BitTorrent has rarely been considered the gold standard in protecting corporate data, but a recently discovered BitTorrent vulnerability may raise fresh concerns about the overall security of peer-to-peer sharing services.

First disclosed via an advisory from HP’s Zero-Day Initiative, the BitTorrent vulnerability involves a problem in Sync, which is a way of connecting smartphones and tablets used by workers in the field with PCs or workstations back at an office, for example. A researcher discovered that a cybercriminal could theoretically pose as a legitimate user of executive code if the legitimate user were to click on a link labeled with the bitsync: protocol after visiting a malware-laden Web page. Given the volume of phishing schemes that seem to happen every day, this presumably wouldn’t be difficult to do.

As a story on SecurityWeek noted, the potential danger was originally found late last year, and BitTorrent has reportedly already fixed it. However, the company may still need to clarify which kind of upgrades — if any — current Sync owners need to make.

It is worth pointing out that Sync only recently came out of beta. In its coverage last month, TechCrunch noted that the stakes are high to compete with similar file-sharing services such as Microsoft OneDrive, Google Drive and Dropbox. That means any BitTorrent vulnerability needs to be dealt with as quickly and as publicly as possible to reassure nervous CSOs that their organizations can experiment with new, emerging services such as Sync without putting their sensitive data at risk.

Unfortunately, in this case, BitTorrent might have a lot of persuading to do. Back in November, a group called Hackito Ergo Sum posted a detailed analysis of Sync’s potential security issues. According to Network World at the time, the findings suggested BitTorrent Sync’s “built for trust” motto should not be believed by businesses.

Plus, a piece on the The Next Web said the whole premise of Sync is that it offers a more reassuring system for file management than putting them in the cloud, an approach that has become controversial after hacking incidents involving Apple’s iCloud and other services.

On the other hand, BitTorrent has posted on its own blog that it has had Sync reviewed by third parties such as iSEC Partners, which showed the service was safe from a variety of possible cybercriminal threats. That kind of validation could come particularly in handy now that it is trying to offer a paid version of its service — at least as long as another BitTorrent vulnerability doesn’t rear its head in the near future.

More from

The Role of Human Resources in Cybersecurity

The human resources (HR) department is an integral part of an organization. They work with all departments with a wider reach than even IT. As a highly visible department, HR can support and improve an organization’s security posture through employee training. Their access to employees at the start of employment is an opportunity to lay a foundation for a culture of risk awareness. HR departments do not typically include cybersecurity risk awareness training with new hire onboarding, but it’s something…

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Operational Technology: The evolving threats that might shift regulatory policy

Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. Attacks on Operational Technology (OT) and Industrial Control Systems (ICS) grabbed the headlines more often in 2022 — a direct result of Russia’s invasion of Ukraine sparking a growing willingness on behalf of criminals to target the ICS of critical infrastructure. Conversations about what could happen if these kinds of systems were compromised were once relegated to “what ifs” and disaster movie scripts. But those days are…

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them. ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge. Understanding Attack Surface Management Here…