Friday, 19 January 2018

Hackers Can Use BitTorrent To Control Your Computer

BitTorrent boasts of 170 million monthly users and is responsible for as much as 40% of the Internet's daily traffic. BitTorrent is rather infamous for facilitating the illegal activity of piracy despite being developed for legal purposes. It is the most common mode for peer-to-peer file sharing which means the contents of the files aren't verified and may contain malicious softwares.

Google's Project Zero, a vulnerability reporting team has found flaws in the widely used Transmission BitTorrent application. As reported by Travis Ormandy, a researcher in Google's Project Zero, there seems to be a fatal vulnerability which may allow hackers to control the computer's of BitTorrent users. 

Image result for bittorrent

Ormandy said hackers can use a common hacking technique called Domain Name System Rebinding to lead victims to malicious sites after which their computer can be remotely controlled using the Transmission BitTorrent app. 

As per his exploit, attackers can take control of users’ systems by creating a DNS name they are authorized to communicate with and then making it resolve to the localhost name of the vulnerable computer. In a separate post while publishing the patch for the same, Ormandy stated the attack takes place in the following manner:
1.   A user visits http://attacker.com, which has an <iframe> to a subdomain the attacker controls.
2. The attacker configures their DNS server to respond alternately with 127.0.0.1and 123.123.123.123 (an address they control) with a very low TTL.
3.   When the browser resolves to 123.123.123.123, they serve HTML that waits for the DNS entry to expire (or force it to expire by flooding the cache with lookups), then they have permission to read and set headers.
Using the above methods, hackers will then use BitTorrent to download a ".bashrc" file which will give them the ability to gain full control of your computer..
Project Zero generally refrains from reporting a security flaw to the public within 90 days of finding it but has chosen to reveal it this time in just 40 days due to a lack of response from Transmisson.
What are your  thoughts on this article? If you want us to cover something, let us know in the comments section below. Goodbye for now!

Post a comment

Whatsapp Button works on Mobile Device only

Start typing and press Enter to search