Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UTorrent.com compromised, malware added to installer

blog.bittorrent.com

Post reply on HN
Print view View original

11–20 of 40 posts

Re: UTorrent.com compromised, malware added to installer

#11

Post by vogonj »

morsch wrote: post #3

As far as I remember, uTorrent has an internal auto-update functionality that interrogates the server for a new version. I wonder how well that is secured and if owning utorrent.com is enough to distribute a malicious update to all users unfortunate enough to start the application while owned. I'm very wary about auto-updates that pull executables (as opposed to merely data) in this way. It's one thing for Chrome to…

from what I've gleaned from being a uTorrent user, it interrogates the server for a .torrent file and then downloads that torrent from a tracker they run. presumably, anyone who owns the host of the .torrent, or anyone who owns the tracker, could own the update download -- though I'm not sure whether they use technologies like code signing at all to verify that the bits are their own.

Re: UTorrent.com compromised, malware added to installer

#12

Post by ordinary »

DrJ wrote: post #7
eyko wrote: post #5

I stopped using it since it wasn't open source. Worse when it became infested with "optional" ~~adware~~ search bar.

still using the last-open source version with the auto-updater disabled!

I'm pretty sure uTorrent was never open source. The mainline client was, though.

Re: UTorrent.com compromised, malware added to installer

#13

Post by skeptical »

kenny_r wrote: post #9
DrJ wrote: post #7

Earlier quoted context omitted.

still using the last-open source version with the auto-updater disabled!

May I suggest Deluge ( http://deluge-torrent.org/ )? It's open-source, cross-platform and very similar to µTorrent in both functionality and looks.

Interesting, I've been using deluge for many years, had no idea they had a build that runs on windows.

Deluge has all the features I want on a torrent client, I will replace my uTorrent installations on windows by deluge.

Re: UTorrent.com compromised, malware added to installer

#14

Post by linker3000 »

kenny_r wrote: post #9
DrJ wrote: post #7

Earlier quoted context omitted.

still using the last-open source version with the auto-updater disabled!

May I suggest Deluge ( http://deluge-torrent.org/ )? It's open-source, cross-platform and very similar to µTorrent in both functionality and looks.

Just watch out for the latest (1.3.3) Windows release - it (or one of the bundled dependencies) seems very broken and I had to revert to the previous version to make things work again.

Re: UTorrent.com compromised, malware added to installer

#15

Post by wladimir »

vogonj wrote: post #10
wslh wrote: post #6

Earlier quoted context omitted.

Yes, but it's very difficult to setup outside Google.

courgette is just a binary diff algorithm -- there's nothing fancy to it (they use some really neat tricks, though), and apparently (I haven't verified) the source is in the chromium tree. validating your updates via asymmetric crypto can be mildly expensive ( http://www.verisign.com/code-signing/content-signing-certifi... lists Windows Authenticode certificates at $400/yr) but is within the realm of a small company.…

To validate updates using asymmetric crypto you don't need to buy a special key at all. You can generate the keypair yourself... The only thing you need is some crypto lib to check a RSA or DSA signature on the downloaded data using a public key embedded in the software.

Re: UTorrent.com compromised, malware added to installer

#16

Post by aptwebapps »

kenny_r wrote: post #9
DrJ wrote: post #7

Earlier quoted context omitted.

still using the last-open source version with the auto-updater disabled!

May I suggest Deluge ( http://deluge-torrent.org/ )? It's open-source, cross-platform and very similar to µTorrent in both functionality and looks.

Can I choose which files to download before it puts empties on the file system?

Re: UTorrent.com compromised, malware added to installer

#17

Post by wladimir »

kenny_r wrote: post #9
DrJ wrote: post #7

Earlier quoted context omitted.

still using the last-open source version with the auto-updater disabled!

May I suggest Deluge ( http://deluge-torrent.org/ )? It's open-source, cross-platform and very similar to µTorrent in both functionality and looks.

Transmission ( http://www.transmissionbt.com/ ) is an open source torrent client with a nice web interface (as well as native interface) just like Deluge.

I think it is somewhat lighter resource-wise (I'm running it on my NAS), but apart from that I don't know the exact differences between Deluge and Transmission, but I thought I'd mention it for completeness' sake.

Re: UTorrent.com compromised, malware added to installer

#18

Post by RexRollman »

vogonj wrote: post #10
wslh wrote: post #6

Earlier quoted context omitted.

Yes, but it's very difficult to setup outside Google.

courgette is just a binary diff algorithm -- there's nothing fancy to it (they use some really neat tricks, though), and apparently (I haven't verified) the source is in the chromium tree. validating your updates via asymmetric crypto can be mildly expensive ( http://www.verisign.com/code-signing/content-signing-certifi... lists Windows Authenticode certificates at $400/yr) but is within the realm of a small company.…

If I recall correctly, Google is facing a patent lawsuit over the Courgette technology. I don't remember if the complainant was a patent troll or not.

Re: UTorrent.com compromised, malware added to installer

#19

Post by itsnotvalid »

RexRollman wrote: post #18
vogonj wrote: post #10

Earlier quoted context omitted.

courgette is just a binary diff algorithm -- there's nothing fancy to it (they use some really neat tricks, though), and apparently (I haven't verified) the source is in the chromium tree. validating your updates via asymmetric crypto can be mildly expensive ( http://www.verisign.com/code-signing/content-signing-certifi... lists Windows Authenticode certificates at $400/yr) but is within the realm of a small company.…

If I recall correctly, Google is facing a patent lawsuit over the Courgette technology. I don't remember if the complainant was a patent troll or not.

Whatever the outcome would be, that is enough to stop people from using this piece of open source software to provide safer updates.
Post reply on HN