Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Resurrecting a dead torrent tracker and finding 3M peers

kianbradley.com

Post reply on HN
Print view View original

131–140 of 217 posts

Re: Resurrecting a dead torrent tracker and finding 3M peers

#131

Post by cookiengineer »

Sophira wrote: post #130
cookiengineer wrote: post #127

Earlier quoted context omitted.

Data is encoded via bencode so it's a byte wise format. Known malicious trackers usually inject stuff in the sense that e.g. there is a payload to all known PDF files appended with a payload that targets the clients' OS. The announcement related APIs are fairly easy to implement, but I wouldn't bet on it being implemented in a fuzzed testing environment. Transmission, for example, had multiple vulnerabilities over th…

Don't torrents have a checksum hash, though? Or is it one of the broken hashing algorithms like MD5?

That's correct. Most clients revalidate stuff after the download has been completed. Depending on how well they can redownload chunks (e.g. web seeds sometimes don't allow that if the web server does not support 206 Partial Content headers) you might have to redownload the file completely afterwards.

I had different experiences with different clients, so I guess it's work in progress on what a client does when the cache was poisoned.

Hashing algos are mostly SHA based ones that are used. No idea if someone managed to inject stuff and found collisions for SHA1 yet though. I know that there has been PoCs in the past for hash collisions of PDF files.

Context: [1] https://shattered.io/

Re: Resurrecting a dead torrent tracker and finding 3M peers

#132

Post by necovek »

gpm wrote: post #91
KomoD wrote: post #63

Earlier quoted context omitted.

> It's that you're literally observing that a bunch of old mostly-piracy torrents are pointing at this domain, and then deciding to turn this domain back into a service which assists in that piracy. He doesn't know if they're mostly piracy or not, all he sees is a hash and the peers.

He did not choose the domain name by chance. He chose it because he observed it was previously in use as a tracker for copyright infringing torrents. The police/courts/jury is not obliged to put blinders on just because you would prefer if they did. The mere fact that the domain name was previously used for this is almost certainly probable cause to get search warrants that will almost certainly provide the requisite…

They explicitly used it to download "Linux isos", which are highly likely not copyright infringing (they are usually free to distribute).

Eg. Canonical distributes Ubuntu via BitTorrent too: https://ubuntu.com/download/alternative-downloads

Edit: I missed the "uh," in the OP: I stand corrected.

Re: Resurrecting a dead torrent tracker and finding 3M peers

#133

Post by rjh29 »

anal_reactor wrote: post #116
NoMoreNicksLeft wrote: post #84

Earlier quoted context omitted.

Was that the actual tracker and tracker only, or was there a web front end that hosted all the torrent files and forums and so forth? Because the latter will make you a big target. God I miss rarbg. And KAT.

> God I miss rarbg. And KAT. I miss shit being worth torrenting. Maybe things have changed, maybe I grew up, but: 1. Most utility software you need is free, save for a few programs you can easily find on Russian torrents. 2. Most games and other media are slop. Torrents didn't die because US law enforcement made them die. Torrents died because most companies realized that providing slop with ads and lootboxes for fre…

Torrents died because you can basically just download anything off file hosting sites now, or bootleg OneDrives/Google Drives.

There is still plenty of quality stuff in 2025, and a lot of slop, just how it was 40 years ago.

Re: Resurrecting a dead torrent tracker and finding 3M peers

#135

Post by dafugg »

treyd wrote: post #89
nneonneo wrote: post #31

Now I'm wondering: with the wide range of bittorrent clients out there, and the fact that many are written in unsafe languages, could it be possible for some of them to be exploited through a malicious tracker? It would not surprise me if some of these clients misbehave if fed malformed data from a tracker.

Most torrent clients that people use (though not all) are actually wrappers around libtorrent, which is very well tested and has even been audited.

Libtorrent even has fuzzers specifically for communications with trackers and DHT peers. Obviously this isn’t perfect but it gives me much more confidence than other implementations do.

Re: Resurrecting a dead torrent tracker and finding 3M peers

#137

Post by aidenn0 »

jrochkind1 wrote: post #105
NoMoreNicksLeft wrote: post #84

Earlier quoted context omitted.

Was that the actual tracker and tracker only, or was there a web front end that hosted all the torrent files and forums and so forth? Because the latter will make you a big target. God I miss rarbg. And KAT.

I'm curious the nature of the US laws that would make the web front end illegal (or subject to civil penalties?) but not the tracker?

A tracker is ostensibly a content-neutral middleman. Your ISP isn't illegal (and until recently was not thought to be subject to civil penalties; now there is at least one ongoing case) either.

A lot of these websites were "come here and pirate lots of shit," often had tools to make it easier to specifically search for infringing content, and would remove torrents that were not tagged correctly. In many cases some of the people running the sites were also seeding.

That makes it hard to argue "we're just passing packets"

Re: Resurrecting a dead torrent tracker and finding 3M peers

#138

Post by seb1204 »

rjh29 wrote: post #133
anal_reactor wrote: post #116

Earlier quoted context omitted.

> God I miss rarbg. And KAT. I miss shit being worth torrenting. Maybe things have changed, maybe I grew up, but: 1. Most utility software you need is free, save for a few programs you can easily find on Russian torrents. 2. Most games and other media are slop. Torrents didn't die because US law enforcement made them die. Torrents died because most companies realized that providing slop with ads and lootboxes for fre…

Torrents died because you can basically just download anything off file hosting sites now, or bootleg OneDrives/Google Drives. There is still plenty of quality stuff in 2025, and a lot of slop, just how it was 40 years ago.

Well, I myself consider many of today's TV shows slop and not worth the need to watch them through a torrent source. Low quality content en mass for streaming services is a thing now. But that's a personal view.

Re: Resurrecting a dead torrent tracker and finding 3M peers

#140

Post by udev4096 »

ethan_smith wrote: post #117
nneonneo wrote: post #31

Now I'm wondering: with the wide range of bittorrent clients out there, and the fact that many are written in unsafe languages, could it be possible for some of them to be exploited through a malicious tracker? It would not surprise me if some of these clients misbehave if fed malformed data from a tracker.

Transmission had a remote code execution vulnerability (CVE-2018-5702) through DNS rebinding that allowed attackers to execute arbitrary commands - tracker exploitation is definitely a real attack vector.

Using a container sandbox such as gvisor would definitely help. Or even using firejail for normal systemd processes
Post reply on HN