10 ms·

Major torrent sites are currently exposing details of their operations?

loufe 4y ago
Somehow soothing to know that organizations small and large, legal and illegal, all suffer from something getting in the way of vital security information reaching those who would act on it.
komali2 4y ago
Why would ISPs bother to serve torrents and join pools to get IPs that way when they can just use this method? I wonder how long this has been a possibility... ugh
- TechBro8615 4y ago
  Wait til you hear about the DHT!
- sturmeh 4y ago
  Just go to https://iknowwhatyoudownload.com/en/peer/ https://iknowwhatyoudownload.com/en/peer/ and put anyones IP in, depending on how static it is, it will provide at least accurate recent data on public trackers.
jacooper 4y ago
I still don't understand what's going on
- loeg 4y ago
  It’s a lot of words to say almost nothing.
- colechristensen 4y ago
  There’s an exploit in the wild that can extract information from some torrent trackers.
- timmytokyo 4y ago
  Torrentfreak's writers are not very good at writing.
Manuel_D 4y ago
> Another screenshot featuring a torrent related to a 2022 movie reveals the URL of yet another third-party supplier tracker. Some basic queries on that URL lead to even more torrent sites. And from there, more, and more, and more – revealing torrent passkeys for every single one on the way. What is this torrent passkey used for? My understanding is that torrent trackers were all about sharing peers. You want tracker info to spread. I'm not understanding what this vulnerability exposes. Edit: It looks like it's actually explained earlier: > One begins with a GET request to another tracker, which responds with a torrent file. It’s then uploaded to the requesting site which updates its SQL database accordingly. > From there the script starts checking for any new entries on a specific RSS feed which is hidden away on another site that has nothing to do with torrents. The feed is protected with a passkey but that’s only useful when nobody knows what it is. > The same security hole also grants direct access to one of the sites tracker ‘bots’ through the panel that controls it. So I think the issue is that keys to authorize control of the automated software to propagate tracker info is being leaked. It sounds like the end result is someone can write spoofed or spam info into torrent trackers.
- martinald 4y ago
  Some torrent sites have ratios, eg you must upload as much as you download. The passkey allows the tracker to keep track of what you've uploaded and downloaded for your ratio. These torrents also have peer discovery and DHT disabled on private trackers.
  - Manuel_D 4y ago
    Whatever, I was never a fan of private trackers anyway. The whole point of P2P is that it's power scales with more users.
    - lfodofod 4y ago
      This is not correct, swarms on good private sites are way better than on public trackers. With real world torrent clients, you’d much rather have a swarm with 100 dedicated servers on 1gbps+ connections than a swarm with a million Indian residential connections.
lfodofod 4y ago
None of these are major (private) torrent sites, torrentfreak is just hyping up bullshit as usual. Just looking at the filenames makes it obvious that these can’t be from any major private tracker, there’s no way BTN or the likes would accept these files.
- deleted 4y ago
  [deleted]
- greenhorn360 4y ago
  What about the filenames tells you that?
  - 312c 4y ago
    The fact they're XviD, no respectable torrent sites have allowed those encodes in well over half a decade.
    - xcdzvyn 4y ago
      I must be using all the wrong torrent sites :-)
Dalewyn 4y ago
Tracker URLs have always been plainly visible to anyone (or anything) that has the torrent file, what exactly is the news here?
- pessimizer 4y ago
  That networks of trackers and their operations are being exposed in realtime. This isn't a security issue for tracker users, it's a security issue for the trackers themselves. It's very very bad, I don't know why people are making light of it. Also, the trackers have reacted and are fixing their management panel configs as we comment, so the story is accomplishing something.
  - Dalewyn 4y ago
    Again, tracker URLs are public information. Including seemingly secret things like passkeys. So again I ask: What is the problem? The article does a fucking terrible job explaining what the problem is. All I can take away is that public information is being passed around in public. That is a problem how?
    - russelg 4y ago
      The problem is that these administration tools were completely publicly accessible if you knew the URL. Yes, if you've got a torrent file from a site, you know the tracker URL and (your own) passkey. The issue here is someone could get the passkey that the admin tool uses to snatch from other private trackers. If you can't see how that is an issue I have no words that can make that more clear for you.
      - Dalewyn 4y ago
        The article only ever talked about the contents of torrent files, so I hope you can understand my confusion. Yes, if the management tools were open to the public when they shouldn't have been then that is a big problem.
pessimizer 4y ago
I think people are not understanding this story. This is a story about trackers who share content between them, not about users. The semi-open management panels expose networks of people who are working with each other to do something that is legally frowned upon.
luckylion 4y ago
It's about the IPT mafia, isn't it?
- lfodofod 4y ago
  No, this appears to be some even less relevant (hard to imagine, amirite?) trackers stealing content from IPT.

Somehow soothing to know that organizations small and large, legal and illegal, all suffer from something getting in the way of vital security information reaching those who would act on it.

komali2 4y ago

Why would ISPs bother to serve torrents and join pools to get IPs that way when they can just use this method? I wonder how long this has been a possibility... ugh

TechBro8615 4y ago
Wait til you hear about the DHT!
sturmeh 4y ago
Just go to https://iknowwhatyoudownload.com/en/peer/ https://iknowwhatyoudownload.com/en/peer/ and put anyones IP in, depending on how static it is, it will provide at least accurate recent data on public trackers.

jacooper 4y ago

I still don't understand what's going on

loeg 4y ago
It’s a lot of words to say almost nothing.
colechristensen 4y ago
There’s an exploit in the wild that can extract information from some torrent trackers.
timmytokyo 4y ago
Torrentfreak's writers are not very good at writing.

Manuel_D 4y ago

> Another screenshot featuring a torrent related to a 2022 movie reveals the URL of yet another third-party supplier tracker. Some basic queries on that URL lead to even more torrent sites. And from there, more, and more, and more – revealing torrent passkeys for every single one on the way. What is this torrent passkey used for? My understanding is that torrent trackers were all about sharing peers. You want tracker info to spread. I'm not understanding what this vulnerability exposes. Edit: It looks like it's actually explained earlier: > One begins with a GET request to another tracker, which responds with a torrent file. It’s then uploaded to the requesting site which updates its SQL database accordingly. > From there the script starts checking for any new entries on a specific RSS feed which is hidden away on another site that has nothing to do with torrents. The feed is protected with a passkey but that’s only useful when nobody knows what it is. > The same security hole also grants direct access to one of the sites tracker ‘bots’ through the panel that controls it. So I think the issue is that keys to authorize control of the automated software to propagate tracker info is being leaked. It sounds like the end result is someone can write spoofed or spam info into torrent trackers.

martinald 4y ago
Some torrent sites have ratios, eg you must upload as much as you download. The passkey allows the tracker to keep track of what you've uploaded and downloaded for your ratio. These torrents also have peer discovery and DHT disabled on private trackers.
- Manuel_D 4y ago
  Whatever, I was never a fan of private trackers anyway. The whole point of P2P is that it's power scales with more users.
  - lfodofod 4y ago
    This is not correct, swarms on good private sites are way better than on public trackers. With real world torrent clients, you’d much rather have a swarm with 100 dedicated servers on 1gbps+ connections than a swarm with a million Indian residential connections.

lfodofod 4y ago

None of these are major (private) torrent sites, torrentfreak is just hyping up bullshit as usual. Just looking at the filenames makes it obvious that these can’t be from any major private tracker, there’s no way BTN or the likes would accept these files.

deleted 4y ago
[deleted]
greenhorn360 4y ago
What about the filenames tells you that?
- 312c 4y ago
  The fact they're XviD, no respectable torrent sites have allowed those encodes in well over half a decade.
  - xcdzvyn 4y ago
    I must be using all the wrong torrent sites :-)

Dalewyn 4y ago

Tracker URLs have always been plainly visible to anyone (or anything) that has the torrent file, what exactly is the news here?

pessimizer 4y ago
That networks of trackers and their operations are being exposed in realtime. This isn't a security issue for tracker users, it's a security issue for the trackers themselves. It's very very bad, I don't know why people are making light of it. Also, the trackers have reacted and are fixing their management panel configs as we comment, so the story is accomplishing something.
- Dalewyn 4y ago
  Again, tracker URLs are public information. Including seemingly secret things like passkeys. So again I ask: What is the problem? The article does a fucking terrible job explaining what the problem is. All I can take away is that public information is being passed around in public. That is a problem how?
  - russelg 4y ago
    The problem is that these administration tools were completely publicly accessible if you knew the URL. Yes, if you've got a torrent file from a site, you know the tracker URL and (your own) passkey. The issue here is someone could get the passkey that the admin tool uses to snatch from other private trackers. If you can't see how that is an issue I have no words that can make that more clear for you.
    - Dalewyn 4y ago
      The article only ever talked about the contents of torrent files, so I hope you can understand my confusion. Yes, if the management tools were open to the public when they shouldn't have been then that is a big problem.

pessimizer 4y ago

I think people are not understanding this story. This is a story about trackers who share content between them, not about users. The semi-open management panels expose networks of people who are working with each other to do something that is legally frowned upon.

luckylion 4y ago

It's about the IPT mafia, isn't it?

lfodofod 4y ago
No, this appears to be some even less relevant (hard to imagine, amirite?) trackers stealing content from IPT.