Just happened to me on Businessinsider.
Twitter Tweet Button URL randomly resolves to a .torrent file
31–40 of 47 posts
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#32This is what TorrentFreak had to say about it:
http://torrentfreak.com/twitter-bug-requires-users-to-torren...
TL;DR is Twitter uses bittorrent internally, this is probably just an error in letting an internal configuration leak to the outside world.
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#33Now you just need browser support for downloading HTTP bodies via BitTorrent. Not actually a bad idea for sufficiently large ones :)
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#34My guess: many CDNs allow you to exclude the querystring from the cache key, so it's possible that one person requested the URL with ?torrent in the querystring (which causes S3 to serve a .torrent response) and that the request hit a cold cache. The response with type application/x-bittorrent was then cached under the querystring-less cache key, causing it to be served to anyone else hitting that edge node with the…
I thought Twitter was all private DC, did platform previously point to S3?
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#35Earlier quoted context omitted.
I don't understand, if the user is prompted to download the file using an external application it's no different than a direct download. If users have their browsers configured to automatically start the download of any .torrent files without confirmation, twitter giving bogus .torrent is no more dangerous than $malware_site linking a .torrent. So that's not a security issue on twitter's site. And anyway, I still fai…
The flow of a (possible) attack is something like this: 1. User configures browser to automatically start torrent downloads when a ".torrent" link is clicked 2. User clicks twitt button which leads to a torrent file 3. The file is downloaded and opened in a torrent client At this point, one could imagine a specifically crafted torrent file which exploits some vulnerability of the torrent client to gain (say) arbitrar…
That attack vector has nothing to do with Twitter.
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#36Earlier quoted context omitted.
The flow of a (possible) attack is something like this: 1. User configures browser to automatically start torrent downloads when a ".torrent" link is clicked 2. User clicks twitt button which leads to a torrent file 3. The file is downloaded and opened in a torrent client At this point, one could imagine a specifically crafted torrent file which exploits some vulnerability of the torrent client to gain (say) arbitrar…
That attack vector has nothing to do with Twitter.
Did I imply it had something to do with twitter?
When this conjecture was posted I assumed someone hijacked a CDN used by twitter and used the twitt button as an attack vector by making it redirect to a torrent file.
I'm not saying twitter is trying to infect its users or something. In all probability, it's just a configuration screw-up and not an attack but (for all we know) it could be.
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#37platform.twitter.com is hosted at Amazon S3 (via an additional CDN). All S3 files by default can be distributed with torrent, if the URL is appended with ?torrent S3 servers will act as a tracker and seeds.
Relevent FAQ from Amazon S3 FAQ page : http://aws.amazon.com/s3/faqs/#What_is_the_BitTorrent_TM_pro...
Wow, that's amazing. I had no idea Amazon offered that.
I also have no idea when I'll ever use it, but still. Damn cool.
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#38Just got this visiting this article page on TechCrunch => http://techcrunch.com/2013/09/23/facetime-audio-is-apples-bi...
Chrome automatically downloaded it => http://cl.ly/image/2u3R2m3j3j1E
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#39reproduced in Egypt, this thing is all over the place
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#40My guess: many CDNs allow you to exclude the querystring from the cache key, so it's possible that one person requested the URL with ?torrent in the querystring (which causes S3 to serve a .torrent response) and that the request hit a cold cache. The response with type application/x-bittorrent was then cached under the querystring-less cache key, causing it to be served to anyone else hitting that edge node with the…
I thought Twitter was all private DC, did platform previously point to S3?
platform.twitter.com is currently CNAMEd to EdgeCast CDN. It looks like the CDN is sitting in front of Amazon S3; http://platform.twitter.com/blahblahblah gives an S3-like 403 response.