Resurrecting a dead torrent tracker and finding 3 million peers
Resurrecting a dead torrent tracker and finding 3 million peers
So I was uh, downloading some linux isos, like usual. It was going slowly, so I opened up the Trackers tab in qBittorrent and saw the following:
Are there any known cases, where operators of trackers got convicted? Talking about trackers only, not the possibility to download the torrent file
Piratebay springs to mind. Having trouble finding sources for other outcomes. Oink admins got tried and got off, what.CD staff managed to dissapear into the ether.
What if a bad actor acquires one of these once popular tracker domains? Could they somehow take advantage of it? For example, what if they make the tracker advertise a large number of "fake" peers that serve malware instead of the actual files? I only have a crude understanding of how BitTorrent works, so I’m not sure what kinds of protections, if any, it has against this type of attack.
The torrent's id is, among other things, the hash of its contents so it's impossible to serve different data
BitTorrent breaks your data in blocks, each block is hashed, their sizes are known. Assuming you got your
.torrentfile from a legitimate source, it's practically impossible to receive something else, as long as your client does all the checks properly.In theory, it is possible to write malware that will collide hashes with some other content, but considering you are restricted to the size of the actual content, it's extremely unlikely that out of all the millions of
.torrents we created so far we can find even one for which it is possible.And even if you win this absolutely bizzare lottery, you'll be competing with legitimate peers for serving the blocks. If at least one block that you care about is not served by you, the recepient will just get corrupted content that won't be dangerous in any way. In other words, you need to have so much bandwidth, that you serve everything before anyone else can serve even one significant block. At which point you will probably have to spend a lot more money on that than you'll ever get from whatever malware you are trying to serve.
MPAA and other rights holders would be able to get list of ips for lawsuits en masse.
the most I think you could do would be log IPs for malicious or litigious purposes, I don’t think you could really do anything like malware injection in this case.