#uTorrent bug allows #websites to spy on PC and steal downloaded files

Google researcher uncovered another uTorrent bug allowing hackers to spread malware
Google Project researcher Tavis Ormandy discovered a severe remote code execution bug in uTorrent Web, which will enable hackers to disseminate malware via hacked software on malicious websites. Hackers exploited a way to steal uTorrent’s authentication tokens and take complete control over the service.
Initially, this problem had been reported in December,[3] except that it touched BitTorrent and uTorrent Classic. Then Ormandy warned clients that the vulnerability might allow hackers to infect websites from which torrents are downloaded and, therefore, allow them to see what software you tend to download. He pointed out that:
Once you have the secret, you can just change the directory torrents are saved to, and then download any file anywhere.
Cybercriminals found a way to steal tokens via torrent websites loaded over a web browser. This way they manage to steal the authentication token and may take full control over uTorrent service.
By default, uTorrent Web create an HTTP RPC server on port 10000 (uTorrent classic) or 19575 (uTorrent web). However, experts have found multiple flaws in the RPC server, which allows hackers to exploit any data using XMLHTTPRequest(). In other words, visiting practically any website can end up with software corruption and malware injection.
The flaw allows hackers to inject malware into Windows startup folder
uTorrent Web uses a web interface.[4] Thus, in comparison to desktop apps, the service is controlled by a browser. Besides, the uTorrent web is configured to start along with the Window OS. This grants the service to be running and accessible all the time.
Once crooks steal the authentication token, they generate a random one and inject it in a configuration file, which must pass all URL parameter requirements. After the hack, the hijacked uTorrent Web server’s icon o will generate a browser window with the controlled client. This way, website’s owner or manager can give the software a command to download a severe infection, which is installed straight to the Windows startup.

Comments

Post a Comment

Popular posts from this blog

How to make ‪#‎symbols‬ with your ‪#‎keyboard‬

Image
Alt + 0153..... ™... trademark symbol Alt + 0169.... ©.... copyright symbol Alt + 0174..... ®....registered trademark symbol Alt + 0176 ...°......degre­e symbol Alt + 0177 ...±....plus-or­-minus sign Alt + 0182 ...¶.....paragraph mark Alt + 0190 ...¾....fractio­n, three-fourths Alt + 0215 ....×.....multi­plication sign Alt + 0162...¢....the cent sign Alt + 0161.....¡..... .upside down exclamation point Alt + 0191.....¿..... ­upside down question mark Alt + 1...........smiley face Alt + 2 ......☻.....bla­ck smiley face Alt + 15.....☼.....su­n Alt + 12......♀.....f emale sign Alt + 11.....♂......m­ale sign Alt + 6....... ♠ .....s­pade Alt + 5....... ♣ ...... ­Club Alt + 3............. ­Heart Alt + 4....... ♦ ...... ­Diamond Alt + 13......♪.....e­ighth note Alt + 14......♫...... ­beamed eighth note Alt + 8721.... ∑.... N-ary summation (auto sum) Alt + 251.....√.....s­quare root check mark Alt + 8236.....∞..... ­infinity Alt + 24.......↑..... ­up arrow Alt + 25......↓...... ­down arrow...
Read more

Don't Trust the '‪#‎Windows‬ 10 Free Update' Email, Warns Cisco

Image
Microsoft released Windows 10 in 190 countries earlier this week. The latest desktop operating system from the company has attracted millions of users already, including unfortunately, some fraudsters as well. A new ransomware has started to circulate in the wild which attempts to fool users into downloading and installing malware instead. Cisco, best known for designing and manufacturing network equipment, is wa rning users about a new phishing attack that tricks users into installing malware that then asks for ransom. The email comes disguised as an official release from Microsoft with subject 'Windows 10 Free Update'. The sophistication of the attack is worrisome too. The email states to be coming from update [at] Microsoft and uses the same colour and font scheme as used by the company. This could trick many into believing that the email is legitimate. But as Cisco points out, the origination of email as well as some minor inconsistencies in the wording and f...
Read more

Microsoft issues warning to 800 million Windows 10 users

Image
Microsoft's  Windows 10 OS issues and problems  has been facing multiple problems in recent months. In a latest development, Microsoft has now released an important new  Windows 10 warning  to 800 million users.  The company has identified a serious and long-running bug on its OS platform. The bug is more of a problem that was inadvertently introduced through design implementations. Microsoft has admitted to quietly switching off Registry backups in Windows 10. It has been observed that Registry backups would randomly show that backup operation has been completed despite no backup file being created.  For users and businesses, Registry Backups are extremely important, as they are the last line of defense. If the Windows System Restore point fail, the registry backup is the only option for users. According to Microsoft, "Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder. If you browse ...
Read more