Although the popularity of streaming websites is growing rapidly, BitTorrent remains one of the primary sources of entertainment content for a large portion of people using the internet. With the help of popular torrent websites (there are some that are completely legal) and BitTorrent users, users can download content.
A recent critical security issue discovered by Googletargets the popular BitTorrent application. Using this flaw, a hacker could execute malicious code on a user's computer, according to Ars Technica.
Last week, Project Zero researchers published the proof-of-concept code. It’s worth noting that Project Zero typically refrains from publicly disclosing details of these flaws for 90 days or until a fix is released. However, in this case, the flaw was only made public 40 days after the initial report. That’s because the report included a patch to fix the vulnerability, but the developers didn’t respond to their private security mailing list.
Using a hacking technique called domain name rebinding, this vulnerability can control the broadcast interface when the target visits a malicious website. This can be further facilitated by creating a DNS name that the attacker is authorized to communicate with.
After controlling the broadcast interface, the attacker needs to change the torrent download directory to home and download a torrent named .bashrc. The attacker can also configure the broadcast to execute any command after the download is complete.
The broadcast developers have promised to release a fix as soon as possible. However, no specific date was given.
