Warning for ArchCD seeders: strange traffic from Kaia Global Networks

mpan · 2013-12-20 13:55:59

Since at least 2013/12/16 morning I'm observing strange torrent traffic from hosts located in subnets belonging to Kaia Global Networks:

79.141.160.0/24
79.141.162.0/24
79.141.173.0/24

The traffic consists of massive downloads of Arch CD, and also Ubuntu LTS CDs (desktop and alternate). While I could believe this is just a coincidence, the problem is that:

At least one of the hosts is confirmed to make a full download of the same file more than once, and others seem to do the same.
All hosts have identical configuration (same services, exactly the same client version, unconfigured nginx server...)

I'm warning other Arch seeders, because they may be unaware that such traffic is using up their bandwidth. If others will confirm the traffic, I'll also notify Ubuntu seeders.

Kaia Global Networks has been notified, but they neither responded nor resolved the problem in the past 24 hours.

Last edited by mpan (2013-12-20 14:04:52)

/dev/zero · 2013-12-20 14:28:31

Thank you.

phanisvara · 2013-12-20 15:01:54

wondering about the possible motive behind such an attack, what would they try to achieve? just wasting everybody's bandwidth? or is this perhaps some automated pirate-catching system, proving that you're distributing something, and then they're going to send you some legal humbug?

vacant · 2013-12-20 15:14:59

Could be someone stress-testing their own systems. Not very considerate to do that for any length of time if that is the case.

mpan · 2013-12-20 15:24:53

I don't think it's an attack. I don't see motives too. Hating Linux is not good enough reason to spend money on such thing .

During a talk with a friend we have came up with an idea that possibly someone is testing their own equipment on expense of others bandwidth. This is the only plausible explaination I can find for now. There were few others (students downloadnig Linux during a course, someone wanting to mirror images, misconfigured equipment), but they have flaws.

I would wait for reports/confirmations from other seeders, before jumping into conclusions. It's unlikely, but possible that it's just a very strange coincidence that just happened to me.

-- edit --
95.141.28.0/24
Only 2 hosts from this range in past 24 hours. One of them has downloaded Arch three times.

Is anyone else experiencing the issue?

-- edit --
79.141.161.0/24

Last edited by mpan (2013-12-24 09:27:56)

commx · 2014-01-10 16:18:20

mpan wrote:

I don't think it's an attack. I don't see motives too. Hating Linux is not good enough reason to spend money on such thing .
During a talk with a friend we have came up with an idea that possibly someone is testing their own equipment on expense of others bandwidth. This is the only plausible explaination I can find for now. There were few others (students downloadnig Linux during a course, someone wanting to mirror images, misconfigured equipment), but they have flaws.
I would wait for reports/confirmations from other seeders, before jumping into conclusions. It's unlikely, but possible that it's just a very strange coincidence that just happened to me.
-- edit --
95.141.28.0/24
Only 2 hosts from this range in past 24 hours. One of them has downloaded Arch three times.
Is anyone else experiencing the issue?
-- edit --
79.141.161.0/24

From which (exact) IP addresses are the connections coming from? I'll take a look into this then.

mpan · 2014-01-10 16:39:45

None of the addresses I catched between 20th and 24th december, before subnet blocking them, are active anymore. Also no new subnets were observed since then.

commx · 2014-01-10 16:43:45

Ok, fine. We're usually receiving loads of abuse mails regarding anonymization services we're providing colocation for and its beyond our control what customers actually do with their services.

mpan · 2014-01-13 05:21:29

Hit me hard, please! I was checking them while I had all the ranges blocked in iptables...

27 addresses downloading from me when I was sending this post:
79.141.160.71-77
79.141.162.31-43
79.141.173.141-147

Last edited by mpan (2014-01-13 05:25:35)

Dävu · 2014-02-12 00:31:54

I'm seeding a linux mint torrent, and I would like to know as well what these guys are trying to accomplish...

http://i.imgur.com/RmiHE4o.png

A few minutes later... (notice peer 79.141.162.33, 79.141.162.34, 79.141.162.38)

http://i.imgur.com/BvVjULj.png

-- mod edit: read the Forum Etiquette and only post thumbnails http://wiki.archlinux.org/index.php/For … s_and_Code [jwr] --

progandy · 2014-02-12 00:59:39

Maybe they are just filling unused bandwidth for fun?

Last edited by progandy (2014-02-12 01:07:57)

mpan · 2014-02-12 03:52:03

After I have blocked KGN subranges the traffic dropped by about 90-95% (23GB montly upload for january Arch release vs >250GB over-half-month upload for december release). This means that their actions are increasing load by 10-20x.

Since KGN refuses to cease activities (an e-mail sent to me 2014/01/13) and they're clearly disrupting the service, maybe Arch and Ubuntu (and possibly other affected distros, if any) should consider blocking the operator on tracker?

Can someone start the topic on Ubuntu's forums too? I don't want to create account just to send a single notification.

WonderWoofy · 2014-02-12 04:01:24

Maybe you should send an email to [arch-general] or post something on the bugtracker. It is just unlikely that the right eyes will see this request to block this IP range from the tracker.

mpan · 2014-02-12 06:45:53

I wasn't requesting anything yet - just asking other users. This is an issue that hits multiple distros.

But maybe you're right. I've posted it as bug#38881. However the issue remains open for other distributions.

Dävu · 2014-02-12 08:21:15

The "primary threats" blocklist from iblocklist.com seems to cover these ips:
https://www.iblocklist.com/list.php?lis … twayqovmxn

mpan · 2014-02-12 08:33:13

Bluetack's level 1, which is what I use, does not. At least wasn't before I've blocked them. Also one can't assume that Linux seeders use anti-anti-p2p blocklists.

frepa · 2014-02-12 13:15:47

I am currently seeing this activity on a Debian torrent as well (debian-live-7.2-amd64-gnome-desktop.iso). It has been going on for a couple of weeks, and wasted all bandwidth I gave this torrent.
The "primary threats" blocklist from the earlier post did not block it for me. I instead created a custom blocklist for Transmission (my bitTorrent client), which was very simple.

Arch Linux

#1 2013-12-20 13:55:59

Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#2 2013-12-20 14:28:31

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#3 2013-12-20 15:01:54

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#4 2013-12-20 15:14:59

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#5 2013-12-20 15:24:53

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#6 2014-01-10 16:18:20

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#7 2014-01-10 16:39:45

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#8 2014-01-10 16:43:45

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#9 2014-01-13 05:21:29

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#10 2014-02-12 00:31:54

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#11 2014-02-12 00:59:39

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#12 2014-02-12 03:52:03

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#13 2014-02-12 04:01:24

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#14 2014-02-12 06:45:53

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#15 2014-02-12 08:21:15

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#16 2014-02-12 08:33:13

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

#17 2014-02-12 13:15:47

Re: Warning for ArchCD seeders: strange traffic from Kaia Global Networks

Board footer