31–40 of 53 posts
If the web UI is exposed that could explain how it got infected: https://torrentfreak.com/qbittorrent-web-ui-exploited-to-min...
In my case, web UI was behind qbittorrent auth + authelia, haven't seen suspected logs that would trace it back to that, really interesting though!
Earlier quoted context omitted.
OP got compromised there's no issue in any hotio container. Code and CI is all open source.
I never have exposed this container to the world ever, and my server do report the existence of such binary. That is the reason based on CPU usage I suspect that mining never triggered. > ps -ef | grep netservlet > root 3708105 3665360 0 08:06 pts/2 00:00:00 grep netservlet
Read this article:
https://torrentfreak.com/qbittorrent-web-ui-exploited-to-min...
It mentions the app will use uPnP to expose itself automatically.
Remember that BitTorrent protocol is P2P, so it likely is accessible from the internet.
My suggestion is to wipe the image, update pull/run the newest version, and change the admin credentials after it starts up.
Omg! I am one of the user! Good find. I maily use for built-in VPN facility, gluetun do not cut out. But now time to re-think. I thought my 2000+ linux iso was causing medium CPU usage. But still lack of GPU, on my unraid server with 50+ docker containers running 24/7 CPU load is 2.31 2.04 2.00 so I wonder mining ever triggered? Ps. I do have such binary on my machine as well, ps -ef | grep netservlet root 3708105 36…
Earlier quoted context omitted.
OP got compromised there's no issue in any hotio container. Code and CI is all open source.
I never have exposed this container to the world ever, and my server do report the existence of such binary. That is the reason based on CPU usage I suspect that mining never triggered. > ps -ef | grep netservlet > root 3708105 3665360 0 08:06 pts/2 00:00:00 grep netservlet
Earlier quoted context omitted.
The comment was 100% in jest / sarcasm. OP's system got compromised at some point; the images are clean. Hell if he didn't want to post his clickbait he easily could have verified with a clean image on a known clean system
Brand new account, 7 different comments on this post, all aggressively trying to discredit it. A bit suspicious, don't you think?
Earlier quoted context omitted.
Brand new account, 7 different comments on this post, all aggressively trying to discredit it. A bit suspicious, don't you think?
Nope. How else are they supposed to make comments if they didn't have an account here yet? I had to create this account just to answer you—is that suspicious too?
Their comments are extremely high confidence (failing to recognize that accidents and supply chain attacks do sometimes happen) and because they are new and posting frequently in the same thread, their account shows the signs of a bot/disinfo campaign (which does happen on HN).
Earlier quoted context omitted.
My money is on the author had not updated their docker image version/tag in over 2 years. It looks like the app used weak hard-coded admin credentials back then. Appears to have been fixed in 2023.
I am running, ghcr.io/hotio/qbittorrent:release-5.1.1
> Wed Jul 02nd 2025 - qBittorrent v5.1.2 release
> [...]
> qBittorrent v5.1.2 was released.
> SECURITY: It contains security fixes for the WebAPI, Rss and Search modules.Omg! I am one of the user! Good find. I maily use for built-in VPN facility, gluetun do not cut out. But now time to re-think. I thought my 2000+ linux iso was causing medium CPU usage. But still lack of GPU, on my unraid server with 50+ docker containers running 24/7 CPU load is 2.31 2.04 2.00 so I wonder mining ever triggered? Ps. I do have such binary on my machine as well, ps -ef | grep netservlet root 3708105 36…
This output indicates the only process matching netservlet is your own grep, no?
The article author searched netservlet for these strings to detect the infection:
> $ strings /tmp/netservlet.elf | egrep -i 'stratum|pool|wallet|http|crypto|mining|eth|btc|pool'
Well. An unpaid volunteer found a way how to get paid! /s
Monero is literally the only crypto that does what it says on the tin. Anonymous, decentralized, minable on commodity hardware. It basically solves internet micropayments.
If you run a website, instead of ads you could provide users with well-behaved "support this site by enabling cryptominer while browsing" toggle that defaults to off.
But no, that'd be "weird". Or in less gullible terms, it spooked some spooks (I mean in the Stirnerian sense, not the one the reader might be thinking of).
And, well, there you have it. 16 years after Satoshi people patting themselves on the shoulder, considering it a resounding success how BTC has become toothless enough for PayPal to adopt, ffs.
And as usual nobody putting 2 and 2 together till some hackers from some hellhole did.
And presumably some other big picture thinkers saw it, too, the ones in the opposite of a hellhole who poured literal billions to turn a global plea for financial liberty into the largest FUD cloud since the Halloween papers.
Earlier quoted context omitted.
This output indicates the only process matching netservlet is your own grep, no?
Agree. The article author searched netservlet for these strings to detect the infection: > $ strings /tmp/netservlet.elf | egrep -i 'stratum|pool|wallet|http|crypto|mining|eth|btc|pool'