The InterPlanetary File System (IPFS) is currently the largest decentralized
storage solution in operation, with thousands of active participants and
millions of daily content transfers. IPFS is used as remote data storage for
numerous blockchain-based smart contracts, Non-Fungible Tokens (NFT), and
decentralized applications.
We present a content censorship attack that can be executed with minimal
effort and cost, and that prevents the retrieval of any chosen content in the
IPFS network. The attack exploits a conceptual issue in a core component of
IPFS, the Kademlia Distributed Hash Table (DHT), which is used to resolve
content IDs to peer addresses. We provide efficient detection and mitigation
mechanisms for this vulnerability. Our mechanisms achieve a 99.6\% detection
rate and mitigate 100\% of the detected attacks with minimal signaling and
computational overhead. We followed responsible disclosure procedures, and our
countermeasures are scheduled for deployment in the future versions of IPFS.Comment: 15 pages (including references), 15 figures. Accepted to be published
at the Network and Distributed System Security (NDSS) Symposium 202