It seems like it would be trivial to make a modified client that distributes malware instead of the actual file that was supposed to be sent. How does BitTorrent defend against this?


In bittorent, the data being transfered is broken up into 'pieces'. The size is variable, and adjustable by the torrrent creator. Each 'piece' in the torrent contains a SHA1 hash of the data contained inside. When a torrent client downloads a 'piece', it checks the SHA1 hash to see if there is any corruption or tampering. Any SHA1 hash mismatches cause the torrent client to dump the piece. Some clients/interfaces (RuTorrent comes to mind) show stats of how much data has been 'wasted' - which is the amount of data contained in pieces that the torrent client has found to contain SHA1 hash mismatches.

As a result, it is quite hard to seed a torrent that has malicious files. You would have to do SHA1 hash collisions, and modify things around so that each piece, and the checksum of the metadata of the torrent checks out after replacing the non-malicious pieces with malicious pieces.

Side Note: At the moment, SHA1 has been deemed to be weakened (see http://threatpost.com/microsoft-warns-customers-away-from-sha-1-and-rc4/102902) to a point where Google (Chrome) and some other companies are beginning to move onto other algorithms.

  • 1
    Let alone the fact no single person will give you the entire thing. So even if you did "corrupted with malicious" it with something malicious the entire thing would actually be corrupted and not be anything – Ramhound Dec 11 '14 at 1:49
  • 2
    Also, this will not help if the original file seeded is malicious. – Ganesh R. Dec 11 '14 at 2:01
  • unless you wanted a malicious file. – Sirex Dec 11 '14 at 2:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.