Total Eclipse of the Heart – Disrupting the InterPlanetary File System

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Peer-to-peer networks are an attractive alternative to classical client-server architectures in several fields of application such as voice-over-IP telephony and file sharing. Recently, a new peer-to-peer solution called the InterPlanetary File System (IPFS) has attracted attention, which promises to re-decentralise the Web. Being increasingly used as a stand-alone application, IPFS has also emerged as the technical backbone of various other decentralised solutions and was even used to evade censorship. Decentralised applications serving millions of users rely on IPFS as one of their crucial building blocks. This popularity makes IPFS attractive for large-scale attacks. We have identified a conceptual issue in one of IPFS’s core libraries and demonstrate their exploitation by means of a successful end-to-end attack. We evaluated this attack against the IPFS reference implementation on the public IPFS network, which is used by the average user to share and consume IPFS content. Results obtained from mounting this attack on live IPFS nodes show that arbitrary IPFS nodes can be eclipsed, i.e. isolated from the network, with moderate effort and limited resources. Compared to similar works, we show that our attack scales linearly even beyond current network sizes and can disrupt the entire public IPFS network with alarmingly low effort. The vulnerability set described in this paper has been assigned CVE-2020-10937. Responsible disclosure procedures are currently being carried out and have led to mitigations being deployed, with additional fixes to be rolled out in future releases.
Original languageEnglish
Title of host publication30th USENIX Security Symposium (USENIX Security 21)
Publication statusSubmitted - 15 Oct 2020
Event30th USENIX Security Symposium - Vancouver, Canada
Duration: 11 Aug 202113 Aug 2021

Conference

Conference30th USENIX Security Symposium
Abbreviated titleUSENIX Security '21
CountryCanada
CityVancouver
Period11/08/2113/08/21

Fields of Expertise

  • Information, Communication & Computing

Treatment code (Nähere Zuordnung)

  • Application

Fingerprint Dive into the research topics of 'Total Eclipse of the Heart – Disrupting the InterPlanetary File System'. Together they form a unique fingerprint.

Cite this