company:bittorrent inc

Torrent clients and BitTorrent Sync can be leveraged for DrDoS attacks

http://cdn.arstechnica.net/wp-content/uploads/2015/08/bittorrent-drdos-attack.png

▻https://www.usenix.org/conference/woot15/workshop-program/presentation/p2p-file-sharing-hell-exploiting-bittorrent

In this paper, we demonstrate that the BitTorrent protocol family is vulnerable to distributed reflective denial-of-service (DRDoS) attacks. Specifically, we show that an attacker can exploit BitTorrent protocols (Micro Transport Protocol (uTP), Distributed Hash Table (DHT), Message Stream Encryption (MSE))and BitTorrent Sync (BTSync) to reflect and amplify traffic from peers.

We validate the efficiency, robustness and evadability of the exposed BitTorrent vulnerabilities in a P2P lab testbed. We further substantiate the lab results by crawling more than 2.1 million IP addresses over Mainline DHT (MLDHT) and analyzing more than 10,000 BitTorrent handshakes. Our experiments reveal that an attacker is able to exploit BitTorrent peers to amplify the traffic up to a factor of 50 times and in case of BTSync up to 120 times.

Additionally, we observe that the most popular BitTorrent clients are the most vulnerable ones. (uTorrent, Mainline Vuze)

[...]

We showed that anattack is quite difficult to circumvent, as the found vulnerabilities can only be defended with a DPI firewall. In case of a MSE handshake, it is even harder to detect the attack, since the packet contains a high entropy payload with a public key and random data.

The paper:

▻https://www.usenix.org/system/files/conference/woot15/woot15-paper-adamsky.pdf

▻https://torrentfreak.com/bittorrent-can-be-exploited-for-dos-attacks-research-warns

BitTorrent Inc has been notified about the vulnerabilities and patched some in a recent beta release. For now, however, uTorrent is still vulnerable to a DHT attack. Vuze was contacted as well but has yet to release an update according to the researcher.

Arstechnica also wrote about it:

▻http://arstechnica.com/security/2015/08/how-bittorrent-could-let-lone-ddos-attackers-bring-down-big-sites

En Français :

▻http://actualite.housseniawriting.com/technologie/2015/08/16/les-attaques-drdos-peuvent-se-propager-via-les-clients-bittorrent/7227

#DDoS #DrDoS

BitTorrentsync security & privacy analysis
▻http://2014.hackitoergosum.org/bittorrentsync-security-privacy-analysis-hackito-session-result

During last Hackito Session, a group of passionate tech gathered and during one evening dug whatever they could on BTsync. The goal of this Hackito Session was to analyze the security of BTsync.

Why? Because BitTorrent Sync growing popularity means more and more private data gets exposed, and as it is a closed source program, there’s a need for some verified and neutral information about its intrinsic security and also about the degree of privacy it provides.

[...]

TL;DR & Conclusions :

– Probable leak of all hashes to getsync.com and access for BitTorrent Inc to all shared data.
– Change of sharing paradigm that introduced this vulnerability happened after the first releases. This may be the result of NSL (National Security Letters, from US Government to businesses to pressure them in giving out the keys or introducing vulnerabilities to compromise previously secure systems) that could have been received by BitTorrent Inc and/or developers.
– Leak about the private network addresses of clients that gives indication about where and what to attack.
– Probable multiple vulnerabilities of the clients.
– Bottom line: Do not use for sensitive data.

#BitTorrent_Sync #BitTorrent,_Inc. #Open_source #Rétroingénierie #Sécurité_informatique

BitTorrent Bleep Alpha Goes Public, Introduces Mac and Android apps
▻http://blog.bittorrent.com/2014/09/17/bittorrent-bleep-alpha-goes-public-introduces-mac-and-android-apps

Private Voice Private Voice & Text App Opens Test Community to All Interested Parties

Communicating with friends, family and coworkers is easier than ever, but at what cost? The Internet promotes the free exchange of information, but we often sacrifice privacy for the sake of convenience. Cloud-based services store personal information and private moments on servers, making them vulnerable to attacks.

Here at BitTorrent, we’re working on a way to change that.

Bleep (aka BitTorrent Chat) est disponible en alpha pour tous (Windows, Mac OS et Android). BitTorrent est une technologie qui a fait ses preuves, donc c’est à tester, même si c’est quand même très problématique que ce soit pas open source...
De mon côté je cherche l’APK...

#BitTorrent_(protocole) #Bleep #Communication #Messagerie_instantanée #Open_source #Pair_à_pair #Peer-to-peer #Version_alpha #VoIP #Voix_sur_IP

Bittorrent Bundle, télécharger des packs d’artistes légalement en p2p
▻http://neosting.net/services-en-ligne/bundles-bittorrent-telecharger-des-packs-legalement-p2p-artistes.html

La société Bittorrent Inc., fondeé le 22 septembre 2004 par Bram Cohen et Ashwin Navin est connue pour avoir déployé le protocole du même nom plus vulgairement appelé P2P. Le logiciel µTorrent de la même société américaine permet d’utiliser ce protocole. Mais le P2P, à cause ... #bittorrent #bundle #p2p

Les téléchargements interrompus par la grève du plus gros tracker
►http://www.clubic.com/telecharger/logiciel-telechargement-p2p/bittorrent/actualite-501872-openbittorrent-greve-tracker-vs-bittorrent-inc.html

Les deux principaux trackers #BitTorrent au monde, OpenBitTorrent et PublicBitTorrent, sont en grève. Ils ne protestent non pas contre des ayants droit, comme on pourrait l’imaginer, mais contre la société BitTorrent, Inc.,

#geek_power