BitTorrent Can Be Exploited for DoS Attacks, Research Warns

With dozens of millions of active users at any given point in the day the BitTorrent protocol is a force to be reckoned with.

While BitTorrent swarms are relatively harmless, a new paper published by City University London researcher Florian Adamsky reveals that there’s potential for abuse.

The paper, titled ‘P2P File-Sharing in Hell: Exploiting BitTorrent Vulnerabilities to Launch Distributed Reflective DoS Attacks’, shows that various BitTorrent protocols can be used to amplify Denial of Service attacks.

Through various experiments Adamsky has confirmed that the vulnerability affects the uTP, DHT, Message Stream Encryption and BitTorrent Sync protocols.

The attacks are most effective through the BitTorrent Sync application where the original bandwidth can be increased by a factor of 120.

For traditional torrent clients such as uTorrent and Vuze the impact is also significant, boosting attacks by 39 and 54 times respectively.

Speaking with TF, Adamsky states that it’s relatively easy to carry out a distributed reflective Denial of Service (DRDoS) attack via BitTorrent. The attacker only needs a valid info-hash, or the “secret” in case of BitTorrent Sync.

“This attack should not be so hard to run, since an attacker can collect millions of possible amplifiers by using trackers, DHT or PEX,” he explains.

“With a single BitTorrent Sync ping message, an attacker can amplify the traffic up to 120 times.”

BitTorrent Inc has been notified about the vulnerabilities and patched some in a recent beta release. For now, however, uTorrent is still vulnerable to a DHT attack. Vuze was contacted as well but has yet to release an update according to the researcher.

For users of BitTorrent-based software there is no security concern other than the fact that people are participating in a DDoS attack without their knowledge. The vulnerability mostly leads to a lot of wasted bandwidth.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.