300k Chinese bots currently abusing Ubuntu's torrents (opens in new tab)

(torrent.ubuntu.com)

12 pointsfignews4y ago9 comments

9 comments

8 comments · 3 top-level

jepler4y ago· 2 in thread

After a short time serving one of those torrents, I have lots of connections from China, each pulling down about 130KiB/s. My outgoing bandwidth has been rising slowly, from only 400KiB/s when I started writing this comment to 3MiB/s now.

https://emergent.unpythonic.net/files/sandbox/Screenshot_202...

    % Information related to '117.188.0.0/14AS9808'

    route:          117.188.0.0/14
    descr:          China Mobile communications corporation

jepler4y ago

And 112.6 and 27.192, also in China, are connecting at a few MiB/s each client IP. However, its clients aren't serving up the "\0" client IDs and are connecting with encryption. https://emergent.unpythonic.net/files/sandbox/Screenshot_202...

fignewsOP4y ago

Those are legitimate peers. The bots are all unencrypted with the \0 client ID. You must also have your torrent port open for them to connect to you because they don’t have ports open. This fact is the only reason one is still able to download these torrents.

chillingeffect4y ago· 2 in thread

Are they xferring ubuntu? Or leveraging it somehow to move their own data?

fignewsOP4y ago

Downloading but remaining at 0% completed.

gjvc4y ago

connecting but not transferring, you mean?

1 more reply

1MachineElf4y ago· 1 in thread

It will likely require some scrolling down to see the bot-driven downloads visible around the middle of the web page.

On what basis is this being attributed to Chinese?

EDIT: When this comment was made, there were 4 torrents with ~300K leeches. At the time of this update, the leecher counts on each all went down to ~150K.

fignewsOP4y ago

I can’t vouch that all of them are Chinese but the vast majority of them are coming from Chinese IP addresses. They seem to be under C&C and come and go in massive quantities.

j / k navigate · click thread line to collapse