A Botnet Accidentally Destroyed I2P

https://www.sambent.com/a-botnet-accidentally-destroyed-i2p-the-full-story/

by Cider9986 • 5 months ago

157 76 5 months ago

gnabgib• 5 months ago

This seems to lack the full story, despite the headline.. Krebs' coverage is more in-depth (39 points) https://news.ycombinator.com/item?id=46976825

torben-friis3• 5 months ago

Man, I feel so out of depth with cybersecurity news.

Why does i2p (per the article) expect state sponsored attacks every February? Where are those forming from, what does the regularity achieve?

How come the operators of giant (I’m assuming illegal) botnets are available to voice their train of thought in discord?

OgsyedIE• 5 months ago

Many state bodies involved in adversarial action have dedicated budgets for offensive cyber-warfare, credential thefts, supply chain compromises and disinformation. If they haven't used all of their budget by the end of the budget period, they'll be allocated a smaller budget for the next budget period.

torben-friis3• 5 months ago

Oh ffs. Whenever I think my opinion on the state of the world can’t get any lower, things somehow manage to get dumber.

rollulus2• 5 months ago

Cool theory but that should result in other attacks that peak in February too, can you give examples?

WaitWaitWha• 5 months ago

Why does i2p (per the article) expect state sponsored attacks every February?

Because The Invisible Internet Project (I2P) allows government dissidents to communicate without the government oversight. Censorship-resistant, peer-to-peer communication

Where are those forming from, what does the regularity achieve?

At least PR China, Iran, Oman, Qatar, and Kuwait. censor communication between dissidents.

How come the operators of giant (I’m assuming illegal) botnets are available to voice their train of thought in discord?

How would you identify someone as 'operators of giant botnets' before they identified themselves as 'operators of giant botnets'?

please read https://en.wikipedia.org/wiki/I2P

Zambyte• 5 months ago

This answer is missing the key "regularity" part of their questions, which I would love to know more about.

margalabargala• 5 months ago

Sure, but why February and not the other 11 months?

jjmarr• 5 months ago

From the main article, I2P has 55,000 computers, the botnet tried to add 700,000 infected routers to I2P to use it as a backup command-and-control system.

https://news.ycombinator.com/item?id=46976825

This, predictably, broke I2P.

infogulch• 5 months ago

That's an interesting stress test for I2P. They should try to fix that, the protocol should be resilient to such an event. Even if there are 10x more bad nodes than good nodes (assuming they were noncompliant I2P actors based on that thread) the good nodes should still be able to find each other and continue working. To be fair spam will always be a thorny problem in completely decentralized protocols.

sandworm101• 5 months ago

No. They should not try to survive such attacks. The best defense to a temporary attack is often to pull the plug. Better than than potentially expose users. When there are 10x as many bad nodes as good, the base protection of any anonymity network is likely compromised. Shut down, survive, and return once the attacker has moved on.

01HNNWZ0MV43FF• 5 months ago

Finding good nodes is a thorny problem for human friendship, too!

embedding-shape• 5 months ago

Even if there are 10x more bad nodes than good nodes [...] the good nodes should still be able to find each other

What network, distributed or decentralized, can survive such an event? Most of the protocols break down once you hit some N% threshold of the network being bad nodes, asking it to survive 1000%+ bad nodes when others usually is something like "When at least half the nodes are good". Are there existing decentralized/distributed protocols that would survive a 1000% attack of bad nodes?

Dylan16807• 5 months ago

I guess "predictably" is valid but what actually went wrong? After going through multiple sources I can't tell if the botnet nodes were breaking the protocol on purpose, breaking the protocol on accident, or correct implementations that nevertheless overwhelmed something.

c45y• 5 months ago

As I understand they weren't building tunnels, so every time a legit client wanted to it has to wade through all the bad nodes to find a good one, so everything slowed right down. I was building at about 3% success rate during the issue which enables general eepsite browsing but torrenting was essentially dead

illusive4080• 5 months ago

Why does Discord allow a server for a botnet owner?

fragmede2• 5 months ago

botnet owners dying typically come forwards and say they are trying to run a botnet, so there may be some difficulty there.

fragmede2• 5 months ago

botnet owners don't typically come forwards and say they are trying to run a botnet, so there may be some difficulty in detecting them there.

ddtaylor• 5 months ago

Discord has a lot of terrible servers. This is one of the reasons they were not trusted when they came out and wanted to do identity verification. They already have a lot of information yet fail to do meaningful enforcement at scale.

Aurornis2• 5 months ago

Only a couple years ago the outrage was that Discord was too eagerly banning servers and users.

I know several people whose Discord accounts were banned because they participated in a server that later had some talk of illegal activities in one of the channels. There are similar stories all over Reddit.

chmod775• 5 months ago

There's servers where they just hang out, but which themselves are legitimate. Cybersecurity related ones etc. You can ban them and they'll just switch to another account within a minute. Occasionally discord or a server owner does, but everyone knows its pointless. There's probably other servers that are mostly used by cybercriminals, maybe command-and-control backups, and security researchers may stumble upon these when taking some malware apart, join them, and end up getting in contact with the owner.

In general I don't think law enforcement wants discord to take these down or ban them. These guys would have no problem to just make some IRC servers or whatever to hang out on instead, which would be much harder to surveil for law enforcement - compared to discord just forwarding them everything said by those accounts and on those servers.

xmcp1232• 5 months ago

Ever tried to ban a botnet owner from a service they want to use?

It’s basically impossible. They have money, IPs, identities, anything you could possibly want to evade.

Cider99862• 5 months ago

They are rich in regard to the tools needed to abuse services haha.

charcircuit2• 5 months ago

If you just look at the messages in those kinds of discords. It's blatant. They aren't even trying to hide it.

bee_rider• 5 months ago

It would be pretty funny if the age verification stuff blocked some of these folks.

bawolff• 5 months ago

I imagine because banning these things is both whack-a-mole and like finding a needle in a hay stack.

samus• 5 months ago

Why wouldn't they? There are Discord servers about anything you can imagine and also what you can't or don't want to image. As long as they don't start disrupting their infra Discord couldn't care less.

Also, how would you even go about classifying them as botnet operators?

Ekaros• 5 months ago

A MAU is a MAU... They likely use relatively little computing capability while making numbers look really good...

richardfey• 5 months ago

I wonder how cjdns would have handled this

hoppp• 5 months ago

Isn't I2P java? The botnet uses java? I thought python or C is preferred for that kinda stuff

mhitza• 5 months ago

The official router implementation is Java. i2pd is an alternative written in C++.

Once established communication can transparently be processed through a socks proxy, or integration with SAM or similar https://i2p.net/en/docs/api/samv3/

monero-xmr• 5 months ago

Computers are so fast it doesn’t matter

flipped4• 5 months ago

"Since the abstraction layers have quadrupled, let's not just care about the actual performance anymore!"

fuzzfactor2• 5 months ago

Not my downvote, but which computers would that be?

More people than just myself might want one.

rippeltippel• 5 months ago

Communication between bots use network protocols, it doesn't matter in which language those protocols are implemented.

Cider99862• 5 months ago

The video seems to be a bit more in-depth.

fuzzfactor2• 5 months ago

A bit of a tangent, but if I had a beard like that I would be making a lot more videos :)

cookiengineer• 5 months ago

This was one of the worst writeups I ever read. Even a LinkedIn Premium post would have had more technical details, lol

pmontra• 5 months ago

This seems to be a better post about what happened, from the same site https://www.sambent.com/i2p-2-11-0-ships-post-quantum-crypto...

nneonneo• 5 months ago

Those are some weird-ass visualizations. I can only assume they were AI-generated.

KennyBlanken• 5 months ago

I'll save everyone else a click: AI slop text coupled with the strangest, most pointless visualizations I've ever seen.

SV_BubbleTime• 5 months ago

Speak for yourself!

I didn’t really understand the link between Alice and Bob until I saw a green floaty dot go through a pile of spaghetti with the word compromise beneath it.

charcircuit2• 5 months ago

hostile nodes
they accidentally disrupted I2P while attempting to use the network as backup command-and-control infrastructure

So were they hostile or were they using it normally?

shevy-java• 5 months ago

The I2P development team responded by shipping version 2.11.0 just six days after the attack began.

Not wanting to be overly critical, but any net-infrastructure project kind of has to keep bot-attacks in mind and other attack vectors, in the initial design stage already. Any state-actor (and other actors, though I would assume it is often a state financing the bot network behind-the-scene) can become potentially hostile.

rollulus2• 5 months ago

This article (with high slop vibes) and another article on their site (linked in the comments) seem to suggest that post quantum encryption mitigated the Sybil attack, without explanation. I fail to understand how the two are even related.

singpolyma3• 5 months ago

Came here to say this. Seems like the attack was an accident and it ended. Nothing was mitigated

swordsith• 5 months ago

Definitely generated, testing a ML model I'm training. it flags as claude mostly.

Roark66• 5 months ago

Is there a shittier summary anywhere, please? Or did the author reached the peak of enshittification?

Honestly, did the bot implementation have bugs or was it a proper implementation that crashed the network due to sheer numbers?

Also, how does changing the encryption standard affect anything if the bots tried to integrate correctly with the network?

Is the problem "fixed" or is it not? Elsewhere I found large number if botnet devs got pissed off with this botnet operator and 600k nodes went offline. Might this have much more to do with the situation getting better than simply changing encryption?

Also, was there any suggestion a quantum breaking attack was attempted? No. So why put the emphasis on "post quantum" in this article?

Bad. Very bad.

superkuh• 5 months ago

The operators admitted on Discord they accidentally disrupted I2P while attempting to use the network as backup command-and-control infrastructure ...

This is crazy to me. Discord is letting literal criminals use it's corporate services in full view to commit crimes?

anthk2• 5 months ago

I upgraded my OBSD just fine over I2P. I don't use the Java client/server, that might the reason.

anthk2• 5 months ago

Also rewriting i2pd in Go would be the sanest step. From Java to Go is not a big challenge and you gain even more portability. Just look at Yggdrasil on how these people created meshnets running even under Android and cheap i386 netbooks.

Thus, something like this in Go should be the norm. The GC it's ideal for this, it comes with batteries charged for networking and it can be for sure be made compatible with stuff like NNCP like nothing.

It wouldn't run many times slower than i2pd in C++, it should be perfectly bearable.

A Botnet Accidentally Destroyed I2P

Related Stories