Content Censorship in the InterPlanetary File System

Content Censorship in the InterPlanetary File System

Speakers: Srivatsan Sridhar

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=UpHP_t9I9uQ

Overview

The InterPlanetary File System (IPFS) stands as the largest decentralized storage solution globally, underpinning thousands of participants and facilitating millions of daily content transfers. It serves as a foundational layer for numerous blockchain-based smart contracts, Non-Fungible Tokens (NFTs), and various decentralized applications, providing content-centric storage where data is identified by a Content Identifier (CID) derived from its hash. This design inherently supports content deduplication, data integrity, and efficient retrieval from the closest available location. However, this talk by Srivatsan Sridhar from NDSS Symposium 2024 reveals a critical vulnerability: a content censorship attack that can effectively prevent the retrieval of any chosen content within the IPFS network.

The core of the problem lies in a conceptual flaw within the Kademlia Distributed Hash Table (DHT), a fundamental component of IPFS responsible for resolving CIDs to peer addresses. Without successful resolution, downloaders cannot locate the data providers. The presented attack is remarkably efficient and low-cost, executable from a single, resource-constrained machine for as little as $4 using AWS, and can render provider records unavailable within seconds to 48 hours. Crucially, IPFS currently lacks built-in mechanisms to counter this threat, posing a significant risk to the availability and security of systems reliant on its storage capabilities, including collaborative file hosting, social networks, and decentralized applications.

Sridhar's work makes four key contributions: detailing the content censorship attack, introducing an efficient detection technique based on KL Divergence, proposing a robust mitigation mechanism using region-based DHT queries, and implementing and evaluating both the attack and countermeasures on the live IPFS network. The findings have broader implications, as the underlying libp2p DHT is also utilized by other prominent decentralized systems such as Ethereum, Celestia, and Polkadot. The vulnerability has been responsibly disclosed and assigned CVE-2023-26248.

Background

▶ Watch: Introduction to IPFS and content censorship problem (0:00)

To fully grasp the intricacies of the censorship attack and the proposed countermeasures, an understanding of IPFS's underlying architecture is essential. IPFS leverages a Kademlia-based Distributed Hash Table (DHT), specifically the libp2p implementation. In this DHT, each peer generates a unique 256-bit peer ID by hashing its public key, ideally resulting in a uniform distribution across the hash space. Each peer maintains a routing table organized into 256 buckets, with each bucket storing up to k=20 peer addresses whose peer IDs share a common prefix of a certain length with the peer's own ID.

When a new node joins the IPFS network, it contacts hardcoded bootstrap nodes to discover initial peers and then performs a DHT walk towards its own peer ID to further populate its routing table and establish connections. While Bitswap offers a flooding-based, unstructured search for popular content, it serves primarily as a lightweight cache and does not guarantee discovery for all data. Reliable content discovery is predominantly handled by the DHT-based resolution system.

The process of content provision and retrieval is as follows: A provider publishing content creates a provider record linking the content's CID to its network location. During a PROVIDE(cid) operation, the provider uses GETCLOSESTPEERS(cid) to identify the k=20 peers closest to the CID in the hash space. These k peers are designated as resolvers for that specific CID, and the provider sends them the provider record. By default, IPFS clients automatically become providers for downloaded content for a fixed duration, typically 48 hours, contributing to the network's auto-scaling capabilities.

When a downloader wishes to fetch content, it first queries its Bitswap peers. If the content is not found, it initiates a FINDPROVIDERS(cid) operation. This involves a DHT walk similar to GETCLOSESTPEERS(cid) but also queries all encountered nodes for provider records, not just the designated resolvers. The process concludes when 20 providers are found or all resolvers have been queried. Upon receiving a provider record, the downloader connects directly to the provider to retrieve the content, verifying its integrity against the CID.

A crucial aspect for the detection and mitigation strategies is the estimation of the network size, N. Decentralized systems inherently lack a central membership manager, making N unknown. The researchers employ a mechanism developed by Protocol Labs that estimates N by sampling m random keys and querying the DHT for the k=20 closest peer IDs to each key. The average distance to these closest peers is then used in a least squares regression to compute N. This estimate, denoted as N_hat, is refreshed periodically (every 10 minutes) and is robust against attacker bias unless the attacker controls a number of Sybil nodes on the order of the entire network size.

While similar DHT vulnerabilities have been discussed in academic literature, many proposed prevention mechanisms are often impractical for modern decentralized systems due to unrealistic assumptions or high overhead. This work builds upon existing knowledge but provides a practical, incrementally deployable solution specifically tailored for IPFS and other libp2p DHT-based systems like Ethereum, Celestia, Polkadot, I2P, and Dat.

Key Findings

▶ Watch: CVE assignment and broader impact on libp2p DHT (1:50)

The primary finding of this research is the discovery and detailed characterization of a highly effective and low-cost content censorship attack targeting the InterPlanetary File System. This attack, which leverages Sybil identities to manipulate the libp2p Kademlia DHT, can prevent the discovery and retrieval of any chosen content within the IPFS network.

Specifically, the key findings include:

• Existence of a Critical Vulnerability: A conceptual issue within the Kademlia DHT allows attackers to strategically position malicious Sybil nodes closer to a target CID than honest peers, thereby intercepting and dropping provider records. This renders content undiscoverable.
• Low Cost and High Efficiency: The attack can be executed from a single, resource-constrained machine, incurring costs as low as $4 using AWS. It can achieve full censorship within a timeframe ranging from seconds (with foreknowledge of the CID) to up to 48 hours (when records already exist on honest peers).
• Lack of Native Countermeasures: IPFS currently lacks any built-in mechanisms to detect or mitigate this specific content censorship attack, leaving it vulnerable to widespread content unavailability.
• Broader Implications: The vulnerability is not confined to IPFS alone. Since the attack exploits a flaw in the libp2p DHT, other prominent decentralized systems that rely on this same DHT implementation, such as Ethereum, Celestia, and Polkadot, are also susceptible to similar censorship threats.
• Responsible Disclosure and CVE Assignment: The vulnerability has been responsibly disclosed to Protocol Labs, the maintainers of IPFS and libp2p, and has been assigned CVE-2023-26248.
• Robust Detection Mechanism: A novel detection technique, adapting a method by Cholez et al., effectively identifies the attack by analyzing the distribution of Common Prefix Lengths (CPLs) of peer IDs using KL Divergence. It achieves a 99.6% detection rate with a 4.4% false positive rate, dynamically adjusting to network size fluctuations.
• Effective and Compatible Mitigation: A practical mitigation strategy based on region-based DHT queries ensures reliable discovery of provider records even under attack. This solution is fully compatible with unmodified IPFS clients, can be incrementally deployed, and is scheduled for integration into future libp2p DHT versions. It achieves 100% mitigation effectiveness.
• Live Network Validation: Both the attack and the proposed countermeasures were implemented and rigorously evaluated on the live IPFS network, targeting self-created content to ensure ethical conduct. This real-world validation confirms the attack's feasibility and the mitigation's efficacy.

These findings highlight a significant security gap in a foundational decentralized storage system and offer a clear path forward for enhancing the resilience of IPFS and other libp2p DHT-based networks.

Technical Deep Dive

▶ Watch: Technical background of IPFS Kademlia DHT (2:00)

The content censorship attack in IPFS exploits a fundamental reliance on the k=20 closest peers to a CID for provider record resolution within the Kademlia Distributed Hash Table (DHT). The researchers detail a sophisticated Sybil attack methodology and propose a statistical detection mechanism followed by a novel mitigation strategy.

Threat Model

The assumed threat model involves a network of N DHT nodes. While multiple nodes might share an IP address, each node possesses a unique peer ID. The attacker is capable of spawning multiple virtual nodes (Sybil identities) from a single physical machine, coordinating their actions, and refusing to store valid provider records or distributing false ones for a target CID. Critically, the attacker operates these Sybil nodes using regular IPFS operations, not by exploiting OS or component bugs, but by leveraging flaws in P2P system protocols. It is assumed that no honest node is fully eclipsed by malicious ones, meaning every honest node maintains at least one honest peer and can reach any key and discover other honest peers via DHT routing. The attacker's primary goal is to prevent downloaders from obtaining provider records for a target CID, leading to content censorship, which is measured by a_eff, the ratio of unsuccessful FINDPROVIDERS(cid) queries.

CID Censorship Attack Process

The attack targets the k=20 resolvers responsible for storing provider records for a specific CID. The attacker's strategy is to inject e Sybil identities, where e is greater than or equal to k, into the network such that these Sybils are closer to the target CID in the hash space than any honest peer. This ensures that both provider records and resolution queries are directed exclusively to the Sybil nodes.

1. Identify Target Resolvers: The attacker first uses the IPFS API to retrieve the current k=20 closest peer IDs to the target CID and identifies the closest honest peer among them.
2. Generate Sybil Identities: The attacker then repeatedly generates random public/private key pairs and computes their corresponding peer IDs. If a generated peer ID is closer to the target CID than the currently closest honest peer, the key pair is kept; otherwise, it's discarded. This brute-force process continues until e such Sybil peer IDs are obtained. The researchers found EdDSA key generation to be significantly faster than RSA for this purpose.
3. Spawn Sybil Nodes: For each generated Sybil peer ID, the attacker spawns a custom libp2p DHT node. These Sybil nodes are programmed to drop any received provider records specifically for the target CID and respond with empty messages to resolution queries for that CID. For all other CIDs, they behave normally to avoid suspicion and detection.
4. Maintain Control: The attacker continuously monitors the set of e closest peers to the target CID. If a new honest node appears in this set (e.g., due to network churn or new honest nodes joining closer), the attacker generates and spawns additional Sybil identities to maintain the desired number of malicious resolvers.

Attack Analysis: The attack involves initial costs for key generation (C_gen) and ongoing operational costs (C_oper). While theoretically e=k=20 Sybils should suffice, empirical observations on the live network showed that DHT lookups are not perfectly accurate, often returning an inconsistent set of k closest peers. Thus, e=45 Sybil identities were required to achieve a 99% attack success probability (a_eff). The warmup time (t_w) for the attack depends on whether Sybils are launched before content provision (immediate effect, t_w=0) or after (attack becomes fully effective after provider records on honest peers expire, typically 48 hours). The total cost (C_att) is C_gen + (t_w + t_eff) * C_oper.

Censorship Attack Detection

Reliable detection is paramount to activate mitigation only when necessary, minimizing overhead. The core idea for detection stems from the observation that an attacker must place e Sybil peers whose IDs are closer to the target CID than any honest peer. Consequently, when an honest node queries the DHT for the target CID, the k=20 closest peer IDs it finds will exhibit an anomalous distribution of Common Prefix Lengths (CPLs).

The detection method repurposes a statistical technique by Cholez et al., adapted for IPFS:

1. Obtain the k=20 closest peer IDs to the target CID via a DHT query.
2. Compute the CPL of each of these peer IDs with the target CID.
3. Compare the empirical distribution of these 20 CPLs (q(x)) with a 'model' probability distribution (p(x)). This model represents the expected CPL distribution if all peers were honest and uniformly distributed. Under normal conditions, CPLs should follow a geometric distribution (probability 0.5^(x+1) for CPL x), adjusted for querying only the k closest.
4. Quantify the mismatch between q(x) and p(x) using the Kullback-Liebler (KL) divergence (also known as a G-test). A large KL divergence indicates an attack, while a small value suggests no attack.

A key challenge is that the model distribution p(x) requires knowing the total number of peers in the DHT, N. The researchers adapt the method by using their network size estimator (N_hat) to dynamically compute p(x) based on the current network size estimate. This makes the detection mechanism robust to network size changes. The detection method requires no additional communication and minimal local computation. A detection threshold (thr) is empirically chosen (0.94) to prioritize minimizing false negatives (undetected attacks) over false positives.

Mitigation with Region-Based Queries

Countering Sybil attacks in open, decentralized systems is notoriously difficult. Traditional solutions often introduce prohibitive overhead or centralize control. Simply increasing k is ineffective, as attackers can generate more Sybils. The fundamental problem is the inability to definitively classify resolvers as honest or malicious.

The core idea for mitigation is that while an attacker can introduce new Sybil identities, they cannot remove existing honest nodes from the network. Therefore, if a provider can still send its records to the initial honest resolvers, and a downloader can communicate with these resolvers, the censorship attack can be mitigated.

To maintain communication with these honest resolvers even during an attack, the researchers propose region-based DHT queries. Instead of communicating with the k=20 closest peers to a CID (which are easily controlled by an attacker), this approach communicates with all nodes within a specific hash space region. This region is defined such that it is expected to contain approximately k=20 uniformly distributed honest peer IDs. The size of this region is calculated using the network size estimate (N_hat) and the assumption of uniform distribution of honest peer IDs. This ensures that, regardless of the number of Sybil nodes, both providers and downloaders can reliably interact with a sufficient number of honest resolvers. To avoid unnecessary overhead, these region-based queries are only activated when the detection mechanism flags an attack.

The algorithm, FINDBYCPL(key, minCPL), is built using existing GETCLOSESTPEERS(key) RPCs from go-libp2p-kad-dht for compatibility. It iteratively calls GETCLOSESTPEERS on sub-regions of the hash space by flipping bits of the key until all peers within the desired region (defined by minCPL, set to log2(N_hat/k)) have been found. This method increases the number of DHT lookups sub-linearly with the number of Sybil identities, contrasting with the attacker's cost which increases linearly. The correctness of this algorithm is formally proven (Theorem 1), ensuring it finds all relevant peer IDs within the specified region.

Demo / Proof of Concept

▶ Watch: Content discovery process and network size estimation (3:00)

The researchers meticulously implemented and evaluated both the content censorship attack and their proposed detection and mitigation mechanisms on the live IPFS network, demonstrating their practical feasibility and effectiveness.

Implementation Details

The censorship attack was implemented using a custom IPFS DHT server node built on the libp2p library. Similarly, the detection and mitigation methods were also implemented on top of the libp2p DHT library. A key design principle was to ensure full compatibility with unmodified IPFS clients. This means that countermeasures can be incrementally deployed; nodes that have not yet upgraded will remain vulnerable but can still seamlessly interoperate with upgraded nodes. These countermeasures are scheduled for deployment in future versions of the libp2p DHT. For transparency and reproducibility, the entire artifact, including the attack, detection, and mitigation implementations, along with experiment scripts, is publicly available via Zenodo and GitHub.

Evaluation Setup

Experiments were conducted on the live IPFS network. To adhere to ethical guidelines and prevent harm to other users, all attacks exclusively targeted content that the researchers themselves created. Protocol Labs, the creators and maintainers of IPFS and libp2p, were informed through a responsible disclosure process. The experimental setup utilized a single AWS t3.xlarge instance (equipped with 4 vCPUs, 16 GiB memory, and 5 Gbps peak bandwidth) to host three types of DHT nodes:

1. Malicious Sybil nodes: Custom libp2p DHT client implementations designed to censor.
2. Provider node: An honest node hosting the self-created content.
3. Downloader node: An honest node attempting to resolve and fetch the target CID.

To avoid waiting for the typical 48-hour warmup time (t_w) for attack effectiveness, Sybil nodes were generally launched before the provider advertised the content in most experiments.

DHT Lookup Accuracy

A significant preliminary finding from the evaluation was the observed inconsistency in GETCLOSESTPEERS(key) operations on the live IPFS network. Ideally, this function should return the k=20 truly closest peer IDs. However, experiments showed that the returned set of peers was not always consistent across different nodes or even multiple calls from the same node. This practical limitation implied that attackers needed to deploy more than 20 Sybil identities to achieve a high attack effectiveness.

Evaluation Results - Attack, Detection, Mitigation

Attack Evaluation

• Sybil Count vs. Effectiveness (Figure 7): While e=20 Sybils are theoretically sufficient, e=45 Sybil identities were empirically required to achieve a 99% attack success probability (a_eff) due to DHT lookup inconsistencies.
• Warmup Time (t_w) (Figure 8): When content was provided before Sybil nodes were launched, the attack was immediate. If Sybils were launched after content provision, effectiveness started at ~30% and reached full effect after 48 hours, the default expiration time for provider records on honest resolvers.
• Cost of Attack (Figure 9): Operational cost (C_oper) for running Sybil nodes on AWS t3.xlarge instances was $0.16 per hour. Key generation cost (C_gen) for EdDSA keys (for a network of 30,000 nodes) was less than $0.0005 and took under 12 seconds. The total cost (C_att) for attacking a single CID, considering t_w = 48h, was approximately **$7.68 + t_eff * $0.16**, demonstrating the attack's minimal cost.

Detection Evaluation

• False Positive/Negative Rates (Figure 10): A detection threshold (thr = 0.94) was chosen, yielding a 4.4% false positive rate and a 0.81% false negative rate. This threshold prioritizes minimizing undetected attacks (false negatives).
• KL Divergence vs. Sybils (Figure 11): The KL divergence metric clearly distinguished between no-attack and attack scenarios. With e=0 Sybils, 4.4% were falsely detected. With e=15 Sybils, 93.6% of attacks were detected, rising to 99.6% with e=45 Sybils.
• Robustness to Network Size (Figure 12): The detection mechanism proved robust across varying network sizes (10K to 25K nodes) because the N_hat estimator dynamically adjusted the model distribution, allowing a fixed detection threshold to remain effective.

Mitigation Evaluation

• Mitigation Effectiveness (Figure 13): Without mitigation, the percentage of downloaders successfully discovering content plummeted to a mere 0.44% with e=45 Sybils. With the proposed mitigation activated, the content discovery success rate increased to 100% across all evaluated Sybil counts (20, 30, 40, 45).
• Peers Contacted and Updated (Figure 14): Region-based queries increased the number of contacted peers with more Sybils. Crucially, the number of non-Sybil peers in the intersection of contacted and updated peers consistently oscillated around 30, exceeding the expected 20 due to slight underestimation of network size, ensuring successful mitigation even if some honest nodes are offline.
• Mitigation Overhead (Figure 15): The number of DHT lookups involved in region-based queries increased up to 9 times higher than for an un-attacked network. However, this overhead increased sub-linearly with the number of Sybils and was only incurred when an attack was detected, minimizing its impact during normal operation.
• Latency (Table II): While mitigation introduced some latency (e.g., FINDPROVIDERS took 28930 ms with mitigation vs. 27756 ms for default in no-attack), it was not significantly higher than the default mode, especially considering the attack rendered default FINDPROVIDERS unsuccessful. Subsequent queries were also faster.

Defensive Implications

▶ Watch: Detailed threat model for the CID censorship attack (4:20)

The discovery and detailed analysis of the content censorship attack (CVE-2023-26248) in IPFS carry significant defensive implications for anyone relying on decentralized storage. Proactive measures are essential to safeguard content availability and integrity.

1. Prioritize Software Updates: The most immediate and crucial defensive action for IPFS users and developers is to prioritize updating their libp2p DHT client implementations as soon as the proposed detection and mitigation mechanisms are officially deployed in future versions. Given the attack's low cost and high effectiveness, delaying updates could expose critical applications to censorship.
2. Awareness for dApp and NFT Developers: Developers building decentralized applications, NFTs, and other Web3.0 solutions that store data on IPFS must be acutely aware of this vulnerability. The assumption of perpetual content availability and immutability, while generally true for the content itself, does not extend to its discoverability in the face of a DHT-level attack.
3. Monitor for Anomalies: While the proposed detection mechanism will be integrated into the libp2p DHT, network operators and large IPFS users might consider implementing their own monitoring for unusual patterns. This could include tracking the success rate of FINDPROVIDERS queries for critical CIDs or observing unexpected distributions of Common Prefix Lengths (CPLs) for resolved peers.
4. Content Redundancy and Multi-CID Strategies: For extremely critical or high-value content, consider strategies that introduce redundancy beyond a single CID. This could involve storing content under multiple distinct CIDs, potentially on different IPFS deployments or even alternative decentralized storage solutions, to create fallback options in case of a localized censorship event.
5. Evaluate Other libp2p DHT Systems: Developers and users of other decentralized systems that leverage the libp2p DHT, such as Ethereum, Celestia, and Polkadot, should actively evaluate their exposure to similar censorship attacks. The generic nature of the DHT flaw suggests that analogous vulnerabilities might exist, necessitating the integration of similar detection and mitigation strategies.
6. Advocate for Core DHT Enhancements: While the proposed mitigation offers incremental deployment, the researchers acknowledge limitations such as the lack of an admission mechanism for provider records or the potential for fake provider records. Defenders should advocate for and support future research and development into more robust, core DHT changes, including admission control based on traffic diversity and improved filtering of malicious records, to enhance long-term resilience.
7. Geographic and Network Diversity for Providers: For content providers, increasing the geographic and network diversity of their IPFS nodes can make it more challenging for an attacker to effectively eclipse all k=20 closest resolvers. While not a direct countermeasure to the Sybil attack itself, it can increase the cost and complexity for an attacker to maintain full control.

By adopting these defensive postures, the decentralized ecosystem can better protect itself against sophisticated censorship attempts and ensure the continued availability and reliability of content stored on IPFS and other libp2p DHT-based networks.

Key Takeaways

• IPFS, the largest decentralized storage solution, is vulnerable to a low-cost and efficient content censorship attack (CVE-2023-26248) that prevents content discovery.
• The attack exploits a conceptual flaw in the Kademlia Distributed Hash Table (DHT), allowing attackers to position Sybil identities to control the k=20 closest resolvers for a target CID.
• A single, resource-constrained machine can execute the attack for as little as $4 using AWS, achieving 99% effectiveness with e=45 Sybil nodes, rendering content undiscoverable within seconds to 48 hours.
• A robust detection mechanism utilizes KL Divergence to analyze the distribution of Common Prefix Lengths (CPLs) of peer IDs, achieving a 99.6% detection rate with a 4.4% false positive rate, dynamically adapting to network size.
• The proposed mitigation employs region-based DHT queries, activated only upon attack detection, to reliably find honest resolvers. This method achieves 100% mitigation effectiveness, is compatible with unmodified IPFS clients, and is scheduled for libp2p DHT integration.
• The underlying DHT vulnerability and its practical solution have significant implications for other libp2p DHT-based systems, including Ethereum, Celestia, and Polkadot, highlighting a need for broader adoption of similar security measures.

About the Speaker(s)

Srivatsan Sridhar is a researcher in the field of decentralized systems and network security. His work, as presented at the NDSS Symposium, focuses on identifying and addressing critical vulnerabilities in foundational decentralized technologies like the InterPlanetary File System (IPFS) and its underlying libp2p Distributed Hash Table (DHT). His contributions include detailing sophisticated attack vectors, developing robust detection mechanisms, and proposing practical, incrementally deployable mitigation strategies to enhance the security and resilience of these crucial decentralized networks.