NRDAX-T0050 - DHT Sybil Content Censorship

mechanism

CVE-2023-26248 / GHSA-mqr9-hjr8-2m9w: Content Censorship in IPFS via Kademlia DHT abuse. The libp2p Kademlia DHT (go-libp2p-kad-dht (Go; as shipped in go-ipfs/kubo), affected go-libp2p-kad-dht <= 0.20.0 / go-ipfs (kubo) <= 0.18.1) stores/serves a CID's provider record at the peers whose peer IDs have the smallest XOR distance to the CID, with no defence against an attacker manufacturing peer IDs in that neighbourhood. An attacker grinds many Sybil peer IDs closer to a target CID than any honest peer and joins them to the DHT, so the Sybils become the k-closest set for that CID: honest ADD_PROVIDER records land on the Sybils (dropped) and honest GET_PROVIDERS lookups converge on the Sybils, which return no honest provider (only more Sybil CLOSER_PEERS). A small number of strategically placed Sybils makes any content undiscoverable network-wide. Unauthenticated - any peer. Impact: content censorship (NDSS 2024 / arXiv:2307.12212). Protocol Labs deployed detection+mitigation in a later libp2p DHT release.

instances (1)

references

cite

https://nrdax.com/techniques/NRDAX-T0050

@misc{nrdax_NRDAX_T0050,
  title = {DHT Sybil Content Censorship (NRDAX-T0050)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0050},
}

{
  "id": "nrdax-NRDAX-T0050",
  "type": "dataset",
  "title": "DHT Sybil Content Censorship (NRDAX-T0050)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0050",
  "publisher": "NRDAX Registry"
}

[![NRDAX-T0050 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0050.svg)](https://nrdax.com/techniques/NRDAX-T0050-dht-sybil-content-censorship)