Hacker News Reader

Comment by password4321 | Hacker News Reader

It would be incredible to learn how many have actually been affected by this issue in that past ~15 years... how important is SSL validation to those able to blend in with the crowd even on the sketchy-ish side of the internet?

So much "just works" because no one is paying attention. Of course now that the spotlight is on the issue it's all downhill from here for anyone who doesn't [auto-]update.

View on HN

Probably zero? That thing was reposible for downloading python from python.org. It's possible to exploit, but would need to be pretty targeted and would require already some access to the target[1].

[1]: Because only other way to exploit it would be noticed by everyone else. Like python.org domain would need to be hijacked or something similar.

You don’t need to hijack the whole domain to poison DNS for a given client

Yes, that's what I meant by other way requires _some_ access to the target.

It makes a MITM attack possible, that doesn't require access to the target or the website it's contacting.

I'd still guess zero times though.

A MITM attack requires some kind of access to the target or the server. You can't just intercept connections of whoever you want on the Internet.

You need to be a hop on the route the data takes yes, but access to the source or destination machine is not a necessity.

The "some access to the target" bit could just being on the same unsecure wifi network as them, such as a coffee shop or library.

Still, I doubt anyone noticed this, and you'd also still need the victim to use qBittorrent and go through this flow that downloads python.

Zero seems pretty likely, yeah.

Does ARP spoofing still actually work? I would have assumed that modern routers block it.

Still the easiest way to MitM random people is to set up your own free WiFi. I've done that in the past, and it works, but HSTS and certificate caching mean it's pretty useless.

I think there's a kind of vaccination effect - nobody is going to put much effort into MitMs because it's useless most of the time, so it isn't as critical when people don't validate certificates.

> The "some access to the target" bit could just being on the same unsecure wifi network as them, such as a coffee shop or library.

Fucking hell, how often do you use torrents in coffee shops let alone install new torrent client while you're at it?

Any public wifi network setup not by a complete idiot today has fully isolated clients.

No. The lack of certificate checking means anyone with access to the network in between; a rogue AP is sufficient.

If you're connecting to a rogue AP, then you are already lost.

Only if software you use is badly broken, like QBittorrent here. For the majority of applications today, a rogue AP can't do much interesting that won't immediately cause alerts.

That is an extremely naive take.

https://news.ycombinator.com/item?id=37961166

Read this and tell me if you really think it unlikely that whoever performed the mitm there wouldn't be able to or interested enough in doing similar things to known seedbox hosts, distributors, or just whoever is distributing information they'd rather not be.

Qbittorrent is one of the most be popular choices for hosted bittorrent seeders across the world. This was trivially exploitable for anyone with access to the right network path for >10years. Sure it'd have to be targeted to qbittorrent users but I don't think much individual targeting is needed if you aim for dozens, hundreds, thousands, or just as many as you can of them.

Besides sketchy government-related entities with legal wiretapping capabilities, you also have well-funded private interest groups on the malicious side.

Are hosted servers typically running Windows? The Linux version doesn't download Python (generally your package manager would do that). I would expect updates to qbittorrent are also handled by the package manager on Linux.

> Are hosted servers typically running Windows?

Generally not. Seedbox services are heavily cost-driven; running a Windows install for each client would add a lot of unnecessary hardware and licensing costs.

First of all those are linux boxes that not effected by this.

Second, attacker here had a valid certificate, it was only noticed when certificate expired (so 6 months after, since it was LE cert).

> Besides sketchy government-related entities with legal wiretapping capabilities, you also have well-funded private interest groups on the malicious side.

If you're targeted by goverment-related entities you probably shouldn't run windows and torrent software.

It's perfectly feasible for someone to set up a poisoned DNS in a place like an airport or a coffee shop and MITM anyone who's not using a VPN etc.

Yes, I fucking love going to the coffee shop and airport, then proceed to download QBitTorrent do download some linux ISOs. Because those places always have highly reliable WiFi, high speed and definetly not filtering traffic.

Fine strawman you're building there.

My comment was about Python.org and I think that it wouldn't be unusual for a student to start doing some work in a coffee shop and get MITMd.

However, it'd be quite easy for someone to have setup QBitTorrent to auto-start on their laptop and then to forget about it when they're doing something else at an airport, coffee shop or other place where you would expect to use someone's wifi. Note that it doesn't even have to be wifi setup by the business - it could be a bad actor setting up an access point that just looks like it belongs there.

You wouldn’t download QBitTorrent, you would use QBitTorrent on unsafe networks, which is not far fetched at all.

But ordinary use of qBitTorrent is fine. The only part with a clear path to code execution (assuming MITM and no certificate verification) is the initial install of Python - which is only required for certain features, only installs once, and requires user confirmation to start.

The download with unverified certificate only triggered on windows if there isn't "good enough" version of python installed. If it's already installed then nothing needs to be downloaded.

Again, this vulnerability can't exploited unless attacker is able MitM you or python.org is hijacked.

It's very hard to exploit in real-life en-masse. Targeted attack is possible, but it requires attacker to:

1) Be able to do MitM in the first place

2) You need to use qBitTorrent

3) You need to use Windows

4) You must not have python version installed that supported by qBitTorrent

Without all 4 this can't be exploited.

It would be incredible to learn how many have actually been affected by this issue in that past ~15 years

IMHO close to 0 --- and for those who were affected, it would've likely been a targeted attack.

Also chiming in to say…zero. A lot of this post feels…trumped up. There’s certainly something there, but “qBittorrent RCE”, whilst technically true, is alarmist.

/shrug

I use a web browser for web browser stuff... and I'll only open a torrent application when I want to download a manually downloaded .torrent file.

Torrents can use webseeds, which results in an HTTP request. Torrenting now includes HTTP requests as a result.

I had the exact same thought. Actually having the data seems almost impossible, it sure would be fun to see.

I think torrenting is one of those things that people understand is sketchy without it actually being sketchy. People also don't just leave it open forever, there usually leeching or seeding and then close the program when it's done. You're probably more likely to get a virus from the pirates exe. (Save me the reply that explains you can use torrenting legally, I already know.)

Yeah I've been surprised by how unsketchy torrenting is compared to how sketchy it should be. You'd think even just for videos, there must be absolutely tons of RCEs in VLC or whatever. Yet I've never seen one actually used.

I needed to get a 100+ gb image to a coworker remote once and after fighting with it for a while we just said screw it and created a torrent. No third parties. No relays. Just us.

Worked well enough then we promptly forgot how to do it again when we needed it.

I've run into the same problem: if you want to share large files to a friend you need to either find a filehost that accepts very large files or use torrents (maybe something like irc transfer works too).

IRC transfer? I hope you are not referring to DCC. :P

I am

IRC transfer being some form of InfraRed Communication.

And DCC being Direct Cable Connection.

File transfers on IRC are via DCC[1] (Direct Client-to-Client Protocol)

S/He did reply "I am" though.

That said, I think torrents are still a great way to share files, perhaps IPFS[2]. I use LocalSend[3], too, at times, although not for large files.

[1] https://modern.ircdocs.horse/dcc.html

[2] https://ipfs.tech/

[3] https://localsend.org

I've done this with friends/family a couple times and wrote up a tutorial that I use as reference every couple months.

Has an optional step to password-protect the contents if you have any qualms with security-by-obscurity of using an unlisted torrent on a public tracker.

https://loganhood.com/2023/12/14/everyday-7zip-bittorrent

Reply on news.ycombinator.com