The Russian-based PiratePay startup is attempting an old, but in this application novel, strategy to help Hollywood fight against the file sharers that they claim are costing the economy 373000 jobs and $58 billion per year: DDOSing them. As Pirate Pay CEO Andrei Klimenko describes his company’s strategy, “We used a number of servers to make a connection to each and every P2P client that distributed this film. Then Pirate Pay sent specific traffic to confuse these clients about the real IP-addresses of other clients and to make them disconnect from each other.” Pirate Pay’s first testing run of their technology, helping obstruct downloads of the film Vysotsky: Thanks to God I’m Alive, appears to have been moderately successful, blocking 44845 attempted file transfers. Pirate Pay aims to charge $12000 to $50000 for their service depending on the scale of the project, and believes they can scale up their efforts to cause a much larger amount of disruption if necessary.
The question is, can this attack be used against Bitcoin as well? In terms of P2P disruptions in general, Bitcoin and BitTorrent already have a very similar cryptographic hash mechanism that prevents attackers from feeding in false data, making it impossible to force P2P users to download corrupted or malicious file segments or Bitcoin users to download blocks that are invalid or attempt to rewrite history without paying a cost a thousand times higher than what PiratePay is offering, but neither protocol has any built-in protection against IP-based attacks. It is entirely conceivable that an attacker will attempt to disrupt Bitcoin confirmations by preventing nodes from connecting to each other, and even have some success in disrupting P2P functionality. Indeed, there is one vulnerability which was fixed recently which attempted to do exactly this, and it is indeed possible that doing short term harm to certain parts of the network will be feasible once in a while in the future because of errors in the implementation of specific clients. However, in the long run such a strategy will find its efficacy limited by one feature that Bitcoin has that BitTorrent does not: DNS bootstrap. While BitTorrent is designed to work in a 100% decentralized way with no node being trusted more than any other node, making it vulnerable to attacks where thousands of malicious nodes introduce themselves into the system, the standard Bitcoin client has a bootstrapping system where it connects to a number of hardcoded nodes and gathers a list of trusted addresses from there, making it much more difficult to confuse nodes about where the other nodes’ addresses are. Even all peer-to-peer contact becomes impossible, the Bitcoin network could gracefully decay into a centralized block download service.
Also, it’s difficult to imagine that PiratePay’s disruption system will be able to effectively prevent file downloads for any significant length of time. Internet technology has shown itself to be rapidly advancing, and if PiratePay achieves any prominence whatsoever then it’s almost inevitable that someone will develop a slight modification to the protocol that will quickly render this attack obsolete. Possibilities include a decentralized IP reputation system, where clients connect to IPs that have been faithful to them (or other nodes that they already trust) in the past, an obfuscation system that makes it hard to tell what torrent users are sharing or even what protocol they are using, forcing PiratePay to risk arousing the ire of Blizzard, Skype (now part of Microsoft itself) or even governments, or defenses targeting specific aspects of the attack that PiratePay is currently not revealing but which will become public once the attack becomes widely implemented. It’s even conceivable that organizations like Anonymous will try to use various forms of denial of service attacks against PiratePay itself.
Finally, even if some disruption scheme is able to prevent some clients from connecting to the Bitcoin network even through the bootstrap system, unbroken network access is not nearly as necessary to participate in Bitcoin as it is in file sharing protocols. If you are attempting to download Vysotsky and PiratePay successfully disconnects you 99.9% of the time, it will take you 1000 times longer to download the file – increasing the download time to several months, making it a compelling proposition for many to either buy the movie instead or ignore it outright. If you are trying to send a Bitcoin transaction, however, and you experience 99.9% disruption, it will simply take a few hours for the transaction to get across the network rather than a few seconds. All it takes is one message to send a transaction from one node to another. There will of course be heavy blockchain splitting, and transactions may take a day to reliably confirm, but the transactions will eventually be relayed somehow.
Neither this attack nor any other will arrive at anything close to the end of copyright infringing file sharing, and Bitcoin has the advantages of far higher protocol efficiency and less need for secrecy that counteract even most attacks that may succeed against BitTorrent. Decentralized systems have proven themselves to be more reliable than centralized ones, but Bitcoin’s combination of the two paradigms is even stronger still. The best strategy to protect Bitcoin right now is not to worry about attacks against other protocols that may not even be used against Bitcoin at all, but rather to promote adoption of Bitcoin in general to help increase the size of the network and buffer it against any attacks or disruptions that attackers may try to implement no matter what their specific form.
