Critical Vulnerability Discovered in uTorrent

[anon]

so lets see if we can find such a modified torrent file someday

For now there are virused "cracks" and "releases" in public trackers and indexes Or trojans that run along "good" content so that you never know you're infected and if so, keep on sharing the torrent

[Aurion]

LOL thats why a protection cycle should be injected someday into torrent files (presented in small bytes) just to assure secure p2ping !! I guess maybe uT would include a small shellcode checked into one of its coming releases so that it detects if that torrent file is infected with any malicious objects

[anon]

I guess maybe uT would include a small shellcode checked into one of its coming releases so that it detects if that torrent file is infected with any malicious objects

Like an antivirus scan?
We can use "Run this program when the download finishes" (torrent properties -> Advanced) to have our AVs scan a torrent after it's finished

[Aurion]

yeah I know that function its normal,I meant that a sophisticated malicious objects checker that will do a ms scan inside the hash info within the .torrent file (to prevent any bad shellcodes to further generate any bad items)

[anon]

Mmm, a kind of mini-antivirus designed specifically to detect .torrent shellcode threats, should they become widespread, it's a good idea.
Just like Winalign is a kind of mini-defragger in Win98 system

[Aurion]

LOL yeah hope we can see that mini-buster soon in any of the Bittorrent trackers

[shoulder]

It's a good idea.

But I think this isn't necessary on the "good" ALT.

[anon]

In the ones you can trust ^^

[shoulder]

I would say on every tracker without open signups.

No one is going to get an invite (and even become an uploader) just to post one infected *.torrent file and get banned.

[anon]

Yes, you're right with that, it'd a stupid thing to do in those cases.
Plus the IP to connect to embedded in the .torrent would surely be spread and DDoSed, and the uploader's personal info posted (depending on the tracker).

[Aurion]

What's the heck then ?? If a smart coder took his time to hide this shellcode wisely in the torrent file that no one would feel anything happened to his PC (since no alerts are shown by any AV),then how come he will be detected ? guys,im talking about a very complicated situation here,just keep up with me !!

[anon]

But even if it was undetectable, it'd be noticed that after loading that torrent, weird things start to happen to your computer, which don't when booting in Safe Mode [well, it depends on how the trojan manages to run with Windows], even with network support, when all this doesn't happen with other (non-infected) torrents...

[Aurion]

[well, it depends on how the trojan manages to run with Windows], even with network support, when all this doesn't happen with other (non-infected) torrents...

You got a good point here pal ! thats exactly what I meant with that simulation,just to improve a smart trojan that won't run till the whole file gets downloaded so that the user don't feel what happen to his PC,just think that some ads got him infected !! That way,the trojan developer would accidently inject those trojans & spread the harmful file around the net in no time (being a devil lately I know )

[anon]

You got a good point here pal ! thats exactly what I meant with that simulation,just to improve a smart trojan that won't run till the whole file gets downloaded so that the user don't feel what happen to his PC,just think that some ads got him infected !! That way,the trojan developer would accidently inject those trojans & spread the harmful file around the net in no time

So as long as you don't give the infected user a way to know you're there (not directly controlling his input, for example), it's OK? File transfer and registry editing, etc.?

(being a devil lately I know )

That's true, Rep...

But it's fantastic that you become interested in computer security matters. Therefore you can learn new things, possible attack ways and how they can be prevented/countered... stuff like this that's always useful

[Aurion]

So as long as you don't give the infected user a way to know you're there (not directly controlling his input, for example), it's OK? File transfer and registry editing, etc.?

don't forget that any cracker/coder who just invent for harmfull purposes is the ONLY one who knows who's there & who's not !! so for sure it would be reasonable for him to inject himself inside victim's PC with a quite well made simulation of his own just to stay for the couple of seconds he needs to get the job done,that's how things work,I guess...

That's true, Rep...

But it's fantastic that you become interested in computer security matters. Therefore you can learn new things, possible attack ways and how they can be prevented/countered... stuff like this that's always useful

yeah sure,im starting to like the whole thing (won't hurt anybody for sure) but the thing is that I need a quite good teacher to learn some trix