Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×
Privacy The Internet

Privacy In BitTorrent By Hiding In the Crowd 240

pinguin-geek writes "Researchers at the McCormick School of Engineering and Applied Science at Northwestern University have identified a new 'guilt-by-association' threat to privacy in peer-to-peer (P2P) systems that would enable an eavesdropper to accurately classify groups of users with similar download behavior. While many have pointed out that the data exchanged over these connections can reveal personal information about users, the researchers shows that only the patterns of connections — not the data itself — is sufficient to create a powerful threat to user privacy. To thwart this threat, they have released SwarmScreen, a publicly available, open source software that restores privacy by masking a user's real download activity in such a manner as to disrupt classification."
This discussion has been archived. No new comments can be posted.

Privacy In BitTorrent By Hiding In the Crowd

Comments Filter:
  • only works with (Score:3, Insightful)

    by esocid ( 946821 ) on Thursday April 09, 2009 @10:11AM (#27517815) Journal
    Vuze (azureus), which I dropped because of how bloated it is. Why java? utorrent is the way to go.
    • Re:only works with (Score:5, Insightful)

      by Akido37 ( 1473009 ) on Thursday April 09, 2009 @10:14AM (#27517855)

      Vuze (azureus), which I dropped because of how bloated it is. Why java? utorrent is the way to go.

      Vuze's bloat problem isn't Java.

      It's feature creep. Sometimes I just want to download a torrent.

      • by courseofhumanevents ( 1168415 ) on Thursday April 09, 2009 @10:26AM (#27518043)
        I wish there was a +1 Correct mod. This isn't exactly insightful or interesting.
      • Re:only works with (Score:4, Insightful)

        by Kjella ( 173770 ) on Thursday April 09, 2009 @10:40AM (#27518187) Homepage

        Vuze's bloat problem isn't Java.

        While I know some stunning things done in java, the four most bloated applications I know are also written in java. I guess it's like C/C++ and buffer overflows, those who like the langauge say good developers don't do that but in practise java seems to lend itself easily to bloat. In theory any developer can do anything in any language that's Turing-complete, it all comes down to how productive real developers are in practise...

        • The main issue with Java for desktop apps is the GUI. Ever since java got started it's GUI frameworks have been clunky and slow. Eclipse went so far as to write there own GUI frame work, SWT, to deal with these issues. http://en.wikipedia.org/wiki/Standard_Widget_Toolkit [wikipedia.org] If you look that the Java version history (http://en.wikipedia.org/wiki/Standard_Widget_Toolkit [wikipedia.org]) You'll see that just about every major release makes some upgrades to the GUI layer. The most drastic was in the 3ed major release (Java 1.2) w
          • by Ilgaz ( 86384 )

            As far as I understand, Sun people now pushes the Java FX instead of Swing making actually successful Swing developers mad. It is the exact same reason why everyone hoped IBM takeover, to add some direction and stability.

              Sun should be supporting Limewire, Vuze with money and send thank you notes every week for making such actually successful apps.

            • everyone hoped IBM takeover, to add some direction and stability.

              Actually I think they would stop development, increase the price and take what profit they could. You would definitely see some stability that way.

        • Well, I've just started with C++, but what I can say is that with C, I can't imagine feature-creep being a major problem.

          "Hey, maybe I should write a dingo that does a whatsitmacalled that only 0.3% of users will ever want. ...wait, I've got to write it in C?

          SOFTWARE BLOAT IS EVIL!"

          • How is C any worse than Java, where your classes' interfaces have helper classes to instantiate someone else's classes and maybe one in 30 lines of code actually does something tangible. It's real cute to make everything modular, but in practice it ends up being idealist bullshit that never gets put to real use, because there are very few coders who can wrap their head around truly useful OO designs.

        • Yeah where I work there is a project to develop a totally new user interface in Java. The application it replaces is written in C and Motif. The new one is about half done and the SLOCS are about 10 times the total in the old UI. Development time for new features is at least double and the team which develops it is about five to ten times the size.

          I think the OO methodology they use accounts for part of it. Everything seems to be built out of these huge blocks.
      • by AliasMarlowe ( 1042386 ) on Thursday April 09, 2009 @10:45AM (#27518259) Journal

        Vuze's bloat problem isn't Java.
        It's feature creep. Sometimes I just want to download a torrent.

        I'd call it malfeature creep with a commercial bent, in an unnatural union with a hideously malformed GUI.
        I installed Vuze innocently and optimistically enough, but as soon as I started it and saw the abomination appear, its days - nay, minutes - on my system were numbered. It was utterly expunged after a quick kill.

      • Re:only works with (Score:4, Informative)

        by Ilgaz ( 86384 ) on Thursday April 09, 2009 @11:11AM (#27518687) Homepage

        Set it to Run in "Advanced Mode" on startup. And for "just downloading a torrent", I don't think anything will beat rtorrent from console.

        • by raynet ( 51803 )

          For command-line torrenting aria2 is another minimalistic option.

        • by Mex ( 191941 )

          I'm a former Azureus / Vuze user, I loved the thing because at the time uTorrent was neither stable nor very good in general.

          Azureus (plain old Azureus) was excellent, top 3 of the bittorrent clients at the time.

          But it took a hard nosedive after Vuze appeared, I was amazed at how bloated it quickly became. It was a matter of weeks, not months or years like other apps that get bloated.

          Slow, bad memory management, horrible UI, etc etc.

          I even stuck with it for a year, hoping that all the bugs would get worked

      • Alas, Java (runtime) itself is bloat as it consumes many many many times more system resources than a native app.
    • by 0100010001010011 ( 652467 ) on Thursday April 09, 2009 @10:17AM (#27517903)

      Utorrent, which I dropped because of how bloated it is. Why GUI? rtorrent is the way to go.

    • Re: (Score:3, Insightful)

      by talz13 ( 884474 )
      Since it runs on every platform that supports java? Since it has useful plugins? Since taking up 1% of my CPU and 300MB of ram to seed 10 torrents doesn't bother me much on a quad core with 4GB of RAM?
      • Re: (Score:2, Funny)

        by FinchWorld ( 845331 )
        "Since taking up 1% of my CPU and 300MB of ram to seed 10 torrents doesn't bother me much on a quad core with 4GB of RAM?"

        So you like things needlessly eating up more resources? Man, you should run a vista vm, inside a vista vm, on vista!

        • Re: (Score:2, Insightful)

          So you like things needlessly eating up more resources?

          What's the point of buying RAM and CPU only to have it underutilized all the time? You might as well go back to only having 16 megs of RAM and a 386 if you are going to complain about 1% usage of CPU and 7.5% usage of total RAM.

          • Re: (Score:2, Funny)

            by Anonymous Coward

            What's the point of buying RAM and CPU only to have it underutilized all the time?

            You over bought then. If global warming is a real concern, then it should matter to you that software is inefficient. True it may not matter a lot that one person is running some bloatware, but when you've got three hundred million people running bloatware, then being a few percent more efficient makes sense.

          • Re: (Score:3, Informative)

            by Ilgaz ( 86384 )

            Funny is, these are the same people demanding 64bit Flash plugin because they run 64bit browser on an 64bit OS.

            If Apple was decent enough (or developers could code anything actually multi arch) to release Snow Leopard for 64bit G5 Macs, I would upgrade to 8 GB (from 4.5 GB) on my Quad G5 in no time. Its max is 16GB btw.

            • Funny is, these are the same people demanding 64bit Flash plugin because they run 64bit browser on an 64bit OS.

              I've pretty much given up even trying to run 64-bit apps that have a large number of 3rd-party add-ons, since most of the add-ons have not been re-compiled for 64-bit.

              Although I suppose a 64-bit browser could be faster, the best thing about a 64-bit OS is that the 32-bit browser can go ahead and use 1GB of RAM and it doesn't really matter. I only have 6GB, but it's also only $100 for another 6GB. A 64-bit OS really helps you run more apps at the same time, and not worry about how much RAM they are taking.

              • by Ilgaz ( 86384 )

                On X86 land, 64bit also means extra registers and commands. It is not like PowerPC which was designed to be 64bit in future from the start.

                It took a while for me to understand that fact, I was wondering why people need 64bit "notepad" apps.

                For the kernel wise things (e.g. general device drivers) or applications not actually needing 64bit, running 32bit is actually faster than 64bit on PowerPC. Meanwhile, Adobe can ship 64bit Photoshop for OS X _today_ which will really run great on both x86-64 and PowerPC 6

          • Yeah, but downloading and uploading are activities that are supposed to happen in the background. This means that you're typically running something in the foreground. Whatever resources are being used in the background will not available for your foreground tasks.

            And if you do any kind of photo or video processing, or play with Google Maps on Firefox, you know you'll need all the resources you can get. Not to mention that bloated software tends to affect your foreground tasks sporadically regardless of how

        • by blueg3 ( 192743 )

          Taking up 1% CPU is fairly trivial. The memory impact is a little on the high side, but if you're familiar with how BitTorrent works, you should appreciate that it either needs to do a fair amount of memory buffering or you will make more trips to the disk. Some BitTorrent clients let you tune that. Seeding multiple torrents while permitting a reasonably large number of connected downloaders is a data-intensive task, any way you slice it.

      • Re: (Score:3, Interesting)

        by Ilgaz ( 86384 )

        It took uTorrent guys 1 or more years to ship a OS X version even while their code is still i386 only. The idea of "run on every platform which has a sane Java and support everything" will keep sending developers/researchers to Vuze no matter how much it is attacked by Java and even paid commercial content hating hating people.

        Let me remind again that uTorrent is NOT an open source software which is also owned by MPAA/RIAA members partners Bittorrent.com.

        They do a great job hiding that fact lately it seems.

    • Bloat is not the word.

      Vuze is a F-ing multimedia billboard.
      It even plays commercials while you try to figure out what the F--k you just launched!

      All the tools to tweak it as to not piss off my ISP are gone. I went uTorrent and kicked myself I didn't do it sooner.

    • Re: (Score:2, Informative)

      by wud ( 709053 )

      i use torrent flux, and it destroys everything else. LAMP based, so I can access it from any computer in my house. I strongly recommend it. http://www.torrentflux.com/ [torrentflux.com]

    • Re:only works with (Score:4, Informative)

      by drchoffnes ( 1256396 ) on Thursday April 09, 2009 @10:37AM (#27518149)
      (From the one of the software authors) UTorrent doesn't support plugins and is closed source. If that were to change, we'd happily develop for it.
      • So much is wrong in the bittorrent world, but so little can be done due to utorrent's closed nature :(

    • Re:only works with (Score:4, Insightful)

      by Ilgaz ( 86384 ) on Thursday April 09, 2009 @10:54AM (#27518423) Homepage

      Well, it seems to be open source and gives the developers all the stuff they need to code such a plugin. Except memory usage (which I got plenty to use), I don't see it uses more than 2-5% CPU too. As a person who wants to use P2P technology but in a way that I can pay for the content, their "Vuze Guide" gives me what I need too.

      and uTorrent? The one acquired by DRM loving Bittorrent.com because it was way too popular compared to their junk client and nobody knows what is inside it anymore? Before attacking an application as "bloated", pick your other suggestion well.

      Even if it supported plugins, releasing such a privacy enhancing plugin for uTorrent would be the irony of the month.

      • by Omestes ( 471991 )

        Transmission, for those of us who have a spare linux/os x box.

        How does bittrorrent.com like DRM? This is the first I've heard of it, please explain.

        Vuze is the only bittorrent client I've used that actively crashed my PC. Why would a bittorrent client cause me to blue screen around four times in a row? I don't like the fact, as well, that its actual useful features (you know, as a bittorrent client) are somewhat hidden, and requires some clicks to actually view the information that you want to see, like

        • If someone could recommend a good FOSS torrent client for Windows, I'd hop on it in a second.

          Have you tried BitTornado? It's actually quite OK - functional but not overburdened with crap - and is widely included in Linux distributions. The Windows binary and Python source (also for Linux) are available from http://www.bittornado.com/ [bittornado.com]
          You could do a lot worse (e.g. Vuze [pukes copiously]).

          • I used it on windows for almost 2 years before I discovered uTorrent.

            Its small, but I'd rather use a command-line based program than bittornado ever again. And why not rtorrent or utorrent? They're both well-developed and work flawlessly...

            • I used it on windows for almost 2 years before I discovered uTorrent.
              Its small, but I'd rather use a command-line based program than bittornado ever again. And why not rtorrent or utorrent? They're both well-developed and work flawlessly...

              We're well-provisioned with RAM and bandwidth, so any non-toxic BT client will work fine for me. BitTornado's use of screen real-estate is also a non-issue (dual monitors with multiple desktops). I might give rTorrent a whirl some time. We're a linux-only home, so uTorrent is not practical (don't use Wine or Windows in VMs).

    • Sure, give us open uTorrent and it'll work great.
      It may have it's flaws, but my personal favourite client remains Deluge.
    • I know that people don't read articles on Slashdot but that's seriously about half way down the list:

      Why use the Vuze/Azureus BitTorrent client? For one, it's probably the most popular client in terms of use, so targeting Vuze gives us the greatest potential impact. Additionally, Vuze is Java-based, meaning anyone can run their software (and ours). Finally, Vuze offers a convenient plugin feature, requiring no changes to your existing Vuze client. And once you're running SwarmScreen, it will automatically search for new versions and update itself for you!

      In addition, Java plugins are trivially ported to other systems. Azureus (I refuse to call it Vuze) also has some useful debugging tools.

      Not to mention that ÂTorrent is not Free Software, so it is definitely not the "way to go." I mean, seriously, the thing is Windows only, what's happening to Slashdot that some closed source Windows piece of crap is "the way to go?"

      Disclaimer: I am a computer science m

    • uTorrent is nice performance-wise, yes. It's closed source though, and therefore untrustable. Hardly a viable solution to post in response to an article about anonymity.

    • It's not the Java.

      I used Azureus for years back when it was still called Azureus and a torrent client rather than some kind of crappy media portal. It was very sleek, really fast on my old laptop that slows down if Firefox and Thunderbird are running simultaneously, and shiny.

      When it got renamed and got this stupid front-end page, I put up with having to manually switch to the advanced view for a while, and then tossed it out. Even in classic mode, the program spent at least five minutes loading its GUI. Th

  • by galorin ( 837773 ) on Thursday April 09, 2009 @10:14AM (#27517849)

    Now my downloading of Linux ISO's and pre-release movies is going to be mingled with horse porn. Just what I always wanted.

    • Re: (Score:2, Funny)

      by ndavis ( 1499237 )

      Now my downloading of Linux ISO's and pre-release movies is going to be mingled with horse porn. Just what I always wanted.

      Nope instead it will always show you downloading a CD from the RIAA so they can send you a bill. This is the new idea to raise money you write a program that makes everyone look like a criminal.

      Maybe if we did do this we could invalidate their methods?

  • But now this thing will start running kiddie porn and illegal software, viruses and Malware though my connection as well so that I don't get classified as any.

    I'd love to see what defence you use when your door gets bashed in in the middle of the night.

  • by Anonymous Coward on Thursday April 09, 2009 @10:15AM (#27517865)
    RIAA Lawyer: We obtained a warrant to search the defendant's home when traffic was identified as being characteristic of SwarmScreen. When the defendant's machine was recovered, we discovered they indeed had SwarmScreen installed--a program only used to subvert our techniques of classifying thieves. That, ladies and gentlemen of the jury, should be enough for indication of guilt.

    The endless cat & mouse game continues ...
    • Ah, if the concern is to perhaps be falsely accused of masking your download content with SwarmScreen, then why not just write in that feature to every torrent client out there?

      Yes, we know where this COULD go in the legal system, but oddly enough, Common F. Sense has reported absent from our legal system for the last decade or two...

      • Re: (Score:2, Insightful)

        by sbeckstead ( 555647 )
        Actually you are quite wrong, we, the intelligent ones, have killed common sense ourselves by not having enough children WITH common sense to make a difference. Further we have disdained the voting process and let the morons run the school boards, the ogres run the police and the uninformed make the rest of our decisions for us. We need a smart people forced breeding program and a full eugenics program to make up for the idiocracy we have created.
  • Legitimate uses (Score:5, Insightful)

    by olddotter ( 638430 ) on Thursday April 09, 2009 @10:25AM (#27518025) Homepage

    Can companies that use bit-torrent to do legitimate work speak out in its defense? I fear the "guilty by association" is much more along the lines of "you use bit-torrent, therefore your guilty".

    Frankly if this improves upon that, it might be a help to bit-torrent users that aren't pirates.

    • I think it goes deeper than that - what are the legitimate:nonlegitimate traffic ratios on trackers? Its not as simple as saying 'BitTorrent has legal uses' if a particular popular tracker has no legitimate torrents.
    • SwarmScreen is just an extra overhead to those companies. They don't give half a shit, let alone a full one, if it helps Johnny Freebooter get his Screener release without being profiled.
       
      The companies who use BitTorrent for legitimate purposes don't need SwarmScreen.

    • by blueg3 ( 192743 )

      In criminal investigation, at least, you don't really see "guilt by association" for P2P clients. Everyone and their brother has LimeWire or a BitTorrent client (or multiple ones) installed, so the fact that they have a copy of uTorrent doesn't tell you anything useful.

  • by JeffSpudrinski ( 1310127 ) on Thursday April 09, 2009 @10:30AM (#27518081)

    Okay...

    According to TFA, their software will download random data from BitTorrent to your system to hide what you really wanted to dowload within a cloud of random downloads.

    Are you SURE you want to allow random data from BitTorrent to be downloaded onto your computer? There's a LOT of stuff out there that I wouldn't want even the remote chance (e.g. being selected randomly) of having it on my computer.

    Just sayin'.

    -JJS

  • Summary of Story (Score:5, Insightful)

    by manekineko2 ( 1052430 ) on Thursday April 09, 2009 @10:34AM (#27518113)

    Here's a summary of their findings, because the one provided by Slashdot doesn't really do a good job in my opinion of describing it.

    BitTorrent downloaders apparently fall into "communities" that have very similar downloading patterns. In light of this, they think that it would be possible for an argument to be made, that if one member of a community is downloading X, that the behavior can be imputed through guilt-by-association onto all other members of that community. Therefore, you wouldn't necessarily need evidence that a given member of a community actually engaged in the downloading, due to the high degree of correlation between community member downloads.

    This strikes me as a bit of dubious reasoning from a legal standpoint, as just because you hang out with a bunch of mobsters all day, and there's a high correlation of that with committing theft, doesn't mean they can try you for robbery just through guilt-by-association without more evidence that you're a robber. Still, courts have made weird conclusions in the past simply because computers and the Internet are involved.

    For now, their software and idea mostly seems like a neat proof-of-concept. Until someone actually tries to deploy this legal argument in a court somewhere, I don't think I'll be losing too much sleep over this. Might be worthwhile for someone in a totalitarian regime that for some reason needs to be downloading over BitTorrent, but I don't know how realistic a concern that really is.

    • by burris ( 122191 )

      Perhaps this creates enough "reasonable doubt" to evade a criminal conviction in the absence of other evidence. However, for a civil infringement suit the standard of proof is the much lower "preponderance of evidence."

      In the USA at least...

    • Re: (Score:3, Informative)

      by hemp ( 36945 )

      What world do you live in?

      Associating with known terrorist groups will automatically get you labeled as a terrorist and win you either execution or jail time.
       

    • by ruin20 ( 1242396 )

      I wouldn't worry about being taken to trail for this, I'd be worried about search warrants being issued based on this data. In other words, if you fall into a community downloading mixed materials, some public domain, some copyrighted, a conviction on one member of the community would be used to subpoena the other members. The idea of "Because you are part of a community illegally distributing protected works, we want to search your hard drive for illegal obtained data" doesn't seem like it would be too far

  • by yourexhalekiss ( 833943 ) <herp.derpstep@com> on Thursday April 09, 2009 @10:36AM (#27518133) Homepage
    It seems like more and more of Cory Doctorow's book "Little Brother" is coming to life. In relation to this article, see chaff [paranoidlinux.org].
  • by bjamesv ( 1528503 ) on Thursday April 09, 2009 @10:50AM (#27518335)
    By firing up random connections, this only protects you from an ISP that is profiling your use. The MPAA can still go fire up a bitorrent client, join a swarm downloading content they claim copyright on and start writing down the IP of everyone who is participating. And then they call up your ISP. this 'masking' technique doesnt actually 'mask' anything very well.
    • by pbhj ( 607776 )

      Don't the torrent networks disallow MPAA use? That would mean on connection that the MPAA is in breach of contract, they're not law enforcement agents and presumably don't have a warrant of the court??

      • Don't the torrent networks disallow MPAA use? That would mean on connection that the MPAA is in breach of contract, they're not law enforcement agents and presumably don't have a warrant of the court??

        It would be impossible to breach the contract of a website outside of the US, I believe(I am curious myself, so someone correct me if I'm wrong), however you can use Peer Guardian for some basic protection from connections from places such as MediaSentry.
        And, yes, there has been questions raised before about XXAA & MediaSentry getting/not having a private investigator license:
        http://delta.techdirt.com/blog/index/articles/20090219/0135273829.shtml [techdirt.com]

    • The MPAA can still go fire up a bitorrent client, join a swarm downloading content they claim copyright on and start writing down the IP of everyone who is participating.

      then you could easily defend yourself by saying: "The MPAA personally sent me that file! I would like them to be inclued in the lawsuit"

  • While this seems like a great idea if you're being targeted at random to see what you're downloading (and by proxy getting the community at large) it won't help if Symantec, MS, EA, etc., catches you downloading their software from a honeypot seeder. It seems to be that the only true protection is the use of darknets and sharing with friends only.

    The only problem there is it isolates the users from the community so much that it's hard to get the wares because there is no set distribution pipe, only the hop

    • by blueg3 ( 192743 )

      There are actually other solutions: an anonymizing network layer, like I2P or Tor (yes, yes: don't use the existing Tor network in this fashion), and anonymous sharing protocols, like FreeNet.

  • by macraig ( 621737 ) <mark@a@craig.gmail@com> on Thursday April 09, 2009 @01:05PM (#27520583)

    If one doesn't like eavesdropping, what's wrong with simply dropping connection attempts from the IPs of known or suspected eavesdroppers? If I'm using PeerGuardian, why do I need SwarmScreen?

    • by blueg3 ( 192743 )

      For one, because SwarmScreen primarily protects against people who observe your connection profile, e.g., ISPs. You are unable to conceal this information from them without a system like Tor.

      For another, the problem with PeerGuardian is the spies who aren't using known IP addresses. Does PeerGuardian block all Tor exit nodes?

    • Multiple layers of security.
      That said, I think onion-routing BT could work, but would likely be slow (like pretty much every other onion-routed network out there.)
  • You know, this is a much more VC-pleasing term. Let's use that.

He has not acquired a fortune; the fortune has acquired him. -- Bion

Working...