Just happened to me on Businessinsider.
Happened to me on a tech news website earlier today (forget which one exactly)
Twitter Tweet Button URL randomly resolves to a .torrent file
41–47 of 47 posts
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#42My guess: many CDNs allow you to exclude the querystring from the cache key, so it's possible that one person requested the URL with ?torrent in the querystring (which causes S3 to serve a .torrent response) and that the request hit a cold cache. The response with type application/x-bittorrent was then cached under the querystring-less cache key, causing it to be served to anyone else hitting that edge node with the…
This is my exact guess as well. I would be surprised if it turned out to be something else.
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#43Earlier quoted context omitted.
Relevent FAQ from Amazon S3 FAQ page : http://aws.amazon.com/s3/faqs/#What_is_the_BitTorrent_TM_pro...
Wow, that's amazing. I had no idea Amazon offered that. I also have no idea when I'll ever use it, but still. Damn cool.
Not only can S3 serve the file as a torrent, if you provide it as a torrent link and have disabled read access to the file, S3 will still serve as the tracker as long as other peers in the swarm have a full copy of the file to serve.
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#44Just got this visiting this article page on TechCrunch => http://techcrunch.com/2013/09/23/facetime-audio-is-apples-bi... Chrome automatically downloaded it => http://cl.ly/image/2u3R2m3j3j1E
Same. Chrome automatically downloaded it for me too. Twice.
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#45Earlier quoted context omitted.
I don't understand, if the user is prompted to download the file using an external application it's no different than a direct download. If users have their browsers configured to automatically start the download of any .torrent files without confirmation, twitter giving bogus .torrent is no more dangerous than $malware_site linking a .torrent. So that's not a security issue on twitter's site. And anyway, I still fai…
The flow of a (possible) attack is something like this: 1. User configures browser to automatically start torrent downloads when a ".torrent" link is clicked 2. User clicks twitt button which leads to a torrent file 3. The file is downloaded and opened in a torrent client At this point, one could imagine a specifically crafted torrent file which exploits some vulnerability of the torrent client to gain (say) arbitrar…
One could also imagine a specially crafted image file which exploits some vulnerability of the graphics library to gain arbitrary code execution. Then you just need the user to look at the twitter button.
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#46Earlier quoted context omitted.
The flow of a (possible) attack is something like this: 1. User configures browser to automatically start torrent downloads when a ".torrent" link is clicked 2. User clicks twitt button which leads to a torrent file 3. The file is downloaded and opened in a torrent client At this point, one could imagine a specifically crafted torrent file which exploits some vulnerability of the torrent client to gain (say) arbitrar…
One could also imagine a specially crafted image file which exploits some vulnerability of the graphics library to gain arbitrary code execution. Then you just need the user to look at the twitter button.
True, though I'd think it would be easier to exploit a torrent client than a browser.
Re: Twitter Tweet Button URL randomly resolves to a .torrent file
#47I also have this bug on BusinessInsider and other sites. Does not look good. Surprised there isn't more coverage of this.