up vote 1 down vote favorite
share [g+] share [fb]

Is it possible to get a virus from a .torrent file?

I mean, I know .exe and other executable files can have viruses or can be malicious, but can the same be done using a .torrent file? Maybe writing some code in .torrent that causes its client software to work in unexpected ways. Just feeling paranoid ;)

link|improve this question
feedback

3 Answers

up vote 5 down vote accepted

Any data file, when loaded into a vulnerable application, can be a vector for an infection.

link|improve this answer
1  
So, thats a yes for .torrent files? A more specific answer? – paranoia Dec 2 '10 at 17:58
1  
True, but: is it likely? – Arjan Dec 2 '10 at 17:59
1  
It's a yes for any file. .torrent, .jpg, .html... any file. – Ignacio Vazquez-Abrams Dec 2 '10 at 17:59
3  
Yes anything is possible, but I have never read of this being done, and I read way to much on security vulnerabilities every day, have for 10 years. Yes you are Paranoid. Thanks for giving the bad guys another idea. I thought Ignacio was pretty specific regarding your question. – Moab Dec 2 '10 at 18:05
Thanks Moab, well I guess what I wanted to say (but didn't in the question) was that whether its common to get infected that way. So turns out its not, atleast not at the moment :) And you're welcome, I'm good with ideas :P – paranoia Dec 2 '10 at 18:59
feedback
up vote 2 down vote

Assuming that the application that handles your .torrent files is handling them correctly (i.e. check them for consistency, handle errors correctly, etc.) then the torrent file itself probably is not a thread for your machine. At least it's not the easiest way to infect your machine.

BUT: The torrent allows you to download other data that might be infected (and often is when you download software illegaly). So watch out what you are downloading.

link|improve this answer
feedback
up vote 0 down vote

The .torrent itself is not typically a threat (though as Ignacio points out the possibility at least exists). However, the software that processes torrent files use them to trigger a download of what it typically a much larger payload. The contents of this payload are unverified and my understanding of bittorrent traffic is that it would not be difficult for anyone participating in a bittorrent swarm to inject malicious code into that payload.

link|improve this answer
1  
Actually, it's extremely difficult. The file names, sizes, and order are fixed in the .torrent file, and each chunk of the torrented content itself is hashed. Getting just the right content at just the position while maintaining the hash is ludicrously hard. And if your change happens to cross a chunk boundary then you need to hope that both chunks come from clients with the change already. – Ignacio Vazquez-Abrams Dec 2 '10 at 18:14
@Joel, if your assumption was true, anti-p2p companies would just need to inject faulty data to corrupt the files being shared in a swarm. – Jakub Dec 2 '10 at 18:20
@Ignacio, why would the code that validates the fragments be less prone to attacks than the code that validates the .torrent file? – Arjan Dec 2 '10 at 18:29
@Jakub: They have been known to do that. What separates them from what Joel is saying is that the chunks are actually meaningless garbage instead of malicious code. – Ignacio Vazquez-Abrams Dec 2 '10 at 18:29
@Arjan: The fragments are fixed in size, which means that there's a lot less potential for overruns (but admittedly still not none). And the hash routines themselves are so old they're practically bulletproof. – Ignacio Vazquez-Abrams Dec 2 '10 at 18:33
show 2 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.