Nebulance.io (TransmiTheNet): News

[Len]

We've blacklisted the uTorrent 3.x line-up

Members of the Fleet,

Recently, a vulnerability was found in uTorrent that allows any visited website to exfiltrate sensitive information from a user's running instance of uTorrent. Anyone using a vulnerable version of uTorrent puts the entire userbase of any private tracker they are on in danger, as any malicious actor can use the vulnerability to impersonate the affected user and convince the tracker to send back IP addresses of other members of the tracker.

While we know some of our users choose uTorrent 3.x line-up as their client of choice here, leaving it of the blacklist poses an unacceptable threat to the safety of our userbase, and it would be extremely irresponsible for us to allow its continued use. I mean really - what kind of horrible staff would we be if we put a minor convenience of a portion of our users above the safety of everyone? What competent group of staff would do something like that?

We strongly suggest you take this severe and dangerous flaw seriously and immediately discontinue use of the client on any tracker. Just having the client running in the background is all that is required to use this exploit against you.

That said, from what we have been able to determine, the 1.6.x, 1.8.x and 2.x line are not nearly as vulnerable as the 3.x line-up. However, to be safe it is strongly advised to set Advanced -> net.discoverable to false and restart the client.

Thanks to OT & PTP as I really couldn't be arsed to write up my own news.


So say we all!