[BitTorrent] preventing unauthorized bittorrent peers?

Bill Cox bill at viasic.com
Mon Jan 24 15:47:56 EST 2005


On Mon, 2005-01-24 at 17:19 +0100, David Wilburn wrote:
> I have a funny security question regarding the bittorrent protocol that 
> I hope you will answer.
> 
> If an organization decided to internally share sensitive documents and 
> data via a private bittorrent tracker, would it be possible for an 
> outsider to download that file from peers even when they can't connect 
> to the tracker?

In theory, no they could not download from outside.  However, you have
to be careful.  Some bittorrent clients (like Azureus) automatically
contact the outside world, looking for updates.  Bugs in such systems
might make your site vulnerable.  However, I feel pretty safe running
Azureus at my company.  If I were guarding information of extreme value,
I probably would not run it.  I also probably wouldn't want the
documents going out the door un-encrypted on a laptop.

> Such a scenario might happen when you have a laptop user in the 
> workplace who downloads several sensitive documents, then goes home and 
> happens to have the bittorrent client up while connected to his home 
> ISP.  What's to stop a malicious person from taking an educated guess at 
> the IP address, client listening port, and file indexes, and then 
> connecting and downloading the files?  Is there any way to restrict 
> unwanted peers to prevent this, such as some sort of mutually 
> authenticating kerberos-like token given to each peer by the tracker?

This is not very likely in my opinion.  To download files, you have to
tell the peer the SHA1 info-hash for the torrent.  In other words, you
have to already know the signature for the file you want to download.
So, first the attacker would need access to the .torrent file.  If he
had that, it's probably already too late to keep him out.

Of course, some hacker out there will probably prove me wrong...

Here's what I do:  All sensitive documents on laptops are saved only on
encfs encrypted file systems (http://freshmeat.net/projects/encfs/).
We've had good luck with it.  I think there are similar options under
windows.  If you're not already doing something like this, then I'd
guess that running bittorrent on laptops wouldn't be the biggest risk
you're taking.  I also try to make sure laptops are behind firewalls at
home (either software on the laptop or a linksys router, etc).

Bill




 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/BitTorrent/

<*> To unsubscribe from this group, send an email to:
    BitTorrent-unsubscribe at yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/
 





More information about the BitTorrent mailing list