The Anti-virus Times

Wednesday, March 14, 2018

Today we are going to talk about the BitTorrent protocol, which is widely used to download illegal (and often malicious) content.

To understand where and how malicious programs can emerge in torrent file sharing, let's recall how it works.

The BitTorrent protocol is used to organise peer-to-peer file-sharing networks. And it is assumed that the shared files are stored on various computers whose owners choose to share their files over a network.

If a user wishes to share a file or files (i.e., grant other users access to their file(s)), they make a corresponding announcement via a special server — a BitTorrent tracker — and upload a small file with the .torrent extension to the server. The file contains information about the shared content. After that, other users can download the content.

A torrent is a plain text file, and, therefore, it cannot contain any malicious payload. This means that downloading a torrent file is perfectly safe.

A user wishing to download something obtains a configuration file with the .torrent extension from a tracker, opens the file in their torrent client, and downloads the content from the distributing user to their PC. At the same time, the content being downloaded becomes available to other peers.

Magnet links aren't inherently dangerous either. But any download can be hijacked by malware. As a result, instead of requested files, a Trojan may first try to download other malware.

Clicking on a magnet link or downloading a torrent file can't get a system infected, but this doesn't mean that users should lower their guard.

For example, users may be presented with the option to download a distribution file along with a patch (i.e. a crack) for the software. The patch will surely contain malicious code. Or a newly released movie is being shared. But when the file is downloaded, users only observe an incorrect codec error message for 90 minutes. They will also be offered the option to download the appropriate codec at www.notmalwareatall.org/malware.exe. Here, it is quite obvious what users will download eventually. A less common infection technique involves films with bogus subtitle files that exploit vulnerabilities in specific video players.

Later on, the shared file can be obtained by other users from any computer onto which it has already been downloaded.

In conclusion.

• Downloading files over BitTorrent is quite harmless. It doesn't matter how a file gets into a system. As soon as the file is launched or opened, the anti-virus will scan it instantly. BitTorrent file sharing can't be abused to download or launch files in such a way that they will bypass anti-virus scanning.
• A shared file can be malicious or it may be used to download malware.