Slashdot Mirror
Pirate Bay Browser Streaming Technology Is a Security and Privacy Nightmare (softpedia.com)
An anonymous reader writes: Last week the Pirate Bay added support for streaming video torrents inside the browser in real-time. Kickass Torrents followed the next week. The technology they used is called Torrents Time. A security researcher has discovered that this technology which is a mix of client and server side code is actually a security and user privacy disaster. Attackers can carry out XSS attacks on TPB and KAT, the app runs on Mac as root, attackers can hijack downloads and force malicious code on the user's PC, and advertisers can collect info on any user that has Torrents Time installed.
MPAA and RIAA releases tainted movies and music on torrents themselves...
Morons of course.
This isn't a security issue! Modern app appers know that ONLY apps can app other apps, so if you're apping The Pirate App, then only that app can app your apps!
Apps!
All lazy web "developers" whose job is slapping together huge javascript frameworks will come at me with frothing mouths, but the truth is that having a client application (the browser) which picks up random executable content off the IntraTubes and executes it in my machine is a *seriously bad idea*. Yeah, yeah. Sandbox my ass.
Heck, I thought we learnt enough from the Word macro viruses in the eighties -- no way.
I, for one, have extirpated Javascript from my browser's default profile (some web sites come up blank. I just ditch those) and disable cookies (there's one site I enable them for *while writing a comment* and then I disable them again and delete them).
That's it. You wanna my eyeballs? You provide something which works reasonably well with *no active content*. In exchange, I won't disable conventional banner ads (some text & png). I might even look at them and *gasp!* click on them if deemed interesting.
News at 11!
Does anyone consider the fact these sites have been taken down (in some cases more than once) and does anyone consider who may be actually running these sites?
"If any question why we died, Tell them because our fathers lied."
The same with software or new technology.
Sooner or later safe and secure versions of Torrent Time (or equivalent) will appear which will allow the use of functionality without compromising security.
Who expects privacy and security when they use Internet ?
Fixed that for you.
Don't fight for your country, if your country does not fight for you.
There's only a small o between BSD and BSoD.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Mr. Sampson discovered that he could open a Torrents Time video player inside this malicious page and serve the user the torrent files they wanted. This could let the user think they're accessing a trustworthy Torrents Time video player, when, in reality, the attacker could be delivering malicious code in the background while the user is watching a movie.
So this is no different than downloading a torrent from an untrustworthy source... assuming anyone using The Pirate Bay cares about trustworthy sources. To execute the malicious code, you'd need to exploit the media player used by the application/browser.
"XSS on The Pirate Bay and Kickass Torrents"
So an attacker could theoretically get your pirate bay cookies, oh, the horror.
I still prefer to use qbittorrent and mplayer for "streaming" but I can't see any major fuck up here.
That's right! One renders your system inoperable, the other is a Windows fatal system error.
(ducks)
Summation 2
Even The Pirate Bay itself is quite hacked code.
Remember that these softwares are made by amateurs who spent their time downloading warez instead of getting proper professional programming education.
Actually, I doubt that they lack CS education. What they lack is QA. "Good" developers with educations let this sort of shit through all the time. The businesses who make software actually make an effort to test their software for security and functionality.
The problem with these guys is that coding is sexy, QA is not.
"The businesses who make software actually make an effort to test their software for security and functionality."
AHAHAHAHAHAHAHAHAHAHAHAHAHAHA. That's a good one. We'd never have anything to worry about from exploits, viruses, hijackers, malware, bugfests etc if that were true.
Might as well say it as it is. They did a commercial quality job on their Torrent Time app.
always when i have no mod points... well played sir!
"So this is no different than downloading a torrent from an untrustworthy source... assuming anyone using The Pirate Bay cares about trustworthy sources. To execute the malicious code, you'd need to exploit the media player used by the application/browser."
Actually, I think it is a bit different. Maybe they can exploit media player, or vlc or whatever *IF* it's not updated/patched -- but that's from a maliciously created media file. What bothers me is that there's a browser layer on TOP of that AND a different media player. The exploit doesn't necessarily NEED to be in the media stream.
It's one thing if I run a torjan'd AVI or something -- it's another if the browser sends a trojan'd AVI I didn't request. I'm sorry, but sketchy ads at a number of torrent sites (including KAT) do enough damage now to people who aren't diligent. How much more damage could those do ALONE and how many other ways can a browser interact with the media player to "break" things in a bad way? What if a malicious ad ends up at legitimate sites (it happens quite a bit)?
If someone is stupid enough to install and run software supplied by a piracy website then they deserve everything you get. Even if the TPB isn't being malicious intentionally, I'm sure one of their skeezy malvertising partners won't have qualms about exploiting users.
I said, "make an effort", I didn't say "entirely succeeded".
But no, I don't think I'd call the effort on Torrent Time to be the same as decent commercial jobs. There are degrees of failure and it is important to distinguish between them.
Suuuuuure. Is this like when they said copied VHS tapes would break your player?
It's even worst than we could ever have imagined. According to security researcher Chros Didd of the American Association for Prevention of Malware (AAPM), actually ANY pirated Hollywood movie (1) puts your computer at great risk of hackers, (2) funds terrorism and (3) aids and abets child molestation and exploitation.
When the copyright term is "forever minus a day", live every day like it's the last.
The only reason why this is so "surprising" now is because it was so badly reported in the first place. Originally the announcements made it sound like it's an HTML5 replacement for the bittorrent client, which used to be a separate application from the browser, kinda like Google Docs replaced Word. That's not what it is, this is a native code plugin. When you download it, you get a huge binary file and a .so (on linux, on windows I assume it'll be dlls). This will run native code directly on your cpu with no sandbox from the browser, it's literally like downloading a random executable from the internet and running it, no different from running a standalone bittorrent client.
The question is, would it be possible to write an actual bittorrent client using only apis provided by the browser? Scripts can use "websockets", but can they open them cross-site? And can the bittorrent protocol be modified to accept websockets? That would be an actual breakthrough, bittorrent has become practically unusable because of all the crapware that surrounds it.
--
Stay tuned for some shock and awe coming right up after this messages!
There is another positive aspect: "The torrent was downloaded because of XSS" is now an excuse.