UHDBits: News

[Len]

A serious security exploit has been found that can easily allow a remote attacker to steal passkeys, peer information, or even download things to the remote computer. The latest version 3.5.3 (beta) fixes them but considering its usability problems (that all 3.x versions have to some extent) such as speed or stability issues, many users prefer to use older versions 2.0.4 or 2.2.1 or 3.4.5.

The exploits are divided to 2 groups 

Exploit of WebUI listening port and incoming connections port. You can and should mitigate the first by disabling WebUI and setting net.discoverable setting to false in uTorrent's settings. Doing these steps prevents majority of harmful action that could be done such as getting access to your PC. 

The remaining unfixed exploit of incoming port could allegedly make your client crash when someone attacks it, but there are reports that even this cannot be replicated so we don't think there is enough reasons or need to ban all older versions of uTorrent yet.

Be careful about sites that you visit. We can recommend using JavaScript blocking plugins such as NoScript or others and whitelist only trusted sites. This would prevent these exploits and also various other possible online attacks.

As many of you have seen on other trackers several versions, mostly 3.x, are being blacklisted and users are being asked to migrate to an alternate client. We are not placing anything on the blacklist at this time, but you should consider this your grace period to change from any 3.x client to something else on the whitelist.

Use this thread for discussion on this topic or alternative clients to migrate to.