4 ms·

It would be incredible to learn how many have actually been affected by this issue in that past ~15 years... how important is SSL validation to those able to bl

It would be incredible to learn how many have actually been affected by this issue in that past ~15 years... how important is SSL validation to those able to blend in with the crowd even on the sketchy-ish side of the internet? So much "just works" because no one is paying attention. Of course now that the spotlight is on the issue it's all downhill from here for anyone who doesn't [auto-]update.

userbinator 2y ago
It would be incredible to learn how many have actually been affected by this issue in that past ~15 years IMHO close to 0 --- and for those who were affected, it would've likely been a targeted attack.
dgfitz 2y ago
I had the exact same thought. Actually having the data seems almost impossible, it sure would be fun to see.
0x457 2y ago
Probably zero? That thing was reposible for downloading python from python.org. It's possible to exploit, but would need to be pretty targeted and would require already some access to the target[1]. [1]: Because only other way to exploit it would be noticed by everyone else. Like python.org domain would need to be hijacked or something similar.
- mcmcmc 2y ago
  You don’t need to hijack the whole domain to poison DNS for a given client
  - 0x457 2y ago
    Yes, that's what I meant by other way requires _some_ access to the target.
- crtasm 2y ago
  It makes a MITM attack possible, that doesn't require access to the target or the website it's contacting. I'd still guess zero times though.
  - deleted 2y ago
    [deleted]
  - account42 2y ago
    A MITM attack requires some kind of access to the target or the server. You can't just intercept connections of whoever you want on the Internet.
    - crtasm 2y ago
      You need to be a hop on the route the data takes yes, but access to the source or destination machine is not a necessity.
- TheDong 2y ago
  The "some access to the target" bit could just being on the same unsecure wifi network as them, such as a coffee shop or library. Still, I doubt anyone noticed this, and you'd also still need the victim to use qBittorrent and go through this flow that downloads python. Zero seems pretty likely, yeah.
  - IshKebab 2y ago
    Does ARP spoofing still actually work? I would have assumed that modern routers block it. Still the easiest way to MitM random people is to set up your own free WiFi. I've done that in the past, and it works, but HSTS and certificate caching mean it's pretty useless. I think there's a kind of vaccination effect - nobody is going to put much effort into MitMs because it's useless most of the time, so it isn't as critical when people don't validate certificates.
  - 0x457 2y ago
    > The "some access to the target" bit could just being on the same unsecure wifi network as them, such as a coffee shop or library. Fucking hell, how often do you use torrents in coffee shops let alone install new torrent client while you're at it? Any public wifi network setup not by a complete idiot today has fully isolated clients.
- sneak 2y ago
  No. The lack of certificate checking means anyone with access to the network in between; a rogue AP is sufficient.
  - 0x457 2y ago
    If you're connecting to a rogue AP, then you are already lost.
    - detaro 2y ago
      Only if software you use is badly broken, like QBittorrent here. For the majority of applications today, a rogue AP can't do much interesting that won't immediately cause alerts.
- baobun 2y ago
  That is an extremely naive take. https://news.ycombinator.com/item?id=37961166 https://news.ycombinator.com/item?id=37961166 Read this and tell me if you really think it unlikely that whoever performed the mitm there wouldn't be able to or interested enough in doing similar things to known seedbox hosts, distributors, or just whoever is distributing information they'd rather not be. Qbittorrent is one of the most be popular choices for hosted bittorrent seeders across the world. This was trivially exploitable for anyone with access to the right network path for >10years. Sure it'd have to be targeted to qbittorrent users but I don't think much individual targeting is needed if you aim for dozens, hundreds, thousands, or just as many as you can of them. Besides sketchy government-related entities with legal wiretapping capabilities, you also have well-funded private interest groups on the malicious side.
  - ndriscoll 2y ago
    Are hosted servers typically running Windows? The Linux version doesn't download Python (generally your package manager would do that). I would expect updates to qbittorrent are also handled by the package manager on Linux.
    - duskwuff 2y ago
      > Are hosted servers typically running Windows? Generally not. Seedbox services are heavily cost-driven; running a Windows install for each client would add a lot of unnecessary hardware and licensing costs.
  - 0x457 2y ago
    First of all those are linux boxes that not effected by this. Second, attacker here had a valid certificate, it was only noticed when certificate expired (so 6 months after, since it was LE cert). > Besides sketchy government-related entities with legal wiretapping capabilities, you also have well-funded private interest groups on the malicious side. If you're targeted by goverment-related entities you probably shouldn't run windows and torrent software.
- ndsipa_pomu 2y ago
  It's perfectly feasible for someone to set up a poisoned DNS in a place like an airport or a coffee shop and MITM anyone who's not using a VPN etc.
  - 0x457 2y ago
    Yes, I fucking love going to the coffee shop and airport, then proceed to download QBitTorrent do download some linux ISOs. Because those places always have highly reliable WiFi, high speed and definetly not filtering traffic.
    - ndsipa_pomu 2y ago
      Fine strawman you're building there. My comment was about Python.org and I think that it wouldn't be unusual for a student to start doing some work in a coffee shop and get MITMd. However, it'd be quite easy for someone to have setup QBitTorrent to auto-start on their laptop and then to forget about it when they're doing something else at an airport, coffee shop or other place where you would expect to use someone's wifi. Note that it doesn't even have to be wifi setup by the business - it could be a bad actor setting up an access point that just looks like it belongs there.
    - eptcyka 2y ago
      You wouldn’t download QBitTorrent, you would use QBitTorrent on unsafe networks, which is not far fetched at all.
      - duskwuff 2y ago
        But ordinary use of qBitTorrent is fine. The only part with a clear path to code execution (assuming MITM and no certificate verification) is the initial install of Python - which is only required for certain features, only installs once, and requires user confirmation to start.
      - 0x457 2y ago
        The download with unverified certificate only triggered on windows if there isn't "good enough" version of python installed. If it's already installed then nothing needs to be downloaded. Again, this vulnerability can't exploited unless attacker is able MitM you or python.org is hijacked. It's very hard to exploit in real-life en-masse. Targeted attack is possible, but it requires attacker to: 1) Be able to do MitM in the first place 2) You need to use qBitTorrent 3) You need to use Windows 4) You must not have python version installed that supported by qBitTorrent Without all 4 this can't be exploited.
sieabahlpark 2y ago
I think torrenting is one of those things that people understand is sketchy without it actually being sketchy. People also don't just leave it open forever, there usually leeching or seeding and then close the program when it's done. You're probably more likely to get a virus from the pirates exe. (Save me the reply that explains you can use torrenting legally, I already know.)
- IshKebab 2y ago
  Yeah I've been surprised by how unsketchy torrenting is compared to how sketchy it should be. You'd think even just for videos, there must be absolutely tons of RCEs in VLC or whatever. Yet I've never seen one actually used.
- sixothree 2y ago
  I needed to get a 100+ gb image to a coworker remote once and after fighting with it for a while we just said screw it and created a torrent. No third parties. No relays. Just us. Worked well enough then we promptly forgot how to do it again when we needed it.
  - Aerroon 2y ago
    I've run into the same problem: if you want to share large files to a friend you need to either find a filehost that accepts very large files or use torrents (maybe something like irc transfer works too).
    - johnisgood 2y ago
      IRC transfer? I hope you are not referring to DCC. :P
      - Aerroon 2y ago
        I am
      - pbhjpbhj 2y ago
nubinetwork 2y ago
/shrug I use a web browser for web browser stuff... and I'll only open a torrent application when I want to download a manually downloaded .torrent file.
- basilgohar 2y ago
  Torrents can use webseeds, which results in an HTTP request. Torrenting now includes HTTP requests as a result.
result2vino 2y ago
Also chiming in to say…zero. A lot of this post feels…trumped up. There’s certainly something there, but “qBittorrent RCE”, whilst technically true, is alarmist.

userbinator 2y ago

It would be incredible to learn how many have actually been affected by this issue in that past ~15 years IMHO close to 0 --- and for those who were affected, it would've likely been a targeted attack.

dgfitz 2y ago

I had the exact same thought. Actually having the data seems almost impossible, it sure would be fun to see.

0x457 2y ago

Probably zero? That thing was reposible for downloading python from python.org. It's possible to exploit, but would need to be pretty targeted and would require already some access to the target[1]. [1]: Because only other way to exploit it would be noticed by everyone else. Like python.org domain would need to be hijacked or something similar.

mcmcmc 2y ago
You don’t need to hijack the whole domain to poison DNS for a given client
- 0x457 2y ago
  Yes, that's what I meant by other way requires _some_ access to the target.
crtasm 2y ago
It makes a MITM attack possible, that doesn't require access to the target or the website it's contacting. I'd still guess zero times though.
- deleted 2y ago
  [deleted]
- account42 2y ago
  A MITM attack requires some kind of access to the target or the server. You can't just intercept connections of whoever you want on the Internet.
  - crtasm 2y ago
    You need to be a hop on the route the data takes yes, but access to the source or destination machine is not a necessity.
TheDong 2y ago
The "some access to the target" bit could just being on the same unsecure wifi network as them, such as a coffee shop or library. Still, I doubt anyone noticed this, and you'd also still need the victim to use qBittorrent and go through this flow that downloads python. Zero seems pretty likely, yeah.
- IshKebab 2y ago
  Does ARP spoofing still actually work? I would have assumed that modern routers block it. Still the easiest way to MitM random people is to set up your own free WiFi. I've done that in the past, and it works, but HSTS and certificate caching mean it's pretty useless. I think there's a kind of vaccination effect - nobody is going to put much effort into MitMs because it's useless most of the time, so it isn't as critical when people don't validate certificates.
- 0x457 2y ago
  > The "some access to the target" bit could just being on the same unsecure wifi network as them, such as a coffee shop or library. Fucking hell, how often do you use torrents in coffee shops let alone install new torrent client while you're at it? Any public wifi network setup not by a complete idiot today has fully isolated clients.
sneak 2y ago
No. The lack of certificate checking means anyone with access to the network in between; a rogue AP is sufficient.
- 0x457 2y ago
  If you're connecting to a rogue AP, then you are already lost.
  - detaro 2y ago
    Only if software you use is badly broken, like QBittorrent here. For the majority of applications today, a rogue AP can't do much interesting that won't immediately cause alerts.
baobun 2y ago
That is an extremely naive take. https://news.ycombinator.com/item?id=37961166 https://news.ycombinator.com/item?id=37961166 Read this and tell me if you really think it unlikely that whoever performed the mitm there wouldn't be able to or interested enough in doing similar things to known seedbox hosts, distributors, or just whoever is distributing information they'd rather not be. Qbittorrent is one of the most be popular choices for hosted bittorrent seeders across the world. This was trivially exploitable for anyone with access to the right network path for >10years. Sure it'd have to be targeted to qbittorrent users but I don't think much individual targeting is needed if you aim for dozens, hundreds, thousands, or just as many as you can of them. Besides sketchy government-related entities with legal wiretapping capabilities, you also have well-funded private interest groups on the malicious side.
- ndriscoll 2y ago
  Are hosted servers typically running Windows? The Linux version doesn't download Python (generally your package manager would do that). I would expect updates to qbittorrent are also handled by the package manager on Linux.
  - duskwuff 2y ago
    > Are hosted servers typically running Windows? Generally not. Seedbox services are heavily cost-driven; running a Windows install for each client would add a lot of unnecessary hardware and licensing costs.
- 0x457 2y ago
  First of all those are linux boxes that not effected by this. Second, attacker here had a valid certificate, it was only noticed when certificate expired (so 6 months after, since it was LE cert). > Besides sketchy government-related entities with legal wiretapping capabilities, you also have well-funded private interest groups on the malicious side. If you're targeted by goverment-related entities you probably shouldn't run windows and torrent software.
ndsipa_pomu 2y ago
It's perfectly feasible for someone to set up a poisoned DNS in a place like an airport or a coffee shop and MITM anyone who's not using a VPN etc.
- 0x457 2y ago
  Yes, I fucking love going to the coffee shop and airport, then proceed to download QBitTorrent do download some linux ISOs. Because those places always have highly reliable WiFi, high speed and definetly not filtering traffic.
  - ndsipa_pomu 2y ago
    Fine strawman you're building there. My comment was about Python.org and I think that it wouldn't be unusual for a student to start doing some work in a coffee shop and get MITMd. However, it'd be quite easy for someone to have setup QBitTorrent to auto-start on their laptop and then to forget about it when they're doing something else at an airport, coffee shop or other place where you would expect to use someone's wifi. Note that it doesn't even have to be wifi setup by the business - it could be a bad actor setting up an access point that just looks like it belongs there.
  - eptcyka 2y ago
    You wouldn’t download QBitTorrent, you would use QBitTorrent on unsafe networks, which is not far fetched at all.
    - duskwuff 2y ago
      But ordinary use of qBitTorrent is fine. The only part with a clear path to code execution (assuming MITM and no certificate verification) is the initial install of Python - which is only required for certain features, only installs once, and requires user confirmation to start.
    - 0x457 2y ago
      The download with unverified certificate only triggered on windows if there isn't "good enough" version of python installed. If it's already installed then nothing needs to be downloaded. Again, this vulnerability can't exploited unless attacker is able MitM you or python.org is hijacked. It's very hard to exploit in real-life en-masse. Targeted attack is possible, but it requires attacker to: 1) Be able to do MitM in the first place 2) You need to use qBitTorrent 3) You need to use Windows 4) You must not have python version installed that supported by qBitTorrent Without all 4 this can't be exploited.

sieabahlpark 2y ago

I think torrenting is one of those things that people understand is sketchy without it actually being sketchy. People also don't just leave it open forever, there usually leeching or seeding and then close the program when it's done. You're probably more likely to get a virus from the pirates exe. (Save me the reply that explains you can use torrenting legally, I already know.)

IshKebab 2y ago
Yeah I've been surprised by how unsketchy torrenting is compared to how sketchy it should be. You'd think even just for videos, there must be absolutely tons of RCEs in VLC or whatever. Yet I've never seen one actually used.
sixothree 2y ago
I needed to get a 100+ gb image to a coworker remote once and after fighting with it for a while we just said screw it and created a torrent. No third parties. No relays. Just us. Worked well enough then we promptly forgot how to do it again when we needed it.
- Aerroon 2y ago
  I've run into the same problem: if you want to share large files to a friend you need to either find a filehost that accepts very large files or use torrents (maybe something like irc transfer works too).
  - johnisgood 2y ago
    IRC transfer? I hope you are not referring to DCC. :P
    - Aerroon 2y ago
      I am
    - pbhjpbhj 2y ago

nubinetwork 2y ago

/shrug I use a web browser for web browser stuff... and I'll only open a torrent application when I want to download a manually downloaded .torrent file.

basilgohar 2y ago
Torrents can use webseeds, which results in an HTTP request. Torrenting now includes HTTP requests as a result.

result2vino 2y ago

Also chiming in to say…zero. A lot of this post feels…trumped up. There’s certainly something there, but “qBittorrent RCE”, whilst technically true, is alarmist.