Hacker News Reader

Comment by MichaelGG | Hacker News Reader

I thought that BitTorrent used TCP? If so, spoofing a connection requires being in a position where you can intercept the return packet in order to be able to complete the TCP handshake. Possible, but requires a spoofer to be very well connected.

View on HN

You don't need to spoof a TCP connection to register a spoofed IP address on a tracker. The tracker GET request has an optional `ip` field, the contents of which is registered as the client's address, regardless of the source address of the actual request. So it's trivial to write a Bittorrent client that reports a false address to the tracker.

http://bittorrent.org/beps/bep_0003.html

So does this optional parameter fully override the peer's address in the reporting ?

Probably. When the tracker responds with a list of peers, each peer only has an id, an ip & a port; there's no real_ip or reported_ip parameters. Of course there could be tracker software in the wild that ignores the ip parameter entirely; it's just a spec, not a contract.

Thanks for the clarification. This makes it entirely possible to spoof someone's address then by a third party.

Wow, that's very interesting. Thanks!

I don't think they mean spoof in such a technical way. I think they just mean it as "the You Have Downloaded website could be just generating files to go with IPs", and similarly "any torrent logs may have been spoofed/made up."

Obviously the next step for the You Have Downloaded site is to track in real-time and say "This IP is currently downloading x,y,z."

Reply on news.ycombinator.com