[BitTorrent] preventing unauthorized bittorrent peers?

Justin Cormack justin at street-vision.com
Mon Jan 24 17:33:06 EST 2005


> 
> 
> 
> There are ways of doing this but there isn't an implementation (which 
> I'm aware of). You could modify the client to support ssl ands certs as 
> you wish, but the peer connectivity would be more involved. You'd be 
> much better off encapsulating a security mechanism (eg, encrypt the 
> content) than to depend on bittorrent in this manner. Also, you're 
> 'educated guess' would have to be a bit more involved.

As you say "sensitive documents" I would encrypt them anyway. Note that you 
have to use a private key encryption system (ie everyone shares the same key)
or the document to be shared is not the same. This raises key management
issues.

Alternatively, without changing the protocol you could use IPsec everywhere,
which would allow connections from outside as well potentially, or tunnel
connections over ssh.
 
> BitTorrent is for distributing large files efficiently.
> 

Presumably these are large sensitive documents...

I actually cant think of many situations where this is an issue on an
internal network (unless it is partitioned between many sites, but even
then an rsynced local server is probably sufficient). However there are
situations when you might want to do this over the internet, where the
bandwidth issues are mroe important.

> 
> On Jan 24, 2005, at 10:19 AM, David Wilburn wrote:
> 
> >
> > I have a funny security question regarding the bittorrent protocol that
> > I hope you will answer.
> >
> > If an organization decided to internally share sensitive documents and
> > data via a private bittorrent tracker, would it be possible for an
> > outsider to download that file from peers even when they can't connect
> > to the tracker?
> >
> > Such a scenario might happen when you have a laptop user in the
> > workplace who downloads several sensitive documents, then goes home and
> > happens to have the bittorrent client up while connected to his home
> > ISP.  What's to stop a malicious person from taking an educated guess 
> > at
> > the IP address, client listening port, and file indexes, and then
> > connecting and downloading the files?  Is there any way to restrict
> > unwanted peers to prevent this, such as some sort of mutually
> > authenticating kerberos-like token given to each peer by the tracker?
> >
> > Thanks,
> > David Wilburn
> >
> >
> >
> >
> > Yahoo! Groups Links
> >
> >
> >
> >
> >
> >
> >
> 
> 
> 
>  
> Yahoo! Groups Links
> 
> 
> 
>  
> 
> 
> 



 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/BitTorrent/

<*> To unsubscribe from this group, send an email to:
    BitTorrent-unsubscribe at yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/
 





More information about the BitTorrent mailing list