Detected sources of garbage P2P traffic.
During the past few weeks, the specialists of the Polish Computer Emergency Response Team observed a curious circumstance - users of the BitTorrent protocol are in danger of getting an unplayable binary file instead of the downloaded files, as there are numerous sources of fake P2P traffic on the network that pretends to be the most popular files most actively downloaded by torrent users trackers. Most of the unusual peers are located in Russia, Canada, China, Australia and the United States, whose IP addresses are probably also fake. Also, Polish experts were surprised that the most often “garbage” is downloaded by users who are interested in popular Russian film shows like “August. Eighth "or" Spy. "
Moreover, the experts tried to download the mentioned films from several popular torrent trackers and found that the number of siders, distributing the film “August. Eighth, an order of magnitude greater than the number of peers trying to download it. However, the situation with the series “Lost” (Lost) is completely different.
')
This is what the package statistics on hash 057a315b89b54e53e2ee583dd5cd9ef60648805e looks like, which corresponds to the film “Augustus Eighth,” distributed by the top siders.
As you can see, most packages are zero.
This circumstance allowed us to link a massive attack on the BitTorrent network with the Russian startup PiratePay , which also recently received a significant round of funding from Microsoft. As a confirmation of this indirectly, you can consider a direct application on the website of the above-mentioned startup:
A large technical article by Polish experts is here .
Moreover, the experts tried to download the mentioned films from several popular torrent trackers and found that the number of siders, distributing the film “August. Eighth, an order of magnitude greater than the number of peers trying to download it. However, the situation with the series “Lost” (Lost) is completely different.
 |  |
')
This is what the package statistics on hash 057a315b89b54e53e2ee583dd5cd9ef60648805e looks like, which corresponds to the film “Augustus Eighth,” distributed by the top siders.
------ + ------------------------------------------- ------
329755 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
399 2d54 5232 3432 302d xxxx xxxx xxxx xxxx xxxx xxxx // -TR2420-xxxxxxxxxxxx
214 2d54 5232 3530 302d xxxx xxxx xxxx xxxx xxxx xxxx // -TR2500-xxxxxxxxxxxx
213 2d54 5232 3432 302d xxxx xxxx xxxx xxxx xxxx xxxx // -TR2420-xxxxxxxxxxxx
100 2d55 5432 3231 302d xxxx xxxx xxxx xxxx xxxx xxxx // 2 T2210-xxxxxxxxxxxx
97 2d55 5431 3737 302d xxxx xxxx xxxx xxxx xxxx xxxx // -UT1770-xxxxxxxxxxxx
95 2d54 5231 3933 302d xxxx xxxx xxxx xxxx xxxx xxxx // -TR1930-xxxxxxxxxxxx
93 2d54 5231 3933 302d xxxx xxxx xxxx xxxx xxxx xxxx // -TR1930-xxxxxxxxxxxx
91 2d55 5433 3132 302d xxxx xxxx xxxx xxxx xxxx xxxx // -UT3120-xxxxxxxxxxxx
90 2d4d 4732 3125 302d xxxx xxxx xxxx xxxx xxxx xxxx // -MG21% 0-xxxxxxxxxxxx
As you can see, most packages are zero.
This circumstance allowed us to link a massive attack on the BitTorrent network with the Russian startup PiratePay , which also recently received a significant round of funding from Microsoft. As a confirmation of this indirectly, you can consider a direct application on the website of the above-mentioned startup:
In connection with the information that appeared in the media, we consider it necessary to make an explanation: the initiators and customers of the measures to protect the feature film Vysotsky. Thank you for being alive "were the producers and producer of the film company" Directorate of Cinema. "
A large technical article by Polish experts is here .
Source: https://habr.com/ru/post/144167/
All Articles