / network info from President’s Marine One helicopter leaked* – Leaked by DoD contractor over Gnutella (LimeWire)• Prompted passage of HR 1319* – Informed P2P User Act – Requires apps to warn you of sharing entire hard drive http://news.cnet.com/8301-10787_3-10184785-60.html http://www.opencongress.org/bill/111-h1319/show
  9. 9. P2P Clients
  10. 10. Kazaa• Yes! It’s still in use! – Official Kazaa client is 100% legal content – Kazaa Lite / Resurrection are unofficial networks – Basically a dead client due to legal scrutiny … for now
  11. 11. Kazaa• Proprietary protocol for peer-to-peer communications and searching• Downloads are through standard HTTP GET requestsGET /.hash=ba01cf58b0216f7ebfea389d17456a17f1e5ffff HTTP/1.1Host: KazaaClient Jul 27 2004 21:14:16X-Kazaa-Username: my-k-lite.comX-Kazaa-Network: KaZaAX-Kazaa-IP:
  12. 12. Kazaa - RegistryHKLMSoftwareKazaaLocalContentDatabase Dir=“C:ProgramDataKazaadb”HKCUSoftwareKazaaTransferDlDir0=“C:My Shared Folder”HKLMSoftwareKazaaLocalContentDownloa dDir=“C:My Shared Folder”
  13. 13. LimeWire• Primary client for Gnutella Network – Currently DOA – FrostWire best alternative • Still dead-ish• Used an open leaf-node system – Allowed for nodes to see all search terms passed through them – Source of hilarity• #1 Network for CP (no, not THAT CP) – See Operation Fairplay
  14. 14. LimeWire• Files are transmitted in the open – Uses standard HTTP GET requests
  15. 15. LimeWire• Downloaded files are stored by default to: C:Program FilesLimeWireShared
  16. 16. BitTorrent• One of the newest, most popular P2P apps• Currently accounts for between 30-55% of all Internet traffic – In U.S.: 53% of all upstream traffic* – In Latin America: 73% of all upstream traffichttp://torrentfreak.com/bittorrent-still-dominates-global-internet-traffic-101026/
  17. 17. Content Discovery
  18. 18. Torrent Web Sites• The vast majority are public web sites where anyone can download – The Pirate Bay (TPB) (www.thepiratebay.org) – BTJunkie (www.btjunkie.org) – ISO Hunt (www.isohunt.com) – Torrent Reactor (www.torrentreactor.net) – Linux Tracker (www.linuxtracker.org) – Legal Torrents (www.legaltorrents.com)
  19. 19. Torrent Web Sites• Many private torrent sites require user accounts and are very secretive• Most revolve around types of media – Educational: • BitMe (www.bitme.org) – Music: • What CD? (what.cd) – TV • HDBits (www.HDBits.org)
  20. 20. Type of Material Available
  21. 21. Type of Material Available
  22. 22. That’s a Lot of Bandwidth!
  23. 23. BitTorrent Is For Large Files• BitTorrent has become the standard for transmitting large sets of data Yes, that’s 313GB
  24. 24. Peer Discovery
  25. 25. The .torrent file• Text based file includes: – Tracker address – Creation date (# secs since 1-1-1970) – File names and sizes – Client used to create torrent• The actual network is identified by a SHA-1 of this file called an Info Hash• All data is “Bencoded”, a format used to transmit various types of data in a simple file format
  26. 26. The .torrent file• d8: announce http://inferno.demonoid.com:3397/an 41: nounce 18:az ureus_propertiesd17:dht_backup_enablei1ee7:comment 57:www.meganova.org, Fast, Clean and Reliable Torrent Site! 10:created by16:WWW.MEGANOVA.ORG13:creati on datei1169407014e8:encoding5:UTF─84:infod5:filesld 6:lengthi47e4:pathl40:Torrent downloaded frompathDemonoi iPhone.mp3 d.com.txteed6:lengthi63138e4: l10: eee4:name15:iPhone Ringtone12:piece lengthi32768e6: pieces40:”Í半ŸÁn_.›5qa3Üh%܉å“─Á+?ƒË¬Ó¯ ¢[Ô7:privatei0eee
  27. 27. The .torrent file• Announce : http://inferno.demonoid.com:3397/announce• Azureus_properties – dht_backup_enable = 1• Comment = www.meganova.org, Fast, Clean…• Created by = WWW.MEGANOVA.ORG• Creation date = 1169407014• Encoding = UTF-84• Info – Files • Length = 47 • Path = Torrent downloaded from Demonoid.com.txt • Length = 63138 • Path = iPhone.mp3 – Name = iPhone Ringtone – Piece length = 32768 – Pieces = piece data
  28. 28. Magnet Links• Replacement for .torrent files – Became popular over 2009• All torrent details are in URI format:magnet:? xt=urn:btih:b8d738781bb770735f71f2ae21b588f04 9cd8381dn=Windows+7tr=http://tracker.thepir atebay.org/announce – xt = eXact Topic = Uniform Resource Name: BitTorrent Info Hash – dn = Display Name – tr = Tracker Address
  29. 29. Present Day• That’s all now nearly obsolete – Many trackers and web hosts are being dismantled due to legal pressures – Even greater decentralization is being used to avoid single points of failure – Modern file sharers use a combination of Magnet links and Tracker-less communications to bypass points of failure
  30. 30. Distributed Hash Tables (DHT)• Technically a Distributed Sloppy Hash Table (DSHT) – A.K.A. UDP Tracker• Used primarily for Peer Discovery• Peer becomes tracker, based on Kademlia protocol – Each peer maintains routing table of known good nodes • Known good = active in last 15 minutes – If no routing table exists, client ‘bootstraps’ into larger table (router.utorrent.com, router.bittorrent.com, dht.aelitis.com)• IP addresses for swarm are stored in routing table
  31. 31. Distributed Hash Tables (DHT)• The routing table for a particular torrent is housed in only ONE node – whatever node’s own SHA-1 name is closest to the Info Hash Key• Info Hash: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12• Node SHA-1: 2fd4e1c67a2d28fced849ee1bb76e7391b93e23b 200 120 275 175 65 15
  32. 32. Distributed Hash Tables (DHT)• To find closest pair, distance between Info Hash and Node SHA1 is compared as:• Distance = x XOR y• X = 93eb12 = 100100111110101100010010• Y1 = 93e23b = 100100111110001000111011• Y2 = 93e21a = 100100111110001000011010• x XOR y1 = 000000000000100100101001 = 2345• x XOR y2 = 000000000000100100010000 = 2320• Y2 is closest to X
  33. 33. Distributed Hash Tables (DHT)• Allows for completely decentralized peer discovery – Trackers are not longer required to find peers – Ratios are not enforceable• Side effects include: – Long lookup times – High(er) rate of dead peers in routing tables – More Hit-and-run leechers• http://www.bittorrent.org/beps/bep_0005.html• http://www.torrentfreak.com/common-bittorrent-dht-myths-091024/• http://www.tribler.org/trac/wiki/Khashmir• http://www.iseclab.org/papers/securecomm08_overbot.pdf
  34. 34. Data Transfer
  35. 35. Peer Communication• Starts with “handshake” b/w peers – Peers share their unique IDs and Info Hash of the network they’re in – Normally uses TCP 6881-6889• Custom Peer Wire Protocol (PWP) – request – requests a specified data block – piece – sends a requested data block – have – notifies a peer that you have a data block available to send
  36. 36. Peer Communication• Data Transmissions – The entire data session is broken down into pieces (256KB, 512KB, 1MB, etc) – Each piece is sent in blocks of data normally 16,384 (16KB) in size – Each block refers to a particular piece and its beginning offset within that piece
  37. 37. Saving Files • Stream treated as one large set of data – Offset “lengths” in .Torrent tell where to differentiate files • Blocks are downloaded randomly – Rarest are normally downloaded firstFile 1 File 2 File 3
  38. 38. Carving Data from Network Captures• How do you extract the files that have been transferred from a network capture? – Humanly impossible impractical• Prior to sending data, the entire data set is broken down into 1MB “pieces”• Data is transferred directly b/w peers in 16KB chunks, denoted by a particular piece and the starting offset in that piece
  39. 39. Carving Data from Network Captures• Can you automatically carve BitTorrent data? – CoolMiner from FBI will do it • Requires a few hours of processing, but will produce the original files that were downloaded across the network stream – AccessData SilentRunner?
  40. 40. BitTorrent Client Forensics • P2P IP Black-list blocking • Access to private trackers • Additional topics
  41. 41. BitTorrent Client Forensics• Clients discussed here: – BitTorrent (Mainline) 5.3 – BitTorrent (Mainline) 7.1 / µTorrent 2.0.4 – Vuze (Azureus)
  42. 42. BitTorrent Client Forensics• BitTorrent (Mainline) client (ver. 5.3) – – Installs by default to: C:Program FilesBitTorrent – By default, listens on port 6881 – By default, saves data from “active” downloads to %USERPROFILE%Application DataBitTorrentincomplete – Copies of original .torrents are renamed to their Info Hash value and stored in: %USERPROFILE%Application DataBitTorrentdatametainfo • Files remain even after download is completed
  43. 43. BitTorrent Client Forensics• BitTorrent (Mainline) client (ver. 5.3) – – Per-download settings stored in Info Hash value filenames in: %USERPROFILE%Application DataBitTorrentdatatorrents sSdestination_path p5 VC:u005CDownloadsu005CJustin Bieber Discography p6 sSworking_path p7 VX:u005CUsersu005Cbrianu005CAppDatau005cRoaming u005CBitTorrentu005Cincompleteu005Cc1f6b384-af2c
  44. 44. BitTorrent Client Forensics• BitTorrent (Mainline) client (ver. 5.3) – – Configuration settings are stored in: %USERPROFILE%AppDataRoamingBitTorrentdataui_config save_in = C:Downloads launch_on_startup = True upnp = True start_maximized = False max_download_rate = 125000000 max_upload_rate = 40960 minport = 6881 minport = 6999 close_to_tray = True save_incomplete_in = X:UsersbrianAppDataRoamingBitTorrentincomplete minimize_to_tray = True
  45. 45. BitTorrent Client Forensics• BitTorrent 6.X/7.X and µTorrent client – All versions of BitTorrent 6.X and above are just a re-branded version of µTorrent – µTorrent provides one of the smallest and most compact clients, and is currently one of the most popular clients in usage – The two clients are virtually identical in nearly every way
  46. 46. BitTorrent Client Forensics• µTorrent client (ver. 2.0.4) – – Installs by default to: C:Program FilesuTorrent – Slim client composed of just two files: utorrent.exe and uninstall.exe – On install, picks a random port – By default, downloads are stored in: %USERPROFILE %DocumentsDownloads – Copies of original torrents are stored in: %USERPROFILE%AppDataRoaminguTorrent %USERPROFILE%Application DatauTorrent (XP) • Files remain only while client is active in torrent
  47. 47. BitTorrent Client Forensics• µTorrent client (ver. 2.0.4) – – Configuration settings are stored in: %USERPROFILE%Application DatauTorrentsettings.dat 15:add_dialog_histl54:C:UsersbrianDocuments 9:bind_porti59008e 7:born_oni12917408009e 15:runs_since_borni18e 18:runtime_since_borni822919042e
  48. 48. BitTorrent Client Forensics• BitTorrent 7.1 – Same information as uTorrent, just stored in: %UserProfile%AppDataRoamingBitTorrent %UserProfile%Application DataBitTorrent (XP) – Addition of “BTDNA” - a service that allegedly allows BT to use ISP’s bandwidth “kindly” • Reverse Analysis http://wefixedtheglitch.tumblr.com/post/22786974
  49. 49. BitTorrent Client Forensics• Vuze Client – Java-based client available for all major OSs – Aggressive dev team – Open-source – Numerous plug-ins
  50. 50. BitTorrent Client Forensics• Vuze Client – Client with dedicated media delivery system
  51. 51. BitTorrent Client Forensics• Vuze client (ver. – – Installs by default to: C:Program FilesVuze – On install, picks a random port from 49152–65534 – By default, downloads are stored in %USERPROFILE %My DocumentsAzureus Downloads – Copies of original torrents are stored in: %USERPROFILE%AppDataRoamingAzureusactive • File is renamed to 40-byte Info Hash value + ‘.dat’ • Files remain only while client is active in torrent %USERPROFILE%AppDataRoamingAzureustorrents • Files remain even after download is completed
  52. 52. BitTorrent Client Forensics• Vuze client (ver. – – Configuration settings are stored in: %USERPROFILE%AppDataRoamingAzureusazureus.config – Very cryptic file, but contains many interesting items: 7:ASN BGP14: (Autonomous System Number) 7:ASN ASN46:VZGNI-TRANSIT - Verizon Internet Services Inc. 17:Default save path20:C:DownloadsAzureus 15:TCP.Listen.Porti50692e 15:UDP.Listen.Porti50692e 23:UDP.NonData.Listen.Porti50692e
  53. 53. BitTorrent Client Forensics• Vuze client (ver. – – Client also stores historical statistics in: %USERPROFILE%AppDataRoamingAzureusazureus.statistics 14:download_counti3e (3 total downloads) 10:downloadedi2706532e (2,706,532 total bytes downloaded) 8:uploadedi26389e (26,389 total bytes uploaded) 6:uptimei20859e (Seconds client has been active)
  54. 54. Anti-Forensics Techniques, etc
  55. 55. PeerBlock (formerly PeerGuardian)• Background app that blocks all TCP/UDP connections to ‘blacklisted’ IPs
  56. 56. Torrent Co-location• Subscription services to download torrents at remote site• Most based upon TorrentFlux web-app• Peer Harbor – www.peerharbor.com – (formerly Torrent2FTP) – Remote site downloads your torrents and sends to you via FTP
  57. 57. IPREDator• VPN service run by ThePirateBay to avoid recent Swedish law IPRED – Intellectual Property Rights Enforcement Directive• Went live November 2009 for €5 ($7)/month – Prevents ISPs from logging usage statistics
  58. 58. Private Trackers• Private torrent trackers require invitations to join• Most have regular, brief, open registration periods• Tracker Checker (trackerchecker.com) automatically looks for trackers in “open registration”
  59. 59. Brian Baskin Contact Us: e-mail: contact@cmdlabs.com p: 443.451.7330 www.cmdlabs.com 1101 E. 33rd Street, Suite C301 Baltimore, MD 21218