This repository contains tools designed to demonstrate and exploit vulnerabilities in BitTorrent tracker and Distributed Hash Table (DHT) systems. Why "BTRR"? Because "Track" and "Forge" bring to mind the Railways, and because
railroad: (verb) - to convict with undue haste and by means of false charges or insufficient evidence.
By spoofing tracker announce messages and monitoring DHT traffic, we highlight the potential for false evidence of seeding or leeching of torrents to be placed by a malicious actor, and picked up by (unwittingly or otherwise) those in the business of monitoring peer-to-peer (P2P) networks, for such purposes as DMCA notices (or much more concerning, reporting on evidence of the trading in abuse-related materials.)
- Introduction
- Installation
- BTForge - Tracker Spoofing Tool
- DHTrack - DHT Monitoring Tool
- Database Management
- Use Cases
- Conclusion
- Resources
BitTorrent and other P2P networks face challenges from anti-piracy efforts that rely on IP address monitoring. Additionally, sites such as iknowwhatyoudownload.com purport to show the torrents that have been downloaded from an IP address, and take it a step further by categorizing the downloads, allegedly making a claim as to whether a given IP address shares abuse-related content.
The trouble with DMCA notices has been well-documented, and no one is likely to argue that calling out abuse/illegal materials is a bad thing, however, it is important to point out that these systems can be exploited to fabricate "evidence" that an IP address is trafficking pirated software, leaked confidential material, or illegal and abusive media files. While it is dubious that a criminal prosecution would commence on only this sort of evidence, an accusation of such deeds appearing on a public website without disclaimer or mention of these issues is troubling as is the apparent lack of conversation or awareness of how easy this forgery is to pull off.
Although one study addressed this from the DMCA angle (the UW paper listed in Resources - way back in 2008), and does show an example of how an IP address can be specified in a simple http request using wget, there seems to be an absence of code to easily parameterize requests or automate any sort of bulk testing, among other desireable features, discussion after this paper seems nonexistent in the public forum.
This repository presents two tools:
- BTForge - A Tracker Spoofing Tool for sending falsified announce messages to BitTorrent trackers. This is a PoC demonstration for evidence forgery.
- DHTrack - A DHT Monitoring Tool and passive tracker daemon for observing and logging DHT traffic, with the ability to focus only on specific info hashes and CIDR blocks. This was created as a way to validate the forgery PoC, but gathers information about real activity on the BitTorrent network as well, which is the point: there is no way to validate alleged information passed from peer to peer or client to tracker via these announcements.
To install these tools, clone the repository and install dependencies:
git clone https://github.com/scottvr/BTRR.git
cd BTRR
pip install -r requirements.txt
The libtorrent python bindings do need to be able to find libtorrent in the library path or working directory.
v1.0
BTForge sends falsified announce messages to a specified tracker URL to demonstrate the ease of planting false evidence.
python btforge.py --info_hash abcdef1234567890 --port 6881 --ip 192.168.1.100 --num_requests 10
--info_hash: The info hash of the torrent (required).--peer_id: The peer ID (optional, random if not specified).--port: The port number (required).--ip: The IP address to announce (required).--num_requests: The number of requests to send (default: 1).--tracker_url: The tracker announce URL (default: "http://tracker.example.com/announce")
v1.0
DHTrack listens for DHT traffic, checking for specific info hashes and CIDR blocks of interest. Results are logged and stored in an SQLite database.
v1.1
- add optional httpserver to serve as passive tracker. Per BitTorrent protocol, it just returns an empty peer list. The tool does not actually function to facilitate torrent transfers; only serves to collect information such as up/download stats.
- since we're now starting two network daemons, add threading capability. (One process, with two threads, one for the DHT listener and one for the http tracker server for the tracker)
python dhtrack.py --hashes_file hashes.txt --cidr_file cidr_blocks.txt --db_file dhtrack.db
--hashes_file: Path to the file containing info hashes to monitor.--cidr_file: Path to the file containing CIDR blocks to monitor.--db_file: Path to the SQLite database file.--tracker_port: (optional) tcp port to bind a passive tracker to, for the purpose of collecting additional information about transfers on the bittorrent network.
Info hashes are stored in an SQLite database for efficient searching. The database schema includes a table for info hashes:
CREATE TABLE IF NOT EXISTS info_hashes (
id INTEGER PRIMARY KEY AUTOINCREMENT,
hash TEXT UNIQUE NOT NULL
);CIDR blocks are also stored in the same SQLite database. The schema includes a table for CIDR blocks:
CREATE TABLE IF NOT EXISTS cidr_blocks (
id INTEGER PRIMARY KEY AUTOINCREMENT,
cidr TEXT UNIQUE NOT NULL
);A utility script is provided to help you create and populate the tables with IP addresses or info_hashes you wish to monitor.
- Demonstrating Vulnerabilities: Show how innocent IP addresses can be implicated in P2P activity using spoofed tracker announces.
- Monitoring Specific Activity: Track specific info hashes or IP ranges for research (such as to verify the PoC to show the spoofed information appear in the DHT or for other network security purposes.
By demonstrating how easily false evidence appearing to show copyright infringement (or worse) can be generated, we aim to encourage improvements in anti-piracy mechanisms and raise awareness about the limitations of IP-based tracking.
- Merriam-Webster definition of "railroad"
- "Tracking the Trackers" - University of Washington BitTorrent/DMCA notice Study
- ratio-spoof on GitHub
- TorrentFreak Article about iknowwhatyoudownload.com