Comment by duskwuff | Hacker News Reader

Comment by duskwuff | Hacker News Reader

Parent Full thread

This seems a little overblown, especially towards the later points.

> 1. Malicious Executable loader with stealth functionality

TL;DR the client downloads Python from python.org over HTTPS. This isn't great (especially since it's hard-coded to 3.12.4), but there's no obvious exploit path which doesn't involve both MITM and user interaction.

> 2. Browser Hijacking + Executable Download (Software Upgrade Context)

TL;DR the client downloads an RSS file over HTTPS and will conditionally prompt the user to open a URL found in that file. This is even lower risk than #1; even if you can MITM the user and get them to click "update", all you get to do with that is show the user a web page.

> 3. RSS Feeds (Arbitrary URL injection)

The researcher seems confused by the expected behavior of an RSS client.

> 4. Decompression library attack surface (0-click)

If you can find an exploit in zlib, there are much worse things you can do with that than attacking a torrent client. Decompressing input is assumed to be safe by default.

> If you can find an exploit in zlib, there are much worse things you can do with that than attacking a torrent client. Decompressing input is assumed to be safe by default.

Any (e.g. http) server supporting stream compression comes to mind.

Or, on the client side, any software that uses libpng to render PNG images (since that's using deflate on the inside). There's probably even more direct exploits against qbittorrent than MITMing the GeoIP database download.

Yep. I hate to be this negative, but…Christ, security ‘researchers’ will really grasp at the most remote straws for a bit of notoriety. I’d respect this more if it were documented honestly. How it’s been done here however has just left me rolling my eyes.

Those are minor if certificates errors are not ignored.

Since the original issue is that the ssl errors are ignored, then all those https downloads are downgraded to http downloads in practice (no need to mitm to attack).

Or to say it another way, due to ignoring ssl errors, all those https urls were giving a wrong sense of security as reviewers would think them secure when they were not (due to lack of validation of ssl).

You still need to MITM the connection though. I think this is more of a risk if you live in dictatorship states, but even a rogue ISP or Wi-Fi hotspot would do. So yeah, definitely not theoretical.

I agree. Calling this a "RCE Vulnerability" is ridiculously exaggerated.

What's next, are we going to declare web browsers to have a "RCE Vulnerability" because they allow you to download programs from any site which may or may not be secure and then execute them?

Or, hey everyone, did you know that if you live in an authoritarian state, the Government can do bad things to you?

Reply on news.ycombinator.com