Vulnerabilities discovered in µTorrent that gives websites control of computers

[ProjectBox153]

Major security flaw in µTorrent that leaves computers open targets for attackers

 

There was a major security flaw found in µTorrent that can allow attackers to do numerous things to computers, including executing code, accessing downloaded files, and access histories of downloads. This was discovered by a security researcher from Google's Project Zero. 

Ars Technica quote:

Quote

Two versions of uTorrent, one of the Internet's most widely used BitTorrent apps, have easy-to-exploit vulnerabilities that allow attackers to execute code, access downloaded files, and snoop on download histories, a Google Project Zero researcher said.

This affects the desktop version of the program as well as the web client version. The beta version of µTorrent already has a fix in place, and can be downloaded here, but the final production release hasn't been completely pushed out to users yet. It should happen in the coming days. µTorrent Web has also been patched. 

Wccftech quote:

Quote

The exploits use a technique known as domain name system rebinding to make an untrusted Internet domain resolve to the local IP address of the computer running a vulnerable uTorrent app.

Even though there is a patch in the works, the developers failed to fix the bugs within the 90-day period given to them. After the 90-day period, the bug was made public, and is how we know about it now. This is worrisome as we don't know if anyone else discovered the flaw after the Google Project Zero researcher discovered it. Who knows if anyone went snooping through download histories or took files people had downloaded in this time? What do you think?

 

 

Sources:

Spoiler

Ars Technica: https://arstechnica.com/information-technology/2018/02/utorrent-bugs-let-websites-control-your-computer-and-steal-your-downloads/

Wccftech: https://wccftech.com/utorrent-security-bugs/

 

[bcredeur97]

microTorrent became awful as soon as they got new owners many years ago. I haven't used it once since...

go-to is qBitTorrent whenever I need to download a torrent for whatever reason... like a copy of a linux distro

[Leonard]

Removing the ports on the NAT/firewall for any torrenting software when closed should be safe.

[vorticalbox]

11 minutes ago, bcredeur97 said:

microTorrent became awful as soon as they got new owners many years ago. I haven't used it once since...

go-to is qBitTorrent whenever I need to download a torrent for whatever reason... like a copy of a linux distro

I like transmission mostly because its included with Ubuntu. also you don't been to defend your self people have to prove your guilt not you to  defend your innocence. 

[apm]

6 minutes ago, bcredeur97 said:

microTorrent became awful as soon as they got new owners many years ago. I haven't used it once since...

i have only used versions pre sellout, so 2.2 or whatever.

its amazing how no one managed to make a lightweight bittorrent client as classic utorrent. 

qbittorrent is the closest we got.

 

i think its not worth mentioning which version exactly are affected by this so i can check if i have to upgrade or not?

i only know that a version of the windows client and web client are affected.

[ProjectBox153]

14 minutes ago, apm said:

i have only used versions pre sellout, so 2.2 or whatever.

its amazing how no one managed to make a lightweight bittorrent client as classic utorrent. 

qbittorrent is the closest we got.

 

i think its not worth mentioning which version exactly are affected by this so i can check if i have to upgrade or not?

i only know that a version of the windows client and web client are affected.

According to Ars, " The fixed version, uTorrent/BitTorrent 3.5.3.44352, is available here for download and will be automatically pushed out to users in the coming days. ". I don't know which specific version from before this (assuming it's limited to one or a couple specific builds) are affected.

[Bananasplit_00]

microtorrent is kinda crap anyway, everyone should really move to qBit IMO

[Daniel644]

the question is how far back does this go? after a certain build it stopped getting supported due to security issues (per the sites opinion) so they required using the older "safe" versions if you used that client, wonder if this has to do with the changes that came from those later versions.

[TetraSky]

Personally moved to Tixati when it utorrent was sold off years ago, but I do know a few people that still uses the last "free" version.(from before they were sold and essentially became adware)

[LAwLz]

So is 2.2.1 vulnerable? That's the last version before it went to shit. 

Also, I'll take this opportunity to recommend qBittorrent to anyone who are currently using utorrent. 

[XenosTech]

6 minutes ago, LAwLz said:

So is 2.2.1 vulnerable? That's the last version before it went to shit. 

Also, I'll take this opportunity to recommend qBittorrent to anyone who are currently using utorrent. 

Come to think of it... I may be running that exact version lol. I hardly download any torrents these days

[xAcid9]

People still use uTorrent? 

[Murasaki]

I used to use it in the past, glad I switched wew. 

[yian88]

Obligatory: Do people still use uTorrent? thats the only real issue i see here.

[HarryNyquist]

12 minutes ago, yian88 said:

Obligatory: Do people still use uTorrent? thats the only real issue i see here.

Probably. It was a good app before they sold out & started bundling malware & crap with the installer. I think a lot of people hang onto it for nostalgia.

[lewdicrous]

I thought this was a known thing.. or was that about the 'remote crypto-mining' if that was a thing too

[Doobeedoo]

qBitTorrent is go to for a while though. 

[Tarzan]

On 2/21/2018 at 6:08 PM, bcredeur97 said:

microTorrent became awful as soon as they got new owners many years ago. I haven't used it once since...

go-to is qBitTorrent whenever I need to download a torrent for whatever reason... like a copy of a linux distro

I like how need to specify your use of torrent applications to disculp yourself^^

[Daniel644]

10 hours ago, xAcid9 said:

People still use uTorrent? 

 

4 hours ago, yian88 said:

Obligatory: Do people still use uTorrent? thats the only real issue i see here.

the REALLY OLD versions like 2.2.1 and earlier is still pretty popular.

[Guest]

I use Vuze still. uTorrent is so basic you might as well wear a puffer vest and a striped t-shirt, then go to Starbucks to download (And write your 'Novel').

[Marinatall_Ironside]

This simply reaffirms my paranoia, which means I don't torrent or do any of that shady business.

[LAwLz]

On 2/22/2018 at 7:22 PM, RorzNZ said:

I use Vuze still. uTorrent is so basic you might as well wear a puffer vest and a striped t-shirt, then go to Starbucks to download (And write your 'Novel').

That's funny. I stopped using updating uTorrent when it started adding a bunch of extra feature and got bloated.

All I want from my torrenting to do is download and upload torrents, preferably automatically with RSS feeds.

[mrthuvi]

Private trackers are starting to ban utorrent....

[suicidalfranco]

Still on transmission ever since I first tried it in the Ubuntu 9.10 days 

[Lewellyn]

3 hours ago, mrthuvi said:

Private trackers are starting to ban utorrent....

damn...

 

uTorrent 2.2.1 isn't even susceptible to this if I'm reading through posts correctly. Fearmongering ruining a perfectly good client.