You didn’t listen when we told you there’s malware in torrents, so we put malware in torrents
South Korean telecom company attacks torrent users with malware
Submitted 4 months ago by schizoidman@lemmy.ml to technology@lemmy.world
Comments
sukhmel@programming.dev 4 months ago
tal@lemmy.today 4 months ago
I don’t really understand the attack vector the ISP is using, unless it’s exploiting some kind of flaw in higher-level software than BitTorrent itself.
A torrent should be identified uniquely by a hash in a magnet URL.
When a BitTorrent user obtains a hash, as long as it’s from an https webpage, the ISP shouldn’t be able to spoof the hash. You’d have to either get your own key added to a browser’s keystore or have access to one of the trusted CA’s keys for that.
Once you have the hash, you should be able to find and validate the Merkle hash tree from the DHT. Unless you’ve broken SHA and can generate collisions – which an ISP isn’t going to – you shouldn’t be able to feed a user a bogus hash tree from the DHT.
Once you have the hash tree, you shouldn’t be able to feed a user any complete chunks that are bogus unless you’ve broken the hash function in BitTorrent’s tree (which I think is also SHA). You can feed them up to one byte short of a chunk, try and sandbag a download, but once they get all the data, they should be able to reject a chunk that doesn’t hash to the expected value in the tree.
I don’t see how you can reasonably attack the BitTorrent protocol, ISP or no, to try and inject malware. Maybe some higher level protocol or software package.
LainTrain@lemmy.dbzer0.com 4 months ago
I think it’s much simpler than that.
Webhard is Web Hard Drives - SK torrenting scene is very different from the west, to simplify basically everyone uses seedboxes or “web hard drives” in SK to download stuff.
While I can’t seem to find out anything about what “The Grid system” is, if the whole thing is an online portal or software. If ISP routers are anything like the west that means they control the DNS servers and the ones on router cannot be changed, and likely it blocks 1.1.1.1 and 8.8.8.8 and so on, as Virgin Media does in the UK for example, which definitely opens up a massive attack vector for an ISP to spin up its own website with a verified cert
tal@lemmy.today 4 months ago
If ISP routers are anything like the west that means they control the DNS servers and the ones on router cannot be changed, and likely it blocks 1.1.1.1 and 8.8.8.8 and so on, as Virgin Media does (along with blocking secure DNS) in the UK for example, which definitely opens up a massive attack vector for an ISP to spin up its own website with a verified cert and malware and have the DNS resolve to that when users try to access it to either download the software needed to access this Grid System or if it’s a web portal - the portal itself.
Browser page integrity – if you’re using https – doesn’t rely on DNS responses.
If I go to “foobar.com”, there has to be a valid cert for “foobar.com”. My ISP can’t get a valid cert for foobar.com unless it has a way to insert its own CA into my browser’s list of trusted CAs (which is what some business IT departments do so that they cans snoop on traffic, but an ISP probably won’t be able to do, since they don’t have access to your computer) or has access to a trusted CA’s key, as per above.
frankgrimeszz@lemmy.world 4 months ago
Some software check for updates without requiring the packages to be signed. The ISP could do a HTTP redirect to a fake torrent client update. The program says “Update available”. It downloads a malicious version.
Other ISPs have been caught injecting adverts into their traffic. So there’s ways.
tal@lemmy.today 4 months ago
I’d also add, on an unrelated note, that if the concern is bandwidth usage, I don’t see why the ISP doesn’t just throttle users, based entirely on bandwidth usage. Like, sure, there are BitTorrent users that use colossal amounts of bandwidth, will cause problems for pricing based on overselling bandwidth, which is the norm for consumer broadband.
But you don’t need to do some kind of expensive, risky, fragile, and probably liability-issue-inducing attack on BitTorrent if your concern is bandwidth usage. Just start throttling down bandwidth as usage rises, regardless of protocol. Nobody ever gets cut off, but if they’re using way above their share of bandwidth, they’re gonna have a slower connection. Hell, go offer to sell them a higher-bandwidth package. You don’t lose money, nobody is installing malware, you don’t have the problem come right back as soon as some new bandwidth-munching program shows up (YouTube?), etc.
awesome_lowlander@lemmy.dbzer0.com 4 months ago
if they’re using way above their share of bandwidth
Based on the numbers reported in the article, that’s a significant chunk of their customers. The ISP was probably reluctant to upgrade their infra like they should have.
Lojcs@lemm.ee 4 months ago
Do torrent clients actually check the hash? I’ve had borked downloads that qbittorrent showed as complete but had to be redownloaded upon a recheck before.
sem@lemmy.blahaj.zone 4 months ago
At the end of the article, the courts side with KT?? Because how dare the isp customers use the bandwidth they bought?
chemicalwonka@discuss.tchncs.de 4 months ago
My dedicated machine just to torrenting using OpenBSD and two proxies
ik5pvx@lemmy.world 4 months ago
Of course it’s KT.
Holzkohlen@feddit.de 4 months ago
SKT would never.
ik5pvx@lemmy.world 4 months ago
Do you mean SKB (or skbb, never figured out how they want to be abbreviated)?
FlavoredButtHair@lemmy.world 4 months ago
Sharing is caring. Can’t we just get along.
Holzkohlen@feddit.de 4 months ago
So that’s why they are last place and why SKT is just better.
Australis13@fedia.io 4 months ago
Well, I guess that's one ISP everyone will want to avoid...
OsrsNeedsF2P@lemmy.ml 4 months ago
Well, there’s only 3, and they’re all friends, sooo
Cikos@lemmy.world 4 months ago
starlink officially comes to my country a few month back. Since then almost all of the local isp stock has dropped and now they are giving mass discount and increased bandwidth.