Download detection of peer to peer applications

DETECTION OF PEER TO PEER APPLICATIONS
AN OPSWAT WHITE PAPER
Author: Priti Dadlani
Contributors: Benny Czarny, Steven Ginn, Toshit Antani
April 2008
OPSWAT, INC.
www.opswat.com
CONTENTS
Introduction ................................................................................................................ 3
Methods of Detecting P2P Applications .................................................................... 3
Network Based Detection ............................................................................................... 3
Client Based Detection .................................................................................................... 4
Client Behavioral Detection ............................................................................................ 4
About OPSWAT ........................................................................................................... 5
2
INTRODUCTION:
A peer to peer (P2P) application, such as BitTorrent, Kazaa, Napster, etc., is
software where clients communicate directly with each other over a common
network. The application acts both as the client as well as the server. A common
use case of a P2P application is file sharing. Simple file sharing has raised a lot
of controversy and questions challenging the usage of P2P applications. An issue
that has been raised is the legality of file sharing. Many files that are being shared
between clients do not have authorization of the copyright owner, making it illegal
to transfer. Also, the bandwidth consumption of P2P applications has caused a
network delay for users. Computers running P2P applications are also vulnerable
to data leaks simply because important information can be easily transferred over
a network that may not be tracked or monitored. P2P applications have caused
concern in etwork administrators, forcing them to disable P2P applications from
gaining network access. This document will outline two technologies in detecting
P2P applications, client based and network based.
METHODS OF DETECTING P2P APPLICATIONS:
There are various methods that security vendors use in order to detect P2P technology, below are two common methods that are currently used.
Network Based Detection
Some P2P applications communicate and function thru a common port, common
protocol, or use a common traffic pattern. A Network based approach uses both
network sniffing and network scanning. Network sniffing looks for both P2P traffic
patterns and packets. Network scanning looks for common ports or protocols that
may be open. These methods are useful for detecting P2P applications such as Piolet. Piolet is an executable which can be dropped and run from anywhere. It requires
no installation and leaves no footprint behind. An administrator is able to watch the
network traffic and determine whether an application like Piolet is in use.
Network scanning or sniffing to see if certain P2P patterns are present can have its
limitations. New age P2P applications use what is called “anonymous P2P” technology. The networks used by these “anonymous P2P” applications (Winny, Imule, Rodi,
etc.) carry no identifiers and the IP addresses of the networks are encrypted. This
makes it almost impossible for P2P traffic to be traced and identified.
3
Client Based Detection
Client based detection is typically performed by analyzing the footprint that the
P2P application leaves behind. This includes the registry keys installed, binary
files installed, MD5 signature of the running process, and the name of the running
process. With client based detection it is easy to take remediation actions against
the P2P application. Administrators can prevent the application from being run
and can even monitor the files that are being transferred. This method of detection can detect “anonymous P2P” applications, as well, by using the footprint left
behind. RShare is an example of a P2P application that anonymizes and encrypts
the network traffic it uses. Detection of this application can be based on the
registry information that gets installed or the running processes. Unfortunately,
a disadvantage to this is the P2P applications’ footprint can be tampered with. A
user can easily go in and delete the installed registry keys of the product, rename
the executable, or change the MD5 signature to spoof something safe and reliable, once again leaving network administrators unaware that a P2P application is
running and in use.
Client Behavioral Detection
Every P2P applications executable contains a binary representation of instructions that it needs in order to run correctly. Behavioral detection of P2P applications tracks the execution patterns and specific code patterns, such as state
machines, protocols, and or network activity. By using the assembly based binary
signatures and other behavior of the application (ports opened, files being accessed, and other techniques), security software can identify whether or not an
executable in question is a valid P2P application or not. By enumerating through
all the running processes and monitoring its behavior it is possible to detect
a P2P application disguising itself as a valid executable such as “notepad.exe”.
Winny is an example of an “anonymous P2P” application that leaves no footprint
behind. Network based and pure client based detection would not be able to
detect a product like this. Analyzing the assembly signature of the executable
and monitoring the behavior of how this application works could give an administrator insight on if this product is running or not. There are of course drawbacks
to this method of detection. The application must be analyzed on the endpoint
and behavioral detection can make it difficult to guarantee a certain level of
performance.
4
ABOUT OPSWAT
Founded in 2002, OPSWAT (www.opswat.com) is the world leader in development
tools and data services that power products managing features of security applications. OPSWAT SDKs and services enable integration with a broad range of applications from traditional security products such as antivirus, antispyware, personal
firewalls and hard disk encryption applications to more conventional products such
as browsers, instant messenger and peer to peer applications with security-related
features. OPSWAT is headquartered in San Francisco, California, with an additional
office in Herzliya, Israel.
OPSWAT™ and the OPSWAT logo are trademarks of OPSWAT, Inc. or its affiliates.
All other names mentioned herein are trademarks or registered trademarks of their respective owners.
5