On the Privacy of Peer-Assisted Distribution of Security Patches

D. Wu, C. Tang, P. Dhungel, N. Saxena, K. W. Ross
2010 2010 IEEE Tenth International Conference on Peer-to-Peer Computing (P2P)  
When a host discovers that it has a software vulnerability that is susceptible to an attack, the host needs to obtain and install a patch. Because centralized distribution of patches may not scale well, peer-to-peer (P2P) approaches have recently been suggested. There is, however, a serious privacy problem with peer-assisted patch distribution: when a peer A requests a patch from another peer B, it announces to B its vulnerability, which B can exploit instead of providing the patch. Through
more » ... ytical modeling and simulation, we show that a large majority of vulnerable hosts will typically become compromised with a basic design for peer-assisted patch distribution. We then study the effectiveness of two different approaches in countering this privacy problem. The first approach utilizes special-purpose peer nodes, referred to as honeypots, that discover and blacklist malicious peers listening for patch requests from susceptible hosts. In the second approach, the patches are requested through an anonymizing network, hiding the identities of susceptible hosts from malicious peers. Using analytical models and simulation, we show that, honeypots do not completely solve the privacy problem; in contrast, an anonymizing network turns out to be more suitable for security patch distribution. • We develop a fluid model to bring insight to the aforementioned privacy problem in peer-assisted patch distribution. In particular, we show that typically a large majority of vulnerable hosts will become compromised with a basic design for peer-assisted patch distribution. • We study the effectiveness of two different approaches in countering the privacy problem. The first approach utilizes special-purpose peer nodes, referred to as honeypots, that discover and blacklist malicious peers listening for patch requests from susceptible hosts. In the second
doi:10.1109/p2p.2010.5569988 dblp:conf/p2p/WuTDSR10 fatcat:fi2wx2j5bfekrcsbr2cxmthkny