While BitTorrent client functionality hasn’t fundamentally changed over the past 20 years, developers of leading clients haven’t let their software stagnate.

A good example is the excellent qBittorrent , a feature-rich open source client which still receives regular updates. In common with similar clients, qBittorent can be found on GitHub along with its source and installation instructions.

Elsewhere on the same platform, users were recently trying to work out how a standard qBittorrent install suddenly led to the appearance of unwanted cryptocurrency mining software on the same machine.

Proxmox and LXC

For those unfamiliar with Proxmox VE , it’s an environment for virtual machines that once tried becomes very useful, extremely quickly. It’s also free for mere mortals and in most circumstances, very easy to install and get up and running.

With help from various Proxmox ‘helper scripts’ offered by tteck on GitHub (small sample to the right), even beginners can install any of dozens of available software packages in a matter of seconds using LXC containers .

Even if none of that makes sense, it doesn’t matter. Those who want qBittorrent installed, for example, can copy and paste a single line of text into Proxmox…and that’s it. Given that the whole process is almost always flawless, user issues are very rare, so to hear of a possible malware infection came as a real shock recently

Cryptominer Discovery

In summary, a Proxmox user deployed a tteck script to install qBittorrent and then a month later found his machine being worked hard by cryptomining software known as xmrig . While he investigated the problem, tteck removed the qBittorrent LXC script as a basic precaution, but it soon became clear that neither Proxmox or tteck’s script had anything to do with the problem.

The unwelcome software was indeed installed maliciously, but due to a series of avoidable events, rather than a genius hack.

When a qBittorrent installation like this completes and the software is launched, access to qBittorent takes place through a web interface accessible from most web browsers. By default, qBittorrent uses port 8080 and since many users like to access their torrent clients from remote networks, qBittorrent uses UPnP (Universal Plug and Play) to automate port forwarding, thereby exposing the web interface to the internet.

Having this working in record time is all very nice, but that doesn’t mean it’s safe. To ensure that only the operator of the client can access the web interface, qBittorrent allows the user to configure a username and a password for authentication purposes.

This generally means that random passers-by will need to possess these credentials before being able to do damage. In this case, the default admin username and password were not changed and that allowed an attacker to easily access the web interface.

Attacker Told qBittorrent to Run an External Program

To allow users to automate various tasks related to downloading and organizing their files, qBittorrent has a feature that can automatically run an external program when a torrent is added and/or when a torrent is finished.

The options here are limited only by the imagination and skill of the user but unfortunately the same applies to any attacker with access to the client’s web interface.

In this case the attacker told the qBittorrent client to run a basic script on completion of a torrent. The script accessed the domain http://cdnsrv.in from where it downloaded a file called update.sh and then ran it. The consequences of that are explained in detail by tteck , but the main points are a) unauthorized cryptomining on the host machine and b) the attacker maintaining root access via SSH key authentication.

Easily Avoided

The default admin username for qBittorrent is ‘admin’ while the default password is ‘adminadmin’. Had these common-knowledge defaults been changed following install, the attacker would still have found the web interface but would’ve had no useful credentials for conventional access.

More fundamentally, possession of the correct credentials would’ve had limited value if the qBittorrent client hadn’t used UPnP to expose the web interface in the first place. Taking another step back, if UPnP hadn’t been enabled in the user’s router, qBittorrent would’ve had no access to UPnP, and wouldn’t have been able to forward ports or expose the interface to the internet.

In summary: disable UPnP in the router and only enable it once its function is fully understood and when absolutely necessary. Never leave default passwords unchanged, and if something doesn’t need to be exposed to the internet, don’t expose it unnecessarily.

Finally, it’s worth mentioning that tteck ‘s response, to a problem that had nothing to do with Proxmox or his scripts, has been first class. Anyone installing the qBittorrent LXC from here will find the default admin password changed and UPnP disabled automatically.

Any time saved can be spent on automated installs of Plex, Tautulli, Emby, Jellyfin, Jellyseerr, Overseerr, Navidrome, Bazarr, Lidarr, Prowlarr, Radarr, Readarr, Sonarr, Tdarr, Whisparr, and many, many more.

From: TF , for the latest news on copyright battles, piracy and more.

Read 5 remaining paragraphs | Comments

At least on the surface, the story of Sdarot, Israel’s most popular pirate site, sounds quite similar to that of The Pirate Bay. Loved by millions and loathed by entertainment companies, both have demonstrated an unusual ability to remain online, despite overwhelming odds.

But while The Pirate Bay has generated considerable revenue over the years, Sdarot’s existence and its ability to generate profit seem inexorably intertwined. The subscription fees, paid by some (but not all) of its users in return for access to Israel’s top premium TV channels, are the main attraction. They’re also the reason the people behind Sdarot’s are among the most hounded pirate site operators on the planet.

Legal Action in the United States

With legal victories and blocking injunctions proving all but useless in Israel, companies including United King Film Distribution, DBS Satellite Services, and Hot Communication, filed three copyright infringement lawsuits in New York, with Sdarot one of the main targets. The companies requested an award for damages and then received one worth $23 million, not bad all things considered.

A decision by the entertainment companies to go hard with their injunction demands, including that every ISP in the United States should be forced to block Sdarot’s domains, was outrageously ambitious yet somehow received approval from the court in 2022.

What followed was an ill-thought-through attack on Cloudflare and universal disapproval from Big Tech. That led to the blocking demands being withdrawn and a mostly secret process to degrade Sdarot’s ability to conduct business online.

Sdarot Remains in Business; But For How Long?

Reports emerging over the past few days indicate that in addition to legal problems in the United States, Sdarot now faces a new lawsuit in Israel. Following an investigation by Zira, an anti-piracy group that has hounded Sdarot for years, a lawsuit was filed at the Tel Aviv District Court against 14 people alleged to be involved in the operation of the pirate TV show platform.

According to Israeli news outlet Walla, the letter of claim describes a “well-oiled criminal system” that illegally records and distributes copyrighted content, and then launders the revenue, hiding it from tax authorities. Those behind the platform are also accused of exploiting minors, an allegation we’ll return to in a moment.

Zira reportedly engaged an unnamed European cybersecurity company to “follow the money” or, more accurately, cryptocurrency wallets used to receive payments from users before forwarding to other wallets. As published by Walla, the document below appears to be part of the evidence package and claims to show a BTC wallet with an extremely healthy balance.

In common with the investigation that eventually took down Megaupload, Zira appears to have avoided discrimination based on the type or scale of alleged offending at Sdarot. From the top of the site to the very bottom, anyone involved seems eligible.

Owner Through to Facebook Moderator

The alleged owner of Sdarot (TV shows) and sister site Sratim (movies) is named in the lawsuit as Michael Ben-Ami, a former resident of Dimona who no longer lives in Israel. Seeing Ben-Ami’s name in print after years in the shadows provokes a trip down memory lane.

When local TV companies were trying to shut down and/or block Sdarot in 2013, the name of the site’s operator was initially unknown. After subsequently identifying Ben-Ami as the main suspect, police raided his home looking for evidence. Reports at the time claimed that officers were confronted by Ben-Ami’s then-wife/partner who pulled out a knife and turned a ‘normal’ police drama into a potential crisis.

As far as we know, no one was injured, which left Ben-Ami – a former police officer – to deny all involvement in the site.

The lawsuit goes on to name Ephraim Fishel Shtroch as a central figure in the streaming operation. The resident of Beit Shemesh stands accused of developing the site’s mobile and smart TV applications. Also among the accused is Ashdod resident Aviel Twito, who reportedly provided hosting services for Sdarot in Israel, plus Ariel Eisental and Bar Lubinger, who stand vaguely accused of helping the site to make pirated content available.

The list concludes with those who helped to run the site, such as Shaul Amedi and Daniel Levy, and those who moderated social media channels; Shoval Reshef and Lipez Nossen (Discord), David Shemesh (Telegram), plus Alik Abramson and Yuval Abramzon (Facebook). Idan Yuval stands accused of designing Sdarot’s website while Yarin Shimoni is said to have provided voice-overs for content released on the platform.

Commenting on the lawsuit, CEO of Zira Ido Natan said an important step had been taken against widespread copyright infringement in Israel. According to the person behind Sdarot’s Twitter account, Zira’s more recent steps against infringement have been going on for quite some time.

No Love Lost Between Sdarot and Zira

After celebrating Sdarot’s 1,000,000th member on June 16, early July the person controlling the Twitter account spoke of experiencing “somewhat significant technical malfunctions” due to Zira’s activities against the site. That turned out to be the seizure of Sdarot’s server in Israel which in turn solicited a response from Sdarot containing a threat against someone allegedly involved.

On July 12, alarm bells rang more urgently at Sdarot HQ, wherever that might be.

“The site is under attack on several different fronts at the same time now, in at least four different countries! The site is currently only active for subscribers until we return to full normality in a few days,” an announcement declared.

What followed were public allegations against Zira CEO, Ido Natan. The tweet in question claims that Natan previously worked as the Minister of Justice’s personal assistant and then suddenly became CEO of Zira.

A day later Eli Cohen, the pseudonym used by the owner of Sdarot, offered to close down the site if certain conditions were met.

With memes quickly descending into more personal insults, Sdarot acknowledged the existence of the Zira lawsuit on August 2 and also appeared to shine light on allegations that the site “exploited minors.”

“I heard that Zira reached the bottom of the ladder. They decided to sue 14 people, some of whom live in Israel. Some of them are minors, all because they claim to have been part of the site’s team about a decade ago,” the tweet reads, adding: “You increased our motivation to continue.”

This week Sdarot announced two things: 1) the operation to shut the site down (Operation: Sunstroke) had come to an end. 2) On September 7, 2023, Sdarot is expected to make a full comeback.

From: TF , for the latest news on copyright battles, piracy and more.

Read 11 remaining paragraphs | Comments

Read 22 remaining paragraphs | Comments

Read 11 remaining paragraphs | Comments

Read 19 remaining paragraphs | Comments

Read 20 remaining paragraphs | Comments

News :

Researchers at Russian cybersecurity firm Kaspersky today revealed that they identified a small number of cryptocurrency-focused firms as at least some of the victims of the 3CX software supply-chain attack that’s unfolded over the past week. Kaspersky declined to name any of those victim companies, but it notes that they’re based in “western Asia.”

Security firms CrowdStrike and SentinelOne last week pinned the operation on North Korean hackers, who compromised 3CX installer software that’s used by 600,000 organizations worldwide, according to the vendor. Despite the potentially massive breadth of that attack, which SentinelOne dubbed “Smooth Operator,” Kaspersky has now found that the hackers combed through the victims infected with its corrupted software to ultimately target fewer than 10 machines­—at least as far as Kaspersky could observe so far—­and that they seemed to be focusing on cryptocurrency firms with “surgical precision.”