  Peer-to-peer networks are an attractive alternative to classical
client-server architectures in several fields of application such as
voice-over-IP telephony and file sharing. Recently, a new peer-to-peer solution
called the InterPlanetary File System (IPFS) has attracted attention, which
promises to re-decentralise the Web. Being increasingly used as a stand-alone
application, IPFS has also emerged as the technical backbone of various other
decentralised solutions and was even used to evade censorship. Decentralised
applications serving millions of users rely on IPFS as one of their crucial
building blocks. This popularity makes IPFS attractive for large-scale attacks.
We have identified a conceptual issue in one of IPFS's core libraries and
demonstrate their exploitation by means of a successful end-to-end attack. We
evaluated this attack against the IPFS reference implementation on the public
IPFS network, which is used by the average user to share and consume IPFS
content. Results obtained from mounting this attack on live IPFS nodes show
that arbitrary IPFS nodes can be eclipsed, i.e. isolated from the network, with
moderate effort and limited resources. Compared to similar works, we show that
our attack scales linearly even beyond current network sizes and can disrupt
the entire public IPFS network with alarmingly low effort. The vulnerability
set described in this paper has been assigned CVE-2020-10937. Responsible
disclosure procedures are currently being carried out and have led to
mitigations being deployed, with additional fixes to be rolled out in future
releases.
