In other words, you can DDoS any ip for the cost of registering a domain and publishing a specific DNS record.
Is it really going to be all that bad? The BitTorrent clients I’ve used all seemed pretty polite, backing off for like 60s at least for each tracker they can’t connect to. If you buy one of the dead tracker domains and point it at an IP of someone else, but their services aren’t even listening on the port client wants to connect to (and don’t speak BitTorrent even if the port happened to coincide), I can’t imagine th…
Resurrecting a dead torrent tracker and finding 3M peers
121–130 of 217 posts
Re: Resurrecting a dead torrent tracker and finding 3M peers
#122Now I'm wondering: with the wide range of bittorrent clients out there, and the fact that many are written in unsafe languages, could it be possible for some of them to be exploited through a malicious tracker? It would not surprise me if some of these clients misbehave if fed malformed data from a tracker.
Possible but unlikely. The protocol is relatively simple, and what clients are out there have already been subjected to tons of untrusted input.
Re: Resurrecting a dead torrent tracker and finding 3M peers
#123Earlier quoted context omitted.
Googling, there's been at least one tracker shut down by US law enforcement, EliteTorrents [2005] https://www.latimes.com/archives/la-xpm-2005-may-26-fi-torre... I think there have probably been more. There are definitely more that had civil suits with MPAA etc suing for damages. It may be somewhat harder to make the case in the US, but a tracker where a great majority of what's listed is copyrighted, I'm pretty sure…
Was that the actual tracker and tracker only, or was there a web front end that hosted all the torrent files and forums and so forth? Because the latter will make you a big target. God I miss rarbg. And KAT.
A lot of the best torrents are now on private trackers in my experience. I'm not clear why, but observing the communities involved, members seem to take great pride in e.g. well formatted e-books, well organized audiobook files, creating different resolutions and compression rate variations of a movie or tv show, and I suppose want to keep those in the community?
Re: Resurrecting a dead torrent tracker and finding 3M peers
#124I wonder how many anti-torrent groups are doing this covertly.
Definitely a few. Media companies often send out infringement notices to ISPs to be forwarded to the user and I would guess this is how they get those IPs
When I moved out of my apartment I needed to transfer the Comcast account to my roommate. In the process of logging into their web dashboard for the first time since I'd started the service, I found out I had an @comcast.com type email address, apparently registered for me. The webmail UI indicated I had thousands of unread emails. I was curious what kind of spam gets sent to an email address that's so far as I'm aware never out on the internet anywhere, so popped it open.
Thousands of DMCA requests. Full filenames. Over the course of a year they had apparently notified Comcast of thousands of alleged violations, and nothing more than an email ever came of it.
Impossible to know which roommate was allegedly torrenting files of course. Or perhaps people visiting using our wifi. Who knows!
Re: Resurrecting a dead torrent tracker and finding 3M peers
#125Earlier quoted context omitted.
Is this legal isn’t a useful question. The better question is how likely are you to get sued? With civil lawsuits it doesn’t matter if it’s legal you can be sued and harassed by lawyers if you get on their radar.
I’m not sure if that’s true actually, you might get a takedown notice, but to sue, and maybe I’m wrong but you have to claim damages, all op has to do is not announce out? IE he can see the peer pool but they don’t announce the peer list.
Suing isn’t just going to court it means subpoenas, depositions, motions, letters, etc. all this stuff costs a ton of money without you even stepping foot in a court. The system is so broken
Re: Resurrecting a dead torrent tracker and finding 3M peers
#126Earlier quoted context omitted.
I’m not sure if that’s true actually, you might get a takedown notice, but to sue, and maybe I’m wrong but you have to claim damages, all op has to do is not announce out? IE he can see the peer pool but they don’t announce the peer list.
The RIAA doesn't have to sue to make OP's life miserable. They have enough lawyers on the payroll to drown him in perfectly legal demand letters. Go one step further and assume the demand letters are harassment - what's OP going to do, sue the RIAA?
Nahh, for a bunch of annoying letters take them to small claims court. Cheap for you, expensive for them, and you win if they don’t show up.
Re: Resurrecting a dead torrent tracker and finding 3M peers
#127Now I'm wondering: with the wide range of bittorrent clients out there, and the fact that many are written in unsafe languages, could it be possible for some of them to be exploited through a malicious tracker? It would not surprise me if some of these clients misbehave if fed malformed data from a tracker.
Data is encoded via bencode so it's a byte wise format. Known malicious trackers usually inject stuff in the sense that e.g. there is a payload to all known PDF files appended with a payload that targets the clients' OS.
The announcement related APIs are fairly easy to implement, but I wouldn't bet on it being implemented in a fuzzed testing environment. Transmission, for example, had multiple vulnerabilities over the years. Not sure about the other client implementations.
Re: Resurrecting a dead torrent tracker and finding 3M peers
#128> Is this legal? Why wouldn't it be? You're not actually hosting a tracker in this case, only looking at incoming connections. And even if you do run a tracker, hard to make the case that the tracker itself is illega. Hosting something like opentrackr is like hosting a search engine, how they respond to legal takedown requests is where the crux is at, and whatever infra sits around the tracker, so police and courts c…
Because knowingly helping people commit crimes generally counts the same as committing the crime yourself. I.e. federally in the U.S. under 18 USC 2a https://www.law.cornell.edu/uscode/text/18/2 The software you're running being "simple" isn't a defence for doing illegal things with it - like aiding others commit crimes. There are a few internet/copyright safe harbor provisions (in the US) that might maybe (probably…
> Because knowingly helping people commit crimes generally counts the same as committing the crime yourself.
Oh boy, are the crypto bros in trouble.
Re: Resurrecting a dead torrent tracker and finding 3M peers
#129> Is this legal? Why wouldn't it be? You're not actually hosting a tracker in this case, only looking at incoming connections. And even if you do run a tracker, hard to make the case that the tracker itself is illega. Hosting something like opentrackr is like hosting a search engine, how they respond to legal takedown requests is where the crux is at, and whatever infra sits around the tracker, so police and courts c…
Do you think the police understand this nuance? Especially since most of the traffic that will go through there is probably copyright infringement? They'll just see tracker and assume it's illegal.
Tell them it's for training a corporate AI model, then.
Re: Resurrecting a dead torrent tracker and finding 3M peers
#130Now I'm wondering: with the wide range of bittorrent clients out there, and the fact that many are written in unsafe languages, could it be possible for some of them to be exploited through a malicious tracker? It would not surprise me if some of these clients misbehave if fed malformed data from a tracker.
Data is encoded via bencode so it's a byte wise format. Known malicious trackers usually inject stuff in the sense that e.g. there is a payload to all known PDF files appended with a payload that targets the clients' OS. The announcement related APIs are fairly easy to implement, but I wouldn't bet on it being implemented in a fuzzed testing environment. Transmission, for example, had multiple vulnerabilities over th…
Don't torrents have a checksum hash, though? Or is it one of the broken hashing algorithms like MD5?