Flaw in Popular μTorrent Software Lets Hackers Control Your PC Remotely

If you have installed world's most popular torrent download software, μTorrent, then you should download its latest version for Windows as soon as possible.

Google's security researcher at Project Zero

discovered

a serious remote code execution vulnerability in both the 'μTorrent desktop app for Windows' and newly launched 'μTorrent Web' that allows users to download and stream torrents directly into their web browser.

μTorrent Classic and μTorrent Web apps run in the background on the Windows machine and start a locally hosted HTTP RPC server on ports 10000 and 19575, respectively, using which users can access its interfaces over any web browser.

However, Project Zero researcher Tavis Ormandy found that several issues with these RPC servers could allow remote attackers to take control of the torrent download software with little user interaction.

According to Ormandy, uTorrent apps are vulnerable to a hacking technique called the "domain name system rebinding" that could allow any malicious website a user visits to execute malicious code on user's computer remotely.

To execute DNS rebinding attack, one can simply create a malicious website with a DNS name that resolves to the local IP address of the computer running a vulnerable uTorrent app.

"This requires some simple DNS rebinding to attack remotely, but once you have the secret you can just change the directory torrents are saved to, and then download any file anywhere writable," Ormandy explained.

Proof-of-Concept Exploits for uTorrent Software Released Publicly

Ormandy also provided proof-of-concept exploits for

μTorrent Web

and μTorrent desktop (

1

and

2

), which are capable of passing malicious commands through the domain in order to get them to execute on the targeted computer.

Last month, Ormandy demonstrated same attack technique against the

Transmission BitTorrent app

.

Ormandy reported BitTorrent of the issues with the uTorrent client in November 2017 with a 90-days disclosure deadline, but a patch was made public on Tuesday—that's almost 80 days after the initial disclosure.

What's more? The re-issued new security patches the same day after Ormandy found that his exploits continued to work successfully in the default configuration with a small tweak.

"This issue is still exploitable," Ormandy said. "The vulnerability is now public because a patch is available, and BitTorrent have already exhausted their 90 days anyway." 

"I see no other option for affected users but to stop using uTorrent Web and contact BitTorrent and request a comprehensive patch."

Patch your uTorrent Software NOW!

The company assured its users that all vulnerabilities reported by Ormandy it two of its products had been

addressed

with the release of:

• μTorrent Stable 3.5.3.44358
• BitTorrent Stable 7.10.3.44359
• μTorrent Beta 3.5.3.44352
• μTorrent Web 0.12.0.502

All users are urged to update their software immediately.

from The Hacker News http://ift.tt/2F6ZaOp