Hot answers tagged

46

file piece ("chunk") hashing is actually an essential, core feature of BitTorrent (the downloaded pieces are immediately and automatically verified), and a part of the BT protocol - the .torrent file contains the hashes needed for verification. So, unless the .torrent file is altered by an attacker (which is a very different issue), the integrity of the ...


28

Blocking Bittorrent is challenging, and can't really be done effectively with port blocks. The standard ports are 6881-6889 TCP, but the protocol can be run on any port, and the peer-to-peer nature of the protocol means that discovering peers that use unblocked ports is simple. Blocking Bittorrent traffic could be done with a deep-packet-inspection or ...


25

BitTorrent uses a method called Chunking, in which files are divided into 64 KB – 2 MB pieces. Each piece is hashed and the hashes (along with the piece size) are stored in the torrent's metadata (the small .torrent file, or the metadata you receive via DHT). That, along with the info_hash, makes BitTorrent quite resistant to intentional tampering (poisoning)...


12

This is a bandage for a much larger issue... When I setup networks for small offices (50 clients or less) I'll use a business-class (entry-level) wired router such as a Fortinet Fortigate 40C or a Cisco RV042. You can block traffic based on: IP - Addresses and Ranges FQDN - Fully Qualified Domain Names Geography - You can block access to countries if you ...


11

Correct. As explained in that article the torrents use the BitTorrent protocol to share Sony's stolen data. Each piece that is downloaded via a seed is linked with an index into the file, and the hash of that portion is checked and verified. However, I don't believe its this hash that they are referring to in that article. Below I'll describe the process ...


11

You have a number of ways to restrict torrents: Blocking ports: this doesn't work, because p2p traffic can use pretty much any port (even ones below 1024) Deep inspection: looking at traffic and blocking based on type can help you a lot, however encrypted traffic all looks alike Destination filtering: this may also help a bit, but you'd have to maintain a ...


10

Don't waste time with complex technical measures: make clear to the employees what your policy is, then simply fire the next person who torrents a film.


9

Torrent poisoning means that peers join the swarm which don't contribute to it and only use up resources. One method is an evil peer which claims to be seeding the whole file. However, instead of returning valid data, it returns garbage. The clients won't notice this until they received the whole chunk and verified the checksum, which means that they wasted ...


7

The BitTorrent Sync Android and iOS apps seem to follow the BitTorrent.com privacy policy which states explicitly that they gather data such as total traffic and performance metrics. We also aggregate some data from the BitTorrent Client regarding total traffic flows and content delivery performance. I don't see any problem with that; it's completely ...


7

Without a backdoor installed on your machine, an attacker would not be able to know what software was installed. If 100% of your traffic passes though an encrypted VPN, then it is not possible for an ISP to know what data is being transmitted. However, protecting the transport layer with a VPN may not conceal the type of protocol used to transmit the data. ...


7

ISPs have never been involved in the process of determining whether or not specific traffic is related to a copyright violation. From a technical perspective the ISP is one of the worst places to implement such a monitoring system. (There is a huge amount of traffic flowing through an ISP, and a huge number of possible copyright violations. At best case ...


6

I've given a lot of thought to this area over the past couple of years, and the simplest answer to both of your questions is that a wholly peer-to-peer web would introduce new ways of handling those processes which would traditionally reside on a server. Peer-to-peer websites would most likely not be served with the data inline. Sort of like Meteor, you ...


5

If you use a public hosting service, that service could of course also keep track of what it's hosting and who uploaded and downloaded it. If the filehost is not a honeypot, if you use an unsecured or semisecured connection with a known protocol to transfer your files, the ISP could track whenever you initiate a file transfer. If the protocol works with an ...


5

First of all, there's nothing inherently dangerous or illegal (except perhaps in unusual jurisdictions) about using BitTorrent. There are plenty of free clients out there all that are well-respected and trustworthy. BitTorrent is frequently used to distribute large open-source projects, such as ISO files for Linux distributions. It's also used by companies ...


4

The growing popularity for Torrent proxies is for anonymity. You can encrypt traffic all you want, but it can always be traced back to the public facing node. The contents of your communication will remain private, however it can be identified that your IP address was in communication with a remote IP address. Without a proxy that will trace back to either ...


4

It depends on who "they" are. If you're torrenting, the university can use commercial traffic inspection tools to identify p2p protocols. The tools are signature based, and the signatures are proprietary, so the exact methods used and methods to circumvent them vary. If you're torrenting illegally distributed copyrighted content, then the rights holders ...


4

SHA-1 is 160 bits (or 40 hexadecimal characters), whereas MD5 is only 128 bits (or 32 hexadecimal characters). Using this file as an example, the Info Hash is: 353E1F88B06C7AFBEB0692E25CE75F05A9E44FB0 Which is 40 hexadecimal characters, so I assume it's SHA-1. Note that this value isn't the hash of the actual file you're trying to download, rather: ...


4

BitTorrent can run on any port, and can be wrapped inside SSL, so blocking by ports or traffic data isn't going to get you anywhere. My suggestion would be to block HTTP traffic on any port which matches the tracker announce protocol, as per the specification. This won't work if the tracker is running on HTTPS, but most don't. It also won't prevent DHT from ...


4

The best solution for this problem is education! This is due to the fact that there are other ways to download software and movies which are harder to block than torrents. On the other hand these mostly one click hoster based file sharing solutions are much harder to detect by the ISP and arent likely to bring you in that much legal trouble. The problem ...


3

Yes, a VPN would mask your HTTP requests as they would be routed through the tunnel. Unless your ISP is somehow exploiting a weakness in the VPN protocol and decrypting the traffic, they would not see the requests.


3

Freenet is the closest to what you mention as it acts as a fully P2P service sharing between nodes in approx. equal ammounts dependent on your settings. I2P doesn't have the same P2P infrastructure and works purely message-based but can still transfer similar amounts of data just not in the same egalitarian way you mention. You can find a quick comparison ...


3

As far as I know pfsense performs very simplistic traffic shaping where by it prioritizes traffic based on port range. This is just so that you can play games with someone else using BitTorrent on the network. This is just to be friendly, this is not for "security". Trying to filter all BitTorrent traffic at the gateway is very a difficult problem and a ...


3

Torrent clients offer encryption of traffic using RC4, and people consider this, like, very safe to hide traffic information from ISP. People are wrong to do so, but not because RC4 is even remotely the weak point. Simply knowing which IPs you're connecting to allows precise determination of the torrent you are downloading by an opponent who simply scrapes ...


3

It appears that this has been blocked by both FireFox and Google due to malicious programs being hosted on the website. This doesn't appear to be intentional distribution of the malware as identified in the below link. This warning might not be present in another browser, such as IE. However, these warnings are normally present for a reason and should ...


2

You could take a look at a recent technical paper, The Unbearable Lightness of Monitoring. The authors of that paper talk about how the BitTorrent protocol itself allows people to see what Internet Protocol addresses take part in the P2P downloading aspect of BitTorrent. They also say that they have a way to detect monitoring IP addresses, and say that ...


2

I would suggest that you use a free UTM such as the one from SOPHOS. it will sit at the place of your firewall and has all in one features for a small office and is free. It will give you the ability to block and monitor the website categories you want. Also, it can protect against malicious downloads.


2

The first thing I would take a look at is your firewall. Why is the common port used by torrents open for instance? Probably because your firewall has an implicit allow. You need to change this to an implicit deny and white list what you would like your users to do. For example you could say only this proxy server may connect out to the internet over ...


2

Short answer For the most part, yes, but there are some theoretical concerns. Long answer BitTorrent divides the file into "pieces". The torrent file contains a list with a SHA1 hash of each piece. Data that does not match the hash in the torrent file will be discarded, so each piece of the file you end up with will have the same SHA1 hash as the ...


2

When writing binary output data try instead using open('bomber.out', 'wb').write(data) I can't verify if this will help but it might be worth a try.


2

In addition to VPN, try also to use another DNS than your ISP's DNS too; to prevent DNS leak. There are many public ones including Google's public DNS.



Only top voted, non community-wiki answers of a minimum length are eligible