BitTorrent has rarely been considered the gold standard in protecting corporate data, but a recently discovered BitTorrent vulnerability may raise fresh concerns about the overall security of peer-to-peer sharing services.
First disclosed via an advisory from HP’s Zero-Day Initiative, the BitTorrent vulnerability involves a problem in Sync, which is a way of connecting smartphones and tablets used by workers in the field with PCs or workstations back at an office, for example. A researcher discovered that a cybercriminal could theoretically pose as a legitimate user of executive code if the legitimate user were to click on a link labeled with the bitsync: protocol after visiting a malware-laden Web page. Given the volume of phishing schemes that seem to happen every day, this presumably wouldn’t be difficult to do.
As a story on SecurityWeek noted, the potential danger was originally found late last year, and BitTorrent has reportedly already fixed it. However, the company may still need to clarify which kind of upgrades — if any — current Sync owners need to make.
It is worth pointing out that Sync only recently came out of beta. In its coverage last month, TechCrunch noted that the stakes are high to compete with similar file-sharing services such as Microsoft OneDrive, Google Drive and Dropbox. That means any BitTorrent vulnerability needs to be dealt with as quickly and as publicly as possible to reassure nervous CSOs that their organizations can experiment with new, emerging services such as Sync without putting their sensitive data at risk.
Unfortunately, in this case, BitTorrent might have a lot of persuading to do. Back in November, a group called Hackito Ergo Sum posted a detailed analysis of Sync’s potential security issues. According to Network World at the time, the findings suggested BitTorrent Sync’s “built for trust” motto should not be believed by businesses.
Plus, a piece on the The Next Web said the whole premise of Sync is that it offers a more reassuring system for file management than putting them in the cloud, an approach that has become controversial after hacking incidents involving Apple’s iCloud and other services.
On the other hand, BitTorrent has posted on its own blog that it has had Sync reviewed by third parties such as iSEC Partners, which showed the service was safe from a variety of possible cybercriminal threats. That kind of validation could come particularly in handy now that it is trying to offer a paid version of its service — at least as long as another BitTorrent vulnerability doesn’t rear its head in the near future.