Taperssection.com

Gear / Technical Help => Post-Processing, Computer / Streaming / Internet Devices & Related Activity => Topic started by: rigpimp on February 21, 2018, 06:07:46 PM

Title: uTorrent Vulnerability
Post by: rigpimp on February 21, 2018, 06:07:46 PM
Bummer for those of us that stopped using Qbittorrent for randomly pinging ports.  This sounds like it has the potential to be much more malicious.

https://torrentfreak.com/bittorrent-client-utorrent-suffers-security-vulnerability-180220/
Title: Re: uTorrent Vulnerability
Post by: heathen on February 21, 2018, 06:17:32 PM
Quote
Update: The vulnerability affects all unpatched uTorrent versions, not just those that have the Web UI enabled.

Bummer for people like me who are using an old version of uTorrent from before it started going downhill.  When I was reading the article I was hoping the vulnerability was only in the newer version(s).
Title: Re: uTorrent Vulnerability
Post by: The Other Chris on February 21, 2018, 06:32:15 PM
I use an older version too, any suggestions on a replacement?
Title: Re: uTorrent Vulnerability
Post by: Fatah Ruark (aka MIKE B) on February 21, 2018, 06:54:52 PM
If you disable the recommended settings (WebUI and net.discoverable setting) I don't think you will have an issue (at least a known one).

That being said most people are using older versions that aren't being patched.

I use rtorrent with rutorrent as a WebUI. It works great. Not as easy to set up as uTorrent, but handles a shit ton of torrents easily.
Title: Re: uTorrent Vulnerability
Post by: voltronic on February 21, 2018, 08:16:07 PM
Deluge (http://deluge-torrent.org/) is the way to go, IMHO.
Title: Re: uTorrent Vulnerability
Post by: unidentified on February 21, 2018, 10:06:57 PM
If you disable the recommended settings (WebUI and net.discoverable setting) I don't think you will have an issue (at least a known one).

That being said most people are using older versions that aren't being patched.

I use rtorrent with rutorrent as a WebUI. It works great. Not as easy to set up as uTorrent, but handles a shit ton of torrents easily.

I am more than a bit confused here.  Would running uTorrent 2.0.4 without enabling WebUI be enough to guard against this flaw?  If not, what other settings could be disabled and how would doing so affect  uTorrent's basic functionality?  Many thanks!
Title: Re: uTorrent Vulnerability
Post by: Fatah Ruark (aka MIKE B) on February 21, 2018, 10:11:29 PM
I got this from a "famous torrent site":

Quote
Recently, two security bugs were found in uTorrent in how it sets up its web interface (affecting both uTorrent Web and uTorrent Classic). The full bug report can be found here: https://bugs.chromium.org/p/project-zero/issues/detail?id=1524 More information can be found here: https://torrentfreak.com/bittorrent-client-utorrent-suffers-security-vulnerability-180220/

uTorrent web
Basically, this security hole allows an attacker to remotely get access to your uTorrent via the WebUI, and use that for malicious activities, like downloading viruses to your computer. Because of this, I strongly recommend that all users currently using the uTorrent webUI, disable it for the time being. (This applies to both uTorrent web and the WebUI inside 'normal' versions of uTorrent)

uTorrent Classic
Even if you have the WebUI disabled, there is another security bug that can be exploited. Among other things, this bug allows for crashing of uTorrent, and stealing of torrents. to prevent this, I strongly recommend that all uTorrent users disable the 'net.discoverable' setting. Some older uTorrent versions might not have this option. If you cannot find it, you might be safe from this bug.

After applying the setting, you should restart the client. (File>Exit, then starting it again)

(https://ptpimg.me/w8682p.png)

(https://ptpimg.me/dgydyg.png)
Title: Re: uTorrent Vulnerability
Post by: Gordon on February 22, 2018, 09:40:40 AM
Bummer for those of us that stopped using Qbittorrent for randomly pinging ports.

I've been using utorrent 2.2.1 for every and thought about trying Q.  has the issue you're referring to been fixed?


Yes I know I could disable webui etc (or wait for the bloated update) but I run utorrent on my headless home server and rely on the webui to load torrents, stop/start etc.
Title: Re: uTorrent Vulnerability
Post by: if_then_else on February 22, 2018, 12:12:29 PM
FWIW: There are some web-ui based frontends for Deluge and Transmission, too.
Title: Re: uTorrent Vulnerability
Post by: rocksuitcase on February 22, 2018, 01:38:07 PM
thanks for this. I stopped using utorrent last summer and replaced it with qbitorrent. Since I don't use it I just uninstalled it rather than tweak the settings. Thanks again.     :coolguy:
Title: Re: uTorrent Vulnerability
Post by: Gordon on February 22, 2018, 04:22:10 PM
FWIW: There are some web-ui based frontends for Deluge and Transmission, too.

saw that and messed with Deluge a little.  I don't have time to figure out command lines for install/configs of plugins etc.  I want simple and easy and qbitorrent seems to fit the bill. 
Title: Re: uTorrent Vulnerability
Post by: rigpimp on February 22, 2018, 04:41:27 PM
I am unsure how, or if, this was resolved but for those considering Qbitorrent:

http://taperssection.com/index.php?topic=183133.0
Title: Re: uTorrent Vulnerability
Post by: Gordon on February 22, 2018, 04:56:33 PM
I am unsure how, or if, this was resolved but for those considering Qbitorrent:

http://taperssection.com/index.php?topic=183133.0

Did you verify that other users had the same issue?  Google did not turn up much for me.  Are you sure it wasn't do to a connected peer in one of your torrents?  I've seen similar behavior on utorrent due to someone in the swarm.

I've tested the latest and 3.3.16 today and malwarebytes has not detected anything.
Title: Re: uTorrent Vulnerability
Post by: rigpimp on February 22, 2018, 05:00:40 PM
I am unsure how, or if, this was resolved but for those considering Qbitorrent:

http://taperssection.com/index.php?topic=183133.0

Did you verify that other users had the same issue?  Google did not turn up much for me.  Are you sure it wasn't do to a connected peer in one of your torrents?  I've seen similar behavior on utorrent due to someone in the swarm.

I've tested the latest and 3.3.16 today and malwarebytes has not detected anything.

It has been a while but I am not sure that I was even running any torrents at the point I upgraded.  Hopefully it has all been worked out, whatever it was.
Title: Re: uTorrent Vulnerability
Post by: tim in jersey on February 22, 2018, 10:15:56 PM
Deluge (http://deluge-torrent.org/) is the way to go, IMHO.

Yep.
Title: Re: uTorrent Vulnerability
Post by: heathen on February 25, 2018, 12:56:46 AM
I'm giving Deluge a try....thanks for the heads up.
Title: Re: uTorrent Vulnerability
Post by: tim in jersey on February 26, 2018, 11:44:40 PM
I'm giving Deluge a try....thanks for the heads up.

Not much of a learning curve either...
Title: Re: uTorrent Vulnerability
Post by: rigpimp on February 27, 2018, 11:02:56 AM
Deluge (http://deluge-torrent.org/) is the way to go, IMHO.

Yep.

I downloaded Deluge and notice that it is not quite as intuitive as uTorrent. 

I personally prefer to run ALL torrenting through my VPN and see that IPVanish's website has instructions to put the proxy info into Deluge but my version of Deluge won't let me enter all of the info for some reason.  Just gotta poke around.
Title: Re: uTorrent Vulnerability
Post by: heathen on February 27, 2018, 11:15:47 AM
I downloaded Deluge and notice that it is not quite as intuitive as uTorrent. 

I personally prefer to run ALL torrenting through my VPN and see that IPVanish's website has instructions to put the proxy info into Deluge but my version of Deluge won't let me enter all of the info for some reason.  Just gotta poke around.
You might need to check the plug-ins.  When I was looking at how to set up a scheduler in Deluge, I learned that it's done with a plug-in.  Some of the plug-ins (like scheduler) come with the install of Deluge and you just need to enable them in the plug-in menu.  There are more to download online as well.
Title: Re: uTorrent Vulnerability
Post by: rigpimp on February 27, 2018, 12:55:01 PM
I downloaded Deluge and notice that it is not quite as intuitive as uTorrent. 

I personally prefer to run ALL torrenting through my VPN and see that IPVanish's website has instructions to put the proxy info into Deluge but my version of Deluge won't let me enter all of the info for some reason.  Just gotta poke around.
You might need to check the plug-ins.  When I was looking at how to set up a scheduler in Deluge, I learned that it's done with a plug-in.  Some of the plug-ins (like scheduler) come with the install of Deluge and you just need to enable them in the plug-in menu.  There are more to download online as well.

Thanks for the tip, I will check on it tonight.