April 7, 2015 By Shane Schick 2 min read

BitTorrent has rarely been considered the gold standard in protecting corporate data, but a recently discovered BitTorrent vulnerability may raise fresh concerns about the overall security of peer-to-peer sharing services.

First disclosed via an advisory from HP’s Zero-Day Initiative, the BitTorrent vulnerability involves a problem in Sync, which is a way of connecting smartphones and tablets used by workers in the field with PCs or workstations back at an office, for example. A researcher discovered that a cybercriminal could theoretically pose as a legitimate user of executive code if the legitimate user were to click on a link labeled with the bitsync: protocol after visiting a malware-laden Web page. Given the volume of phishing schemes that seem to happen every day, this presumably wouldn’t be difficult to do.

As a story on SecurityWeek noted, the potential danger was originally found late last year, and BitTorrent has reportedly already fixed it. However, the company may still need to clarify which kind of upgrades — if any — current Sync owners need to make.

It is worth pointing out that Sync only recently came out of beta. In its coverage last month, TechCrunch noted that the stakes are high to compete with similar file-sharing services such as Microsoft OneDrive, Google Drive and Dropbox. That means any BitTorrent vulnerability needs to be dealt with as quickly and as publicly as possible to reassure nervous CSOs that their organizations can experiment with new, emerging services such as Sync without putting their sensitive data at risk.

Unfortunately, in this case, BitTorrent might have a lot of persuading to do. Back in November, a group called Hackito Ergo Sum posted a detailed analysis of Sync’s potential security issues. According to Network World at the time, the findings suggested BitTorrent Sync’s “built for trust” motto should not be believed by businesses.

Plus, a piece on the The Next Web said the whole premise of Sync is that it offers a more reassuring system for file management than putting them in the cloud, an approach that has become controversial after hacking incidents involving Apple’s iCloud and other services.

On the other hand, BitTorrent has posted on its own blog that it has had Sync reviewed by third parties such as iSEC Partners, which showed the service was safe from a variety of possible cybercriminal threats. That kind of validation could come particularly in handy now that it is trying to offer a paid version of its service — at least as long as another BitTorrent vulnerability doesn’t rear its head in the near future.

More from

Ransomware payouts hit all-time high, but that’s not the whole story

3 min read - Ransomware payments hit an all-time high of $1.1 billion in 2023, following a steep drop in total payouts in 2022. Some factors that may have contributed to the decline in 2022 were the Ukraine conflict, fewer victims paying ransoms and cyber group takedowns by legal authorities.In 2023, however, ransomware payouts came roaring back to set a new all-time record. During 2023, nefarious actors targeted high-profile institutions and critical infrastructure, including hospitals, schools and government agencies.Still, it’s not all roses for…

What should an AI ethics governance framework look like?

4 min read - While the race to achieve generative AI intensifies, the ethical debate surrounding the technology also continues to heat up. And the stakes keep getting higher.As per Gartner, “Organizations are responsible for ensuring that AI projects they develop, deploy or use do not have negative ethical consequences.” Meanwhile, 79% of executives say AI ethics is important to their enterprise-wide AI approach, but less than 25% have operationalized ethics governance principles.AI is also high on the list of United States government concerns.…

Hive0051 goes all in with a triple threat

13 min read - As of April 2024, IBM X-Force is tracking new waves of Russian state-sponsored Hive0051 (aka UAC-0010, Gamaredon) activity featuring new iterations of Gamma malware first observed in November 2023. These discoveries follow late October 2023 findings, detailing Hive0051's use of a novel multi-channel method of rapidly rotating C2 infrastructure (DNS Fluxing) to deliver new Gamma malware variants, facilitating more than a thousand infections in a single day. An examination of a sample of the lures associated with the ongoing activity reveals…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today