57

While downloading a file via a torrent, what will happen if some of the peers send me fake chunks?

Also, can any of the peers send me a whole fake file? For example, if I download a .torrent file which should download a file with hash sum A, and a peer sends me a file with hash sum B, will the torrent client notice that and block it?

  • 1
    The idea that this is possible was a part of Ross Ulbricht's defence in the silk road trial. They argued that material was planted on his computer while he was torrenting the Colbert Report - motherboard.vice.com/en_us/article/78xdva/… – JMK Aug 14 '17 at 12:04
  • 1
    I think it's worth noting that there were organizations that were believed to be polluting trackers by intentionally sharing bad chunks. The idea wasn't to get you to download a malicious file, but simply to make torrenting unpleasant and slow. – Jesse K Aug 14 '17 at 17:20
  • 8
    Most practical attacks will aim at the .torrent file in the first place. It's so much easier to make the user download a torrent distrubuting malware and such, than corrupting a clean torrent by finding SHA1 collisions. – Dmitry Grigoryev Aug 15 '17 at 12:59
71

Yes, a client will notice and block.

A torrent is divided into pieces, a piece is divided into chunks.
Every piece has its SHA1 hash included in the .torrents metadata.

If a peer send fake or corrupted chunks this will be detected when the whole piece has been received and the hash check fails.
A peer that repeatedly sends bad data will be blocked, but there is some leeway because corruption may naturally occur sometimes in a data transfer.
A good client has heuristics to find out exactly what peer(s) sent bad data by comparing the chunks sent in the piece that failed the hash check, with the chunks in the same piece when it has been re-downloaded and passed the hash check.

  • 7
    A torrent is built on TCP (or uTP), right? Why would corruption naturally occur in a data transfer? – Oddthinking Aug 14 '17 at 5:12
  • 6
    May want to note that SHA-1 is kinda broken and explain collision vs second preimage etc. – Kevin Aug 14 '17 at 5:17
  • 11
    @Oddthinking I simplify a bit in my answer to keep it short. Things that can cause corruption; TCP/UDP weak checksums, client bugs, bad disk, bad memory and bad drivers. – Encombe Aug 14 '17 at 7:14
  • 4
    Unless the SHA1 is broken: shattered.io – Jakuje Aug 14 '17 at 7:25
  • 25
    @TwoThe: The attacker needs more than a SHA1 collision, he needs a second pre-image to attack a specific torrent. SHA-1 is still quite strong against that (although with so many chunks to choose from its almost like a collision scenario). However, protocols should switch to a better hash function as soon as practical, and no new work should use SHA1. – James K Polk Aug 14 '17 at 14:36
12

Adding onto Encombe's answer as to the likely-hood of a fake, "forgery" happening: It's overwhelming unlikely that such a situation could or would occur, though it is possible.

SHA-1 is an older method for file hashing and isn't recommended for new use, but it's arguably fine as it is now.

Scenario 1: A mistake occurs: If another user sends you a bad piece or chunk (perhaps a one-in-a-million error occurs and the data is corrupted in transit), the hashes will not match and the chunk will be rejected. It's almost impossibly unlikely that a chunk would just happen to have the same hash after being corrupted.

Scenario 2: A malicious user attempts to send you a fake file: Assuming that our attacker(s) knows what they're doing, it would still be very unlikely. Imagine the difficulty of even computing a fake file that has the same SHA1 hash - and the hashes of your fake file's chunks would need to match the hashes of the original file's chunks. I'd argue the amount of time it'd take to author such a file would render it almost impossible, even if you used a weaker hashing method such as MD5 out of the sheer difficulty of making so many conflicting and overlapping hashes.

You're much more likely to be at risk of someone putting up a "trap" torrent online that's designed to contain a virus or malicious content, but that would have been created by attackers and seeded by them as well (plus anyone who fell for the trap).

Having SHA-256 or greater hashes would be great, but the odds of such an attack ever succeeding are astronomically low.

  • 1
    1) DOS attacks are unrelated - that's the difference between someone sending you a forged letter in the mail and sending you 100,000 letters in the mail. 2) The reason it's so hard is because generating even a single SHA-1 collision takes a ton of time. The .torrent describes how large the file is, what the SHA-1 hash is, and other metadata. Imagine, in order to create a colliding file, you'd need to create one of the exact same length and have the same SHA-1 hash as the original. Now imagine that the forged file's chunks now each have to match the original's? It's basically impossible. – Jeremy Kato Aug 15 '17 at 18:50
  • 1
    That's not even to mention that such an engineered file, at best, would probably be harmless junk data. Creating a file that collides with the original, meets the other matching requirements, and still has a virus in it would be absurdly hard. Attackers could never dream up something so complicated actually working. – Jeremy Kato Aug 15 '17 at 18:51
  • 1
    That's true, but after sending too many incorrect chunks the other peers will block you. And this would only slow down the torrent's spread; it wouldn't allow you to spread a completely different file. – Jeremy Kato Aug 15 '17 at 20:00
  • 1
    Because when you put the file back together, the entire file's hash will mismatch and your torrent program will realize it needs to manually verify the contents. And again, all any of this does is slow down some people's torrents, so it's not only unlikely that someone would have the computational ability to do this, but it's unlikely because they would have essentially no motivation to do this. – Jeremy Kato Aug 16 '17 at 13:21
  • 1
    You want to talk practical? Your article claims the cost to make a single collision happen is $110,000. The attack took over 9 quintillion SHA-1 hashes of the file. You've made all these points to show that you can spend hundreds of thousands or millions of dollars to inconvenience one chunk of someone's torrent. It's theoretically possible but right now you'd be better off pointing a microwave at someone's computer and hoping you cause corrupting interference. – Jeremy Kato Aug 16 '17 at 16:20
1

Torrents rely heavily on the SHA-1 hash function: torrents are split into equally sized pieces and each piece's SHA-1 hash is kept in the info section of the torrent, which itself is identified and hence protected by its SHA-1 hash.

SHA-1 is showing signs of weakening. For example, early this year, an attack was published that allows a large organisation like a state actor or corporation, or a wealthy individual, to produce two different blocks of data with the same SHA-1 hash. This is not quite the same thing as finding a collision for an existing block of data though, and mainly for this reason the attack could only be practically used against the hashes of the pieces for now and even then it wouldn't be possible to take over an third-party torrent, you'd have to produce your own. For now. It could be that a full collision attack isn't far off. Every year the chance that someone secretly has a full attack of SHA-1 increases.

To leverage the current attack, a torrent could be produced that serves benevolent content to most people, getting flagged as ‘trusted’ on torrent indexing sites, but a targeted individual might be tricked into downloading a malicious piece of data, like a virus.

The authors of the attack also published a way to harden SHA-1 though. The idea is to detect likely SHA-1 collisions and modify them in such a way that the different blocks of data get a different hash again. Technically this hardened SHA-1 is different from SHA-1, but since as far as we know no full attack of SHA-1 exists yet, for now non-malicious files will in all likelihood have the same hardened and regular SHA-1 hash so software relying on SHA-1 will keep working and only malicious files will have different hashes. But this fix will only help if software uses it and so far the most popular software library for torrenting hasn't fixed its implementation.

Currently, work is being done on a second version of the BitTorrent specification, which will use the more secure SHA-256 hash function. This version is currently in its drafting stage though and has been for a decade. Until it's done and version 1 gets deprecated, this doesn't help anyone.

It's hard to overemphasize how weak SHA-1 is getting. And the published attacks against SHA-1 don't tell the whole story. Despite years of intensive study of SHA-1's predecessor, an attack against it completely unknown to the public did surface in the wild. So the answer is probably YES.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy