Hacker News Reader

Comment by tonytamps | Hacker News Reader

The private torrent site crowd are very restrictive on which clients are allowed and even big names like qBit aren't safe enough to assume the version is allowed.

View on HN

Although the identification is literally just a string you send when connecting, easy to spoof.

That part is just for your own protection - these are almost always private trackers with ratio requirements.

If you spoof the client name and your client ends up misbehaving/misreporting you'll just get banned for cheating.

I've never looked at the source code of a PT, but my understanding is that they also implement heuristics to detect strange behaviors, i.e. clients trying to fake their ratio.

Not all of them do, but yes. Since it is the client who send all the info (bytes sent/received, version, etc), anything can be spoofed. The tracker, having access to the stats of all the client on a specific torrent can find "unusual" client (for example, a client that report a lot of bytes sent while no other client report downloading/receiving anything, or the opposite). But due do quirks of the networks, delay and possible lost stats messages, they still have to be pretty permissive of small discrepancies. Also, all use an ID in the tracker url for each client to discriminate them and associate them with their account on the website. And some are not very careful about the ID generation algorithm, leading to being easily able to find other account peer ID, and so you can use them to download to preserve your ratio. I even found at least one private tracker that did not care if you passed a non-existent peer ID.

For example there's also something called "ghost leeching" (side channel entirely bypassing tracker reporting) which can lead to other peers reporting upload for which there's no opposite account of download on the tracker. Making it look like peers over-reported upload and cheated when they are in fact entirely innocent. There's no way for a private tracker to be really sure about stats. The most the moderators can do is to check for repeating suspicious usage patterns across many torrents of a particular peer under scrutiny.

I have used patched version of muTorrent. Binary exe contains string private, and I changed it to crivate with hex editor, so that torrent client stops reacting to private flag and starts whistleblowing peers to DHT. I don't think that my client looks unusual.

It does. If the tracker is monitoring DHT. Or, more likely, if your client finds a similar "no respect for private flags" DHT peer, sends data to it, and reports that to the tracker.

Does that weird DHT peer report to the tracker? It may not even have an account there. From the tracker's end, that peer is a ghost, and it looks like your client has reported sending data no one ever received.

I remember using a ratio-fake tool that would basically proxy your reporting to the tracker with the signature of the client you were actually using. It was awesome.

Reply on news.ycombinator.com