{"id":73444,"date":"2023-05-28T09:02:42","date_gmt":"2023-05-28T09:02:42","guid":{"rendered":"https:\/\/www.cryptocabaret.com\/?p=73444"},"modified":"2023-05-28T09:02:42","modified_gmt":"2023-05-28T09:02:42","slug":"a-bittorrent-client-webui-shouldnt-be-shared-with-the-entire-internet","status":"publish","type":"post","link":"https:\/\/www.cryptocabaret.com\/?p=73444","title":{"rendered":"A BitTorrent Client WebUI Shouldn\u2019t Be Shared With The Entire Internet"},"content":{"rendered":"

\"pirate<\/a>The word \u2018open\u2019 in a connected world can be something positive. Open source, for example, or open library. On other occasions the opposite can be true; unnecessary ports left open on a router springs to mind.<\/p>\n

For millions of people using devices that appear to configure themselves, whether something is open or closed is irrelevant. If a device immediately works as promised, oftentimes that\u2019s good enough. The problem with some internet-connected devices is that in order to immediately work in the hands of a novice, security gives way to ease of use, and that can end in disaster.<\/p>\n

Torrent Client WebUI<\/h2>\n

Many of today\u2019s torrent clients can be operated via a web interface, commonly known as a WebUI. A typical WebUI is accessed via a web browser, with the client\u2019s IP address and a specified port number providing remote access. <\/p>\n

In a LAN environment (the part of a network behind the router, such as a home) the torrent client\u2019s web interface serves local users, i.e those with direct access to the local network, typically via Wifi. The problems begin when a torrent client\u2019s WebUI is exposed to the wider internet. In broad terms, instead of the client being restricted to IP addresses reserved for local uses (starting 192.168.0.0 or 10.0.0.0), anyone with a web browser anywhere in the world can access the UI too.<\/p>\n

In many cases, a WebUI can be secured with a password or by other means but when users are allowed to do that themselves, many never do, despite the warnings. That could end in disaster if the wrong person decides to let rip from the other side of the world.<\/p>\n

Specialized Search Engines<\/h2>\n

Internet-connected devices are easily found using services such as Shodan<\/a>, Censys<\/a>, Fofa<\/a> and Onyphe.io<\/a> and those that are poorly configured are in plentiful supply.<\/p>\n<\/p>\n

\"tixati1\"<\/a><\/center><\/p>\n

The image above shows a WebUI for the Tixati torrent client. With zero security, everything is on full display, just as it is for the person who operates the client, whoever they might be. This means that all downloads and uploads can be browsed, including data related to those transfers, as seen below.<\/p>\n<\/p>\n

\"tixati2\"<\/p>\n

It can take just a couple of minutes to find hundreds of open clients. A common WebUI seen in the wild belongs to qBittorrent but the overwhelming majority are locked down, just as they should be. <\/p>\n

That\u2019s Not Ideal<\/h2>\n

For reasons that aren\u2019t entirely clear, the Android torrent client \u2018tTorrent<\/a>\u2018 is quite popular in Russia. <\/p>\n<\/p>\n

\"ttorrent-rus\"<\/a><\/center><\/p>\n

It\u2019s possible that people install tTorrent on always-on set-top boxes, so the latest movies are ready to go as soon as they get home from work, or the local bar. The problem here is that with an entirely exposed WebUI, people can find out what Russians are downloading.<\/p>\n<\/p>\n

\"ttorrent12\"<\/a><\/center><\/p>\n

The average Russian citizen probably won\u2019t mind if outsiders discover their Mortal Kombat habit; they made the decision to download it, so that\u2019s that.<\/p>\n

But what if strangers passing by in the night had influence over content consumed locally? What if those strangers decided to utilize their control of an open WebUI to share news from the other side of the world, downloaded directly to their new friend\u2019s Android device?<\/p>\n

If they did, it might look a lot like this\u2026.<\/p>\n<\/p>\n

\"ttorrent13\"<\/a><\/center><\/p>\n

\"ttorrent11\"<\/a><\/center><\/p>\n

From: TF<\/a>, for the latest news on copyright battles, piracy and more.<\/p>\n

<\/center><\/p>\n

Powered by WPeMatico<\/a><\/small><\/p>\n","protected":false},"excerpt":{"rendered":"

The word \u2018open\u2019 in a connected world can be something positive. Open source, for example, or open library. On other occasions the opposite can be true; unnecessary ports left open on a router springs to mind. For millions of people using devices that appear to configure themselves, whether something is open or closed is irrelevant. […]<\/p>\n","protected":false},"author":2,"featured_media":73445,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[308],"tags":[],"class_list":["post-73444","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-torrent"],"_links":{"self":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts\/73444","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=73444"}],"version-history":[{"count":0,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts\/73444\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/media\/73445"}],"wp:attachment":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=73444"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=73444"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=73444"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}