Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Pirate Bay in the cloud

thepiratebay.se

Post reply on HN
Print view View original

11–20 of 72 posts

Re: The Pirate Bay in the cloud

#11

Post by avar »

morsch wrote: post #7

The announcement is rather nebulous, as is their way. TorrentFreak has a more detailed explanation: http://torrentfreak.com/pirate-bay-moves-to-the-cloud-become... It's pretty much what you'd expect, though: The web site is now running on VMs on two unnamed cloud providers, accessed through a load balancer. All traffic is still routed through servers they control. The cloud providers apparently don't know that they'r…

I wonder how vulnerable this approach is to timing attacks similar to the ones you can use to smoke out onion routed machines.

If you know the physical and network location of their routing boxes and you keep polling some (e.g. static) resource on their servers you can eliminate all cloud providers that are further away than the response time as being the hidden backend.

Let's say you narrow it down to 10 candidates and 5 of them experience some sort of network issue that gets reflected in the response times of TPB, you've now narrowed it to 5.

I wonder what they're doing to mitigate these sort of timing attacks meant to discover their hidden backend.

Re: The Pirate Bay in the cloud

#12

Post by shadowmint »

obscure announcement is obscure.

basically seems like they've got a virtual setup now that lets them essentially deploy "the pirate bay" on anything that runs virtual machines.

Now if they had distributed user run VMs running this private server VPN they might have something to talk about, but is basically just a hosting change. Makes it easier for them to move around as hosting get wise and shuts them off (as it will inevitably do).

The real question is, are they doing something sneaky like having VMs running on known clouds using encrypted vpn traffic to hide the fact that those machines are pirate bay VMs, and relays to feed info in and out. ;) Just speculating...

Re: The Pirate Bay in the cloud

#13

Post by Crake »

morsch wrote: post #7

The announcement is rather nebulous, as is their way. TorrentFreak has a more detailed explanation: http://torrentfreak.com/pirate-bay-moves-to-the-cloud-become... It's pretty much what you'd expect, though: The web site is now running on VMs on two unnamed cloud providers, accessed through a load balancer. All traffic is still routed through servers they control. The cloud providers apparently don't know that they'r…

Yeah, I had no idea what was going on until I read your handily provided article, haha.

Re: The Pirate Bay in the cloud

#14

Post by mike-cardwell »

avar wrote: post #11
morsch wrote: post #7

The announcement is rather nebulous, as is their way. TorrentFreak has a more detailed explanation: http://torrentfreak.com/pirate-bay-moves-to-the-cloud-become... It's pretty much what you'd expect, though: The web site is now running on VMs on two unnamed cloud providers, accessed through a load balancer. All traffic is still routed through servers they control. The cloud providers apparently don't know that they'r…

I wonder how vulnerable this approach is to timing attacks similar to the ones you can use to smoke out onion routed machines. If you know the physical and network location of their routing boxes and you keep polling some (e.g. static) resource on their servers you can eliminate all cloud providers that are further away than the response time as being the hidden backend. Let's say you narrow it down to 10 candidates…

Or you could just look at the network traffic that the load balancers are generating to see where the majority of it is going.

I wouldn't bother just taking the load balancers down. I'd go upstream of them to see where the traffic is going, and then take down those hosts at the same time as the load balancers.

Re: The Pirate Bay in the cloud

#16

Post by vidarh »

shadowmint wrote: post #12

obscure announcement is obscure. basically seems like they've got a virtual setup now that lets them essentially deploy "the pirate bay" on anything that runs virtual machines. Now if they had distributed user run VMs running this private server VPN they might have something to talk about, but is basically just a hosting change. Makes it easier for them to move around as hosting get wise and shuts them off (as it wil…

The description on torrentfreak says their archictecture is basically:

1. Border router handling inbound traffic, connecting via encrypted VPN to their load balancer in a different country.

2. Load balancer which is a disk-less server with all configuration in RAM that connects via encrypted VPN to two separate sets of VMs at two separate cloud providers in two different countries.

3. Said VMs using encrypted disk images, and set up to automatically shut down if they are out of contact with the load balancer for more than 8 hours, at which point a keyphrase would need to be entered to unlock the disk images.

I would assume they probably has more routers and load balancers in other locations ready in case they need to switch over.

They can keep this shell game up forever as long as the people operating it are able to get online - adding more layers if necessary.

Re: The Pirate Bay in the cloud

#17

Post by vidarh »

mike-cardwell wrote: post #14
avar wrote: post #11

Earlier quoted context omitted.

I wonder how vulnerable this approach is to timing attacks similar to the ones you can use to smoke out onion routed machines. If you know the physical and network location of their routing boxes and you keep polling some (e.g. static) resource on their servers you can eliminate all cloud providers that are further away than the response time as being the hidden backend. Let's say you narrow it down to 10 candidates…

Or you could just look at the network traffic that the load balancers are generating to see where the majority of it is going. I wouldn't bother just taking the load balancers down. I'd go upstream of them to see where the traffic is going, and then take down those hosts at the same time as the load balancers.

First you would need to find the load balancer, which means you would first need to go after their router, then get the cooperation of a second country. Then you would need the cooperation of two more countries to get at the cloud providers...

... only for The Pirate Bay to spin up more instances elsewhere and point a domain or two at it.

Re: The Pirate Bay in the cloud

#18

Post by subsystem »

mike-cardwell wrote: post #14
avar wrote: post #11

Earlier quoted context omitted.

I wonder how vulnerable this approach is to timing attacks similar to the ones you can use to smoke out onion routed machines. If you know the physical and network location of their routing boxes and you keep polling some (e.g. static) resource on their servers you can eliminate all cloud providers that are further away than the response time as being the hidden backend. Let's say you narrow it down to 10 candidates…

Or you could just look at the network traffic that the load balancers are generating to see where the majority of it is going. I wouldn't bother just taking the load balancers down. I'd go upstream of them to see where the traffic is going, and then take down those hosts at the same time as the load balancers.

The point is your still not taking anything of value, the site could be up on different servers and load balancers in a couple of hours, if not minutes. For the record, torrent sites have been doing this for years.

Re: The Pirate Bay in the cloud

#19

Post by vidarh »

avar wrote: post #11
morsch wrote: post #7

The announcement is rather nebulous, as is their way. TorrentFreak has a more detailed explanation: http://torrentfreak.com/pirate-bay-moves-to-the-cloud-become... It's pretty much what you'd expect, though: The web site is now running on VMs on two unnamed cloud providers, accessed through a load balancer. All traffic is still routed through servers they control. The cloud providers apparently don't know that they'r…

I wonder how vulnerable this approach is to timing attacks similar to the ones you can use to smoke out onion routed machines. If you know the physical and network location of their routing boxes and you keep polling some (e.g. static) resource on their servers you can eliminate all cloud providers that are further away than the response time as being the hidden backend. Let's say you narrow it down to 10 candidates…

Just some in-memory caching on the load balancer could make timing attacks pretty useless.
Post reply on HN