256
South Korean telecom company attacks torrent users with malware
(www.tomshardware.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 27 Jun 2024
256 points (98.5% liked)
Technology
59081 readers
3563 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
I don't really understand the attack vector the ISP is using, unless it's exploiting some kind of flaw in higher-level software than BitTorrent itself.
A torrent should be identified uniquely by a hash in a magnet URL.
When a BitTorrent user obtains a hash, as long as it's from an https webpage, the ISP shouldn't be able to spoof the hash. You'd have to either get your own key added to a browser's keystore or have access to one of the trusted CA's keys for that.
Once you have the hash, you should be able to find and validate the Merkle hash tree from the DHT. Unless you've broken SHA and can generate collisions -- which an ISP isn't going to -- you shouldn't be able to feed a user a bogus hash tree from the DHT.
Once you have the hash tree, you shouldn't be able to feed a user any complete chunks that are bogus unless you've broken the hash function in BitTorrent's tree (which I think is also SHA). You can feed them up to one byte short of a chunk, try and sandbag a download, but once they get all the data, they should be able to reject a chunk that doesn't hash to the expected value in the tree.
I don't see how you can reasonably attack the BitTorrent protocol, ISP or no, to try and inject malware. Maybe some higher level protocol or software package.
I'd also add, on an unrelated note, that if the concern is bandwidth usage, which is what the article says, I don't see why the ISP doesn't just throttle users, based entirely on bandwidth usage. Like, sure, there are BitTorrent users that use colossal amounts of bandwidth, will cause problems for pricing based on overselling bandwidth, which is the norm for consumer broadband.
But you don't need to do some kind of expensive, risky, fragile, and probably liability-issue-inducing attack on BitTorrent if your concern is bandwidth usage. Just start throttling down bandwidth as usage rises, regardless of protocol. Nobody ever gets cut off, but if they're using way above their share of bandwidth, they're gonna have a slower connection. Hell, go offer to sell them a higher-bandwidth package. You don't lose money, nobody is installing malware, you don't have the problem come right back as soon as some new bandwidth-munching program shows up (YouTube?), etc.
Based on the numbers reported in the article, that's a significant chunk of their customers. The ISP was probably reluctant to upgrade their infra like they should have.