Hot answers tagged

28

Blocking Bittorrent is challenging, and can't really be done effectively with port blocks. The standard ports are 6881-6889 TCP, but the protocol can be run on any port, and the peer-to-peer nature of the protocol means that discovering peers that use unblocked ports is simple. Blocking Bittorrent traffic could be done with a deep-packet-inspection or ...


17

It does not take much effort to block P2P etc with current routers and restrict access as this detailed article from 2011 (Lifehacker) shows. But unless you restrict access a lot and thus make users unhappy they will still be able to upload copyrighted content to youtube, make bomb threats etc. If you don't want to deal with these liability issues (which ...


14

One tool for trying to enforce DRM is watermarking, i.e. embedding within the media itself a mark which is (almost) invisible to the human viewer, but which is resilient to copies (i.e. the copy has it). Once media copies are individually marked with the identity of their rightful owner, you can trace the origin of fraudulent copies. Do not get it wrong: it ...


13

Convenience: Offering good codecs NOT Preventing DVD players from fast forwarding through FBI warnings and 15 minutes of marketing Easy distribution: kindle, itunes, etc Allowing fair use: CSS (DMCA), moving between devices, no region locks, etc Reasonable pricing for electronic goods If there is more value in buying the good then downloading from ...


12

This is a bandage for a much larger issue... When I setup networks for small offices (50 clients or less) I'll use a business-class (entry-level) wired router such as a Fortinet Fortigate 40C or a Cisco RV042. You can block traffic based on: IP - Addresses and Ranges FQDN - Fully Qualified Domain Names Geography - You can block access to countries if you ...


11

Correct. As explained in that article the torrents use the BitTorrent protocol to share Sony's stolen data. Each piece that is downloaded via a seed is linked with an index into the file, and the hash of that portion is checked and verified. However, I don't believe its this hash that they are referring to in that article. Below I'll describe the process ...


10

Don't waste time with complex technical measures: make clear to the employees what your policy is, then simply fire the next person who torrents a film.


8

For signing only, a 512-bit RSA key ought to resist at least a few days, more probably a few weeks, even against determined attackers. This is still "reasonable" as long as you verify the signature "soon". You can imagine that from the point the public key was made public, you have a few minutes, at best hours of security, after which you must consider the ...


7

ISPs have never been involved in the process of determining whether or not specific traffic is related to a copyright violation. From a technical perspective the ISP is one of the worst places to implement such a monitoring system. (There is a huge amount of traffic flowing through an ISP, and a huge number of possible copyright violations. At best case ...


7

Without a backdoor installed on your machine, an attacker would not be able to know what software was installed. If 100% of your traffic passes though an encrypted VPN, then it is not possible for an ISP to know what data is being transmitted. However, protecting the transport layer with a VPN may not conceal the type of protocol used to transmit the data. ...


6

You've got most of the likely approaches mentioned in your question but here's a couple of points on them. Usage. This is the easiest way to start blocking traffic, and what the a lot of ISPs seem to go with most. Have a "fair use" policy which is based on bandwidth and then start taking action against users to go significantly over it. Unfortunately in ...


5

The Digital Rights Management (DRM) question has been around for a while. The simple answer is: No - anything which one individual has can be shared Have a read of this question, and the others tagged drm for some discussion. Most of the protection that is put in place fails, on many levels: Identifying files through checksums or signatures - these can ...


5

If you use a public hosting service, that service could of course also keep track of what it's hosting and who uploaded and downloaded it. If the filehost is not a honeypot, if you use an unsecured or semisecured connection with a known protocol to transfer your files, the ISP could track whenever you initiate a file transfer. If the protocol works with an ...


4

The growing popularity for Torrent proxies is for anonymity. You can encrypt traffic all you want, but it can always be traced back to the public facing node. The contents of your communication will remain private, however it can be identified that your IP address was in communication with a remote IP address. Without a proxy that will trace back to either ...


4

Real-life certificates have a neat concept called revocation. It is a way to propagate (in a secure way) the information that a given certificate, though apparently legit and kosher and with all the correct signatures, should not be trusted anymore. That's a kind of "oops" functionality. In X.509, this uses Certificate Revocation Lists and OCSP. The ...


4

You know what is really the cheapest and simplest solution ? Buy a VPN plan , and route all the company traffic (or the guest WiFi traffic) to the VPN. Never more care if your users are watching porn or downloading torrent or buying drugs or whatever , you won't be the responsible for it. Let the VPN company take care of that I think this solution is really ...


3

Time isn't that important. The question is how much money that attacker is willing to spend. From what I heard, breaking RSA 512 currently costs 75-150$ and 30 hours using cloud computing. We have a very similar question on crypto.SE: Is 512-bit RSA still safe for signature generation? But have you considered using elliptic curve crypto? For example the ...


3

I assume that they would do this by sniffing packets, but doesn't this all go down the drain if packets are encrypted? I'm trying to think of how they can detect this kind of activity if packets are encrypted. I suppose that when the encryption key is sent over a BitTorrent client, the ISP could intercept the key and then see everything. Would ...


3

As far as I know pfsense performs very simplistic traffic shaping where by it prioritizes traffic based on port range. This is just so that you can play games with someone else using BitTorrent on the network. This is just to be friendly, this is not for "security". Trying to filter all BitTorrent traffic at the gateway is very a difficult problem and a ...


3

If the P2P software isn't explicitly designed for privacy you should assume that it does not provide any privacy. Some of the data that you are likely to leak when using P2P software might be: IP address Any personal files you accidentally share Any data you provide to the P2P software (e.g. username) Any data wilfully provided by the P2P software (e.g. ...


3

Many P2P software will create hashes of each piece to prevent a malicious entity from modifying the pieces in-flight. When your P2P client gets a piece, it verifies it's hash. This will prevent one malicious entity modifying a piece of a valid file, but it won't help you if the file itself (qwerty.mp3) is malicious. If the file itself is malicious, a simple ...


3

I'll assume you're talking about BitTorrent, rather than Gnutella or other P2P protocols. There's no standard port for BitTorrent traffic, so you're going to have to do some digging. First, BitTorrent talks to a set of trackers. This communication is done over HTTP, and will have (at least) the following headers: info_hash - a URL-encoded hash of the ...


3

It looks like communication between 2 hosts on a LAN, hardly a P2P. In fact, it looks like a port/service scan by a "security" tool hitting all the popular TCP ports.


3

In practice, unless each mobile contributes bandwidth and storage space to the P2P network, a P2P network will involve computers other than the mobile applications of your use case. And thus susceptible to a security topology beyond your control. If the network is pure P2P (no central servers other than peer discovery bootstrap) and it is restricted to the ...


3

The information you asked for is given here on their official site. I am copy/pasting a small relevant excerpt below. BitTorrent Sync was designed with privacy and security in mind. The system uses SRP for mutual authentication and for generating session keys that ensure Perfect Forward Secrecy. All traffic between devices is encrypted with ...


3

The information provided from Bittorrent is pretty lame. Since it is not open source i don't use it. But the Free Software Foundation is working on it


3

You are right encryption is mandatory for all WebRTC communications. All the communications are encrypted using Datagram Transport layer Security (DTLS), which is a derivative of SSL. DTLS is build in to all browsers that support WebRTC. In short the the keys for the peer-to-peer SSL connection are generated by the peers and exchanged over the signalling ...


3

You could read something like Infosec Institute's Botnets Unearthed – The ZEUS BOT, but it boils down to: It's not a peer to peer setup, it's a client/server setup. Malware clients try to contact command and control servers which are not behind firewalls that prevent access. You see a list of command and control nodes (or, better, make sure your own ...


3

The answer is dependent on what "signalling server" you refer to. WebRTC is MITM-secure against untrusted relayservers, STUN and TURN servers. Those servers only help the clients to set up a p2p connection at all. However, the channel through which SDP is done needs to be trusted. Unlike the relayserver, SDP carries no weight, and consists only of some ...


3

Per this superuser answer, you can try to block access to web sites that index the torrents. This isn't quite what you asked for but may help. That answer explains: One way to do this in an indirect way is by using OpenDNS. Set the DNS server in your router settings to the OpenDNS servers (208.67.222.222 and 208.67.220.220) Create an account on ...



Only top voted, non community-wiki answers of a minimum length are eligible