Privacy of users in P2P networks goes far beyond their current usage and is a
fundamental requirement to the adoption of P2P protocols for legal usage. In a
climate of cold war between these users and anti-piracy groups, more and more
users are moving to anonymizing networks in an attempt to hide their identity.
However, when not designed to protect users information, a P2P protocol would
leak information that may compromise the identity of its users. In this paper,
we first present three attacks targeting BitTorrent users on top of Tor that
reveal their real IP addresses.
Some BitTorrent users are running BitTorrent on top of Tor to preserve their
privacy. In this extended abstract, we discuss three different attacks to
reveal the IP address of BitTorrent users on top of Tor. In addition, we
exploit the multiplexing of streams from different applications into the same
circuit to link non-BitTorrent applications to revealed IP addresses.
This paper presents a set of exploits an adversary can use to continuously
spy on most BitTorrent users of the Internet from a single machine and for a
long period of time. Using these exploits for a period of 103 days, we
collected 148 million IPs downloading 2 billion copies of contents. We identify
the IP address of the content providers for 70% of the BitTorrent contents we
spied on. We show that a few content providers inject most contents into
BitTorrent and that those content providers are located in foreign data
centers.