3 ms·

Probably zero? That thing was reposible for downloading python from python.org. It's possible to exploit, but would need to be pretty targeted and would require

by 0x457 2y ago

Probably zero? That thing was reposible for downloading python from python.org. It's possible to exploit, but would need to be pretty targeted and would require already some access to the target[1]. [1]: Because only other way to exploit it would be noticed by everyone else. Like python.org domain would need to be hijacked or something similar.

mcmcmc 2y ago
You don’t need to hijack the whole domain to poison DNS for a given client
- 0x457 2y ago
  Yes, that's what I meant by other way requires _some_ access to the target.
crtasm 2y ago
It makes a MITM attack possible, that doesn't require access to the target or the website it's contacting. I'd still guess zero times though.
- deleted 2y ago
  [deleted]
- account42 2y ago
  A MITM attack requires some kind of access to the target or the server. You can't just intercept connections of whoever you want on the Internet.
  - crtasm 2y ago
    You need to be a hop on the route the data takes yes, but access to the source or destination machine is not a necessity.
TheDong 2y ago
The "some access to the target" bit could just being on the same unsecure wifi network as them, such as a coffee shop or library. Still, I doubt anyone noticed this, and you'd also still need the victim to use qBittorrent and go through this flow that downloads python. Zero seems pretty likely, yeah.
- IshKebab 2y ago
  Does ARP spoofing still actually work? I would have assumed that modern routers block it. Still the easiest way to MitM random people is to set up your own free WiFi. I've done that in the past, and it works, but HSTS and certificate caching mean it's pretty useless. I think there's a kind of vaccination effect - nobody is going to put much effort into MitMs because it's useless most of the time, so it isn't as critical when people don't validate certificates.
- 0x457 2y ago
  > The "some access to the target" bit could just being on the same unsecure wifi network as them, such as a coffee shop or library. Fucking hell, how often do you use torrents in coffee shops let alone install new torrent client while you're at it? Any public wifi network setup not by a complete idiot today has fully isolated clients.
sneak 2y ago
No. The lack of certificate checking means anyone with access to the network in between; a rogue AP is sufficient.
- 0x457 2y ago
  If you're connecting to a rogue AP, then you are already lost.
  - detaro 2y ago
    Only if software you use is badly broken, like QBittorrent here. For the majority of applications today, a rogue AP can't do much interesting that won't immediately cause alerts.
baobun 2y ago
That is an extremely naive take. https://news.ycombinator.com/item?id=37961166 https://news.ycombinator.com/item?id=37961166 Read this and tell me if you really think it unlikely that whoever performed the mitm there wouldn't be able to or interested enough in doing similar things to known seedbox hosts, distributors, or just whoever is distributing information they'd rather not be. Qbittorrent is one of the most be popular choices for hosted bittorrent seeders across the world. This was trivially exploitable for anyone with access to the right network path for >10years. Sure it'd have to be targeted to qbittorrent users but I don't think much individual targeting is needed if you aim for dozens, hundreds, thousands, or just as many as you can of them. Besides sketchy government-related entities with legal wiretapping capabilities, you also have well-funded private interest groups on the malicious side.
- ndriscoll 2y ago
  Are hosted servers typically running Windows? The Linux version doesn't download Python (generally your package manager would do that). I would expect updates to qbittorrent are also handled by the package manager on Linux.
  - duskwuff 2y ago
    > Are hosted servers typically running Windows? Generally not. Seedbox services are heavily cost-driven; running a Windows install for each client would add a lot of unnecessary hardware and licensing costs.
- 0x457 2y ago
  First of all those are linux boxes that not effected by this. Second, attacker here had a valid certificate, it was only noticed when certificate expired (so 6 months after, since it was LE cert). > Besides sketchy government-related entities with legal wiretapping capabilities, you also have well-funded private interest groups on the malicious side. If you're targeted by goverment-related entities you probably shouldn't run windows and torrent software.
ndsipa_pomu 2y ago
It's perfectly feasible for someone to set up a poisoned DNS in a place like an airport or a coffee shop and MITM anyone who's not using a VPN etc.
- 0x457 2y ago
  Yes, I fucking love going to the coffee shop and airport, then proceed to download QBitTorrent do download some linux ISOs. Because those places always have highly reliable WiFi, high speed and definetly not filtering traffic.
  - ndsipa_pomu 2y ago
    Fine strawman you're building there. My comment was about Python.org and I think that it wouldn't be unusual for a student to start doing some work in a coffee shop and get MITMd. However, it'd be quite easy for someone to have setup QBitTorrent to auto-start on their laptop and then to forget about it when they're doing something else at an airport, coffee shop or other place where you would expect to use someone's wifi. Note that it doesn't even have to be wifi setup by the business - it could be a bad actor setting up an access point that just looks like it belongs there.
  - eptcyka 2y ago
    You wouldn’t download QBitTorrent, you would use QBitTorrent on unsafe networks, which is not far fetched at all.
    - duskwuff 2y ago
      But ordinary use of qBitTorrent is fine. The only part with a clear path to code execution (assuming MITM and no certificate verification) is the initial install of Python - which is only required for certain features, only installs once, and requires user confirmation to start.
    - 0x457 2y ago
      The download with unverified certificate only triggered on windows if there isn't "good enough" version of python installed. If it's already installed then nothing needs to be downloaded. Again, this vulnerability can't exploited unless attacker is able MitM you or python.org is hijacked. It's very hard to exploit in real-life en-masse. Targeted attack is possible, but it requires attacker to: 1) Be able to do MitM in the first place 2) You need to use qBitTorrent 3) You need to use Windows 4) You must not have python version installed that supported by qBitTorrent Without all 4 this can't be exploited.

by 0x457 2y ago

mcmcmc 2y ago

You don’t need to hijack the whole domain to poison DNS for a given client

0x457 2y ago
Yes, that's what I meant by other way requires _some_ access to the target.

crtasm 2y ago

It makes a MITM attack possible, that doesn't require access to the target or the website it's contacting. I'd still guess zero times though.

deleted 2y ago
[deleted]
account42 2y ago
A MITM attack requires some kind of access to the target or the server. You can't just intercept connections of whoever you want on the Internet.
- crtasm 2y ago
  You need to be a hop on the route the data takes yes, but access to the source or destination machine is not a necessity.

TheDong 2y ago

The "some access to the target" bit could just being on the same unsecure wifi network as them, such as a coffee shop or library. Still, I doubt anyone noticed this, and you'd also still need the victim to use qBittorrent and go through this flow that downloads python. Zero seems pretty likely, yeah.

IshKebab 2y ago
Does ARP spoofing still actually work? I would have assumed that modern routers block it. Still the easiest way to MitM random people is to set up your own free WiFi. I've done that in the past, and it works, but HSTS and certificate caching mean it's pretty useless. I think there's a kind of vaccination effect - nobody is going to put much effort into MitMs because it's useless most of the time, so it isn't as critical when people don't validate certificates.
0x457 2y ago
> The "some access to the target" bit could just being on the same unsecure wifi network as them, such as a coffee shop or library. Fucking hell, how often do you use torrents in coffee shops let alone install new torrent client while you're at it? Any public wifi network setup not by a complete idiot today has fully isolated clients.

sneak 2y ago

No. The lack of certificate checking means anyone with access to the network in between; a rogue AP is sufficient.

0x457 2y ago
If you're connecting to a rogue AP, then you are already lost.
- detaro 2y ago
  Only if software you use is badly broken, like QBittorrent here. For the majority of applications today, a rogue AP can't do much interesting that won't immediately cause alerts.

baobun 2y ago

That is an extremely naive take. https://news.ycombinator.com/item?id=37961166 https://news.ycombinator.com/item?id=37961166 Read this and tell me if you really think it unlikely that whoever performed the mitm there wouldn't be able to or interested enough in doing similar things to known seedbox hosts, distributors, or just whoever is distributing information they'd rather not be. Qbittorrent is one of the most be popular choices for hosted bittorrent seeders across the world. This was trivially exploitable for anyone with access to the right network path for >10years. Sure it'd have to be targeted to qbittorrent users but I don't think much individual targeting is needed if you aim for dozens, hundreds, thousands, or just as many as you can of them. Besides sketchy government-related entities with legal wiretapping capabilities, you also have well-funded private interest groups on the malicious side.

ndriscoll 2y ago
Are hosted servers typically running Windows? The Linux version doesn't download Python (generally your package manager would do that). I would expect updates to qbittorrent are also handled by the package manager on Linux.
- duskwuff 2y ago
  > Are hosted servers typically running Windows? Generally not. Seedbox services are heavily cost-driven; running a Windows install for each client would add a lot of unnecessary hardware and licensing costs.
0x457 2y ago
First of all those are linux boxes that not effected by this. Second, attacker here had a valid certificate, it was only noticed when certificate expired (so 6 months after, since it was LE cert). > Besides sketchy government-related entities with legal wiretapping capabilities, you also have well-funded private interest groups on the malicious side. If you're targeted by goverment-related entities you probably shouldn't run windows and torrent software.

ndsipa_pomu 2y ago

It's perfectly feasible for someone to set up a poisoned DNS in a place like an airport or a coffee shop and MITM anyone who's not using a VPN etc.

0x457 2y ago
Yes, I fucking love going to the coffee shop and airport, then proceed to download QBitTorrent do download some linux ISOs. Because those places always have highly reliable WiFi, high speed and definetly not filtering traffic.
- ndsipa_pomu 2y ago
  Fine strawman you're building there. My comment was about Python.org and I think that it wouldn't be unusual for a student to start doing some work in a coffee shop and get MITMd. However, it'd be quite easy for someone to have setup QBitTorrent to auto-start on their laptop and then to forget about it when they're doing something else at an airport, coffee shop or other place where you would expect to use someone's wifi. Note that it doesn't even have to be wifi setup by the business - it could be a bad actor setting up an access point that just looks like it belongs there.
- eptcyka 2y ago
  You wouldn’t download QBitTorrent, you would use QBitTorrent on unsafe networks, which is not far fetched at all.
  - duskwuff 2y ago
    But ordinary use of qBitTorrent is fine. The only part with a clear path to code execution (assuming MITM and no certificate verification) is the initial install of Python - which is only required for certain features, only installs once, and requires user confirmation to start.
  - 0x457 2y ago
    The download with unverified certificate only triggered on windows if there isn't "good enough" version of python installed. If it's already installed then nothing needs to be downloaded. Again, this vulnerability can't exploited unless attacker is able MitM you or python.org is hijacked. It's very hard to exploit in real-life en-masse. Targeted attack is possible, but it requires attacker to: 1) Be able to do MitM in the first place 2) You need to use qBitTorrent 3) You need to use Windows 4) You must not have python version installed that supported by qBitTorrent Without all 4 this can't be exploited.