TorrentLeech News

[Captain Marvel]

Vulnerability patched - 3 days left to reset your passkeys!

As you may have noticed, we had a SOLR vulnerability on site, which requires us to reset all passKEYS (NOT PASSWORDS! please keep reading ) for users registered before 10th of November, 2020 (users registered after that date were not affected, thus they didn't see that "warning" banner we put in place).

So what happened exactly?

Without going into deep details, and to keep it easy and understandable for the majority of our users, SOLR (its the open-source java platform we use to query searches/torrents etc on site) suffered from a vulnerability issue, which is now patched to the latest version (as of 10th of November). That vulnerability allowed a hacker to copy data on one of our servers, and while most of the things he took were encrypted and hashed (unreadable/useless), usernames, last IP login and the table with the torrent passkeys for our users was not encrypted (we have implemented a new system around this now, more on it later)

What does that mean for my account? Is my password and email safe?

Yes, your account is safe. Even though your passwords have not been stolen, both password and your email address are hashed and unreadable.

Do i need to do something on my end?

If you haven't already, you should see a banner that prompts you to go change your passkey. You can't close that banner, nor it will go away, untill you reset your passkey! Please go under your profile --> Edit --> find the reset passkey button and reset it. Please note that when you do that, if you have any active torrents, they will stop working, and you will need either to redownload them or edit them. We have put a nice step by step guide with photos for your convenience here --> reset passkey how-to I repeat : DONT CHANGE YOUR PASSWORD! Reset your passkey!

What will happen if i fail to reset my passkey by Monday, 16th of November?

If you dont manually reset your passkey by that date, system will do it for you and you will have to manually re-add all your torrents after that date. Don't leave it for last minute!

Any kind of hacking/data leaking is not cool at all! What steps you took to ensure something like that wont happen in the future?

Trust us when we say that, no one benefits from this and nobody is happy when such situations occurred. Apart from patching the latest vulnerabilities and upgrading to latest version, we also now moved all those "sensitive" data and chunk them among other servers encrypting every bit of detail.

Bottom line: It sucked (still does!) and its a real inconvenience for everyone involved. It could be much worse, thus thats not an excuse. What is a promise though, is that we'll do better.

Enjoy the site!

P.S.1 Reminder: CHANGE PASSKEY and not password!

P.S.2 Stap by step guide --> How to change passkey/edit torrents

P.S.3 Your password and email are safe, and not leaked.

P.S.4 If you made your account AFTER 10th of November 2020, this doesn't apply to you and nothing is needed on your end