UTorrent.com compromised, malware added to installer
blog.bittorrent.com
UTorrent.com compromised, malware added to installer
1–10 of 40 posts
Re: UTorrent.com compromised, malware added to installer
#2nubz
Re: UTorrent.com compromised, malware added to installer
#3As far as I remember, uTorrent has an internal auto-update functionality that interrogates the server for a new version. I wonder how well that is secured and if owning utorrent.com is enough to distribute a malicious update to all users unfortunate enough to start the application while owned.
I'm very wary about auto-updates that pull executables (as opposed to merely data) in this way. It's one thing for Chrome to do it, I assume Google does it in a way that's safe. But freeware/shareware projects? Not so much. Hell, who's to say the authors don't lose interest in two years and let the domain expire. I had one freeware or open-source app that didn't even have the courtesy of asking, it just pulled fresh binaries and restarted -- ouch. (At least you could disable this feature in the preference.)
Re: UTorrent.com compromised, malware added to installer
#4As far as I remember, uTorrent has an internal auto-update functionality that interrogates the server for a new version. I wonder how well that is secured and if owning utorrent.com is enough to distribute a malicious update to all users unfortunate enough to start the application while owned. I'm very wary about auto-updates that pull executables (as opposed to merely data) in this way. It's one thing for Chrome to…
Just since you mentioned Chrome's updating mechanism, it is a fascinating approach that they took: http://www.chromium.org/developers/design-documents/software...
Re: UTorrent.com compromised, malware added to installer
#5I stopped using it since it wasn't open source. Worse when it became infested with "optional" ~~adware~~ search bar.
Re: UTorrent.com compromised, malware added to installer
#6As far as I remember, uTorrent has an internal auto-update functionality that interrogates the server for a new version. I wonder how well that is secured and if owning utorrent.com is enough to distribute a malicious update to all users unfortunate enough to start the application while owned. I'm very wary about auto-updates that pull executables (as opposed to merely data) in this way. It's one thing for Chrome to…
Just since you mentioned Chrome's updating mechanism, it is a fascinating approach that they took: http://www.chromium.org/developers/design-documents/software...
Yes, but it's very difficult to setup outside Google.
Re: UTorrent.com compromised, malware added to installer
#7I stopped using it since it wasn't open source. Worse when it became infested with "optional" ~~adware~~ search bar.
still using the last-open source version with the auto-updater disabled!
Re: UTorrent.com compromised, malware added to installer
#8As far as I remember, uTorrent has an internal auto-update functionality that interrogates the server for a new version. I wonder how well that is secured and if owning utorrent.com is enough to distribute a malicious update to all users unfortunate enough to start the application while owned. I'm very wary about auto-updates that pull executables (as opposed to merely data) in this way. It's one thing for Chrome to…
For example, VLC (and, IIRC, Firefox) uses asymetric crypto to sign the update messages and the binaries. And the private keys are in none of the VideoLAN servers, but in other secret locations.
So, if the server is hacked, or a DNS is spoofed, you cannot make auto-update pull broken/malware binaries.
The problem is that, if your update process is buggy in some release, you loose those users forever...
Re: UTorrent.com compromised, malware added to installer
#9I stopped using it since it wasn't open source. Worse when it became infested with "optional" ~~adware~~ search bar.
still using the last-open source version with the auto-updater disabled!
May I suggest Deluge (http://deluge-torrent.org/)?
It's open-source, cross-platform and very similar to µTorrent in both functionality and looks.
Re: UTorrent.com compromised, malware added to installer
#10Earlier quoted context omitted.
Just since you mentioned Chrome's updating mechanism, it is a fascinating approach that they took: http://www.chromium.org/developers/design-documents/software...
Yes, but it's very difficult to setup outside Google.
courgette is just a binary diff algorithm -- there's nothing fancy to it (they use some really neat tricks, though), and apparently (I haven't verified) the source is in the chromium tree.
validating your updates via asymmetric crypto can be mildly expensive (http://www.verisign.com/code-signing/content-signing-certifi... lists Windows Authenticode certificates at $400/yr) but is within the realm of a small company.
setting up a Google-scale CDN and writing a reliable push update framework? that's the hard part.