TorrentIt, which had 27,000 members at its peak, was known for having a large mix of scene and non-scene torrents, and for a very tight community. In April 2006, BREIN went after the original owner, who lived in the Netherlands, forcing the shutdown of the site under legal pressure. The TorrentIt crew decided it was better to take the site down than to have him take the heat, and took the site down.

Almost a year later in January 2007, some of the former staff members decided to bring the site back, under a new domain, one not attached to the original owner. The intention was to open by the end of May, but that never happened. The deadline was missed, and it took more than a year before the site was ready for its official relaunch.

BlastGT1, one of the original crew members, and an Admiral (equivalent to SysOp) at the new site told TorrentFreak: “Unfortunately, due to real life commitments, we missed that deadline, and after months of stagnation, I took it upon myself to find good coders within the torrent community who could help us finish the site, and try to repair the damage we had done to TiT’s good name.”

TorrentIt teamed up with the coders from DigitalHive, who were looking to start a new side project themselves, and this eventually led to the long awaited resurrection of the tracker. “Now, we’re back with a different domain, a different source and the drive to succeed,” BlastGT1 said.

“We don’t care about racing sites for pre times, we don’t care about having the biggest userbase. We care about having quality torrents, scene and non-scene, and most of all, we care about community. That is what made TorrentIt stand out before, and so many are already loving its return, finding their cabins kept warm and cozy,” BlastGT1 added.

The new and improved tracker changed its domain extension from .info to .eu, and now runs on Gazelle. Two days ago, they sent out almost 10K invites to former members, and many of them have joined the new site since. Unfortunately, an invite is needed to sign up, so not everybody will be able to celebrate and participate.

BlastGT1 has a word of advice for newcomers though: “Bide your time, get a good honest reputation elsewhere, have patience like people did once upon a time. Sooner or later you’ll make the right friend and snag an invite.”

Article from: TorrentFreak, check out our new blog at FreakBits.

Norbits is one of these trackers, a medium sized community with over 10,000 members, most of them from Norway. Norbits has suffered downtime because of DDoS attacks before, but this time the threat may be more serious than that.

In an NFO file obtained by by IT-Avisen, a group called MORRADi takes responsibility for the attack on Norbits. “Once again we show our power! Once again we show your foolishness! This is not the first time we have done it, and it won’t be the last,” they write (translated).

“Enough is enough, you are becoming a real nuisance, and you are also a bunch of idiots that try to hide, so it’s high time we punish you! P2P is not something we want, when will you understand that? Do we have to take it as far as publishing your user database online?”

The message seems to suggest that “sceners” are behind the hack and the attacks, since they don’t want their releases shared on BitTorrent trackers. IT-Avisen journalist Trond Bie thinks this is plausible, as he told Dagbladet: “I know that there are people on the FTP scene that don’t like Norbits. It’s not improbable that such a group wanted to attack the servers. It’s happened before.” Whether the group actually has access to all the IPs, usernames and transfer logs of Norbits users remains unclear.

This would not be the first time that a private BitTorrent tracker has been hacked. Earlier this year the IP-addresses of seedboxes and of top-users on some of the larger private trackers leaked to BitTorrent. Nevertheless, this kind of information is useless to anti-piracy organizations, as it is impossible to verify whether it is legit or not.

Article from: TorrentFreak, check out our new blog at FreakBits.

According to Michael Brooks, a security researcher who brought this issue to our attention, this particular TBDev exploit is down to the fact the developers didn’t protect the administrative interface from Cross Site Scripting attacks (XSS).

The attack uses CSRF in a chain with other flaws to obtain synergy – Michael calls this CSRF Bouncing.

“Unfortunately this Cross Site Scripting attack is accessible by an attacker using a Cross Site Request Forgery” Michael told TorrentFreak. “The Cross Site Scripting flaw is particularly valuable. The XSS payload is stored in the main index.php for the application. This means that an attacker can expose every visitor to their payload.”

Michael goes on: “The CSRF flaw is POST based so it does require the administrator to execute javascript. Finding the administrator account isn’t difficult if you have a user account on the system. Like with just about every SQL powered application the administrator is the first user account created. From this profile you will be able to send a personal message and you may even be able to obtain the admin’s email address.”

Worryingly, even if the attacker doesn’t have a user account, it’s possible to get one using an XSS flaw.

Michael explained how a malicious attacker increases his chances of a success with the exploit, by combining it with a little social engineering.

“In this case I am using the reflective XSS flaw to make it appear as though the administrator is viewing his own web application. The social engineering attack could look something like this: ‘I think there is a bug in your site. Can you check this link, it just does not look right http://localhost/redir.php?url=’ . This now means the flaw is no longer a “Cross Site” Request Forgery, because the request is being sent from the same website.”

After a successful attack it’s possible to deface the site and “hijack every user’s authentication token indefinitely”.

So what can be done to avoid this exploit? Michael told TorrentFreak:

“The most important thing to keep in mind is do not click on links that look like this. The link can be easily modified to be shorter, but the important part is avoiding links to TBDev’s /redir.php.”

“However this isn’t the only way that the flaw can be exploited. If you visit a website that the hacker controls then he can also trigger the attack. If you think you might have clicked on a bad link, change your password immediately.”

So what should an admin do if they already fell victim to the exploit?

“To remove the persistent XSS payload the administrator might have to login to the SQL server manually and delete the offending entry in the “news” table (since they won’t be able to use the web application to delete the news posting) using DELETE FROM news WHERE body LIKE ‘%fromCharCode%’.

The difficult part is that every user will have to change their password. In PHP I suggest defending against XSS using htmlspecialchars($var,ENT_QUOTES); . There are cases where XSS can still be possible without ENT_QUOTES. To defend against CSRF i suggest using PHP CSRF Guard.”

An administrator on a TBDev tracker we spoke with suggested a very quick fix off the top of his head:

in news.php change

$body = $_POST["body"];

to

$body = htmlspecialchars($_POST["body"],ENT_QUOTES);

We put this to Michael who told us: “The fix isn’t bad however the same fix also needs to be applied to $_GET["url"] in redir.php or the administrator account as well as others are subjected to hijack. There are other security problems with this application, but the XSS is the most serious as it leads to immediate attack.”

Earlier today TorrentFreak contacted a number of admins with details of the exploit. Michael tells us he has notified the relevant people of the flaw but it may take a few days until an official patch is made available.

The full details of the exploit are available here.

Article from: TorrentFreak, check out our new blog at FreakBits.

If you’re brand-new to a private site, it will be difficult in the beginning to acquire a 1.0 ratio. Luckily, users are given a ‘grace’ period to achieve this. Since there are so many more seeds than leechers (a total flip-flop from public BT sites), it becomes harder to upload to others – due to the fact that there are fewer people to share with.

So why go through all the trouble to keep an honest ratio? Because deep down, you’re an upstanding denizen of file-sharing society! Aside from that shameless pat-on-the-back, good ratios offer many perks, including an upgraded account on the tracker (i.e. VIP status), higher download speeds, free “invites” for your friends, and no waiting periods associated with accounts in arrears.

Here are Ten Tips to get your ratio in top-shape as fast as possible:

1. Start out with Smaller Files

Initially, opt for smaller (i.e. under 1 GB) files for downloading. This gives you a greater chance of someone coming along after you and downloading the same torrent (and you’ll be able to upload to them). Obviously a 700MB movie file will be more appealing to other site members than a 30GB ‘Blu-Ray’ rip.

2. Jump on the ‘Newly Released’ torrents

This is a great tip for increasing your ratio in a hurry. Camp out in your favorite private BT site, and refresh the torrent listings frequently. Newly added entries will have many more leechers than seeds, so you’ll be able to share (upload) more data. To maximize this tip, select smaller files – the “TV Episode” category works great for this.

3. Select Files that have a High ‘L’ or upload number

This is important. When selecting torrents, base your initial selections on a high number of leechers (the more, the better). This will ensure you have many avenues to upload to during (and after) the transfer. When starting out on a new private BT site, we would even go so far as to say that you should download torrents that you don’t want – just start grabbing torrents that have lots of leechers. Once your ratio get over the 1:1 (1.0) mark, delete them.

TIP: If one of your seeding torrents remains popular, leave it running in µtorrent permanently. This will always help to boost your upload ratio.

4. Avoid ‘Zero-Leech’ torrents

When you’re new to a private site, steer clear of the ‘zero-leech’ torrents – it is impossible to increase your share ratio when there are no other downloaders. When viewing a list of torrents, look for the “Leecher” column (or just “L”) and avoid anything that has a zero ( “0″ ) in it. After your account ratio has become relatively stable, now is the time to snag whatever you want.

5. Leave some tasks running in uTorrent

After the completed download of a torrent, leave the task running (as a seed) in µtorrent to increase your upload statistics. Don’t delete (or move) the files of a running task! You can, however, extract (unRAR) the files, or copy the files from one place to the next. In the event of a movie/video file – you’ll be able to “burn” or “extract” the *.avi file (or even play it on the PC) without affecting the seeding torrent.

TIP: Always keep a few things running as ’seeds’ in your BT client. If you notice that they aren’t uploading, replace them with newer ones.

6. Go for the ‘Freebie’ downloads

Many private sites will offer “free” torrents that won’t count against your download statistics (thus, your ratio will remain unchanged). Grab these freebies – especially when searching for torrents on a new account.

7. Use ‘Credits’ to purchase…

A popular feature among superior private BitTorrent sites is the addition of a ‘credits’ feature for account holders. Credits can be used to ‘purchase’ VIP status, increased sharing ratios and other perks. Not all sites are the same, but some credits can be acquired just from staying active in their IRC channel, or from just having the torrents available for download in your BT client.

8. Do NOT try to ‘cheat’ the Private Trackers

There are a variety of ratio cheating tips available out there, but don’t be tempted. Trackers are fairly sophisticated and ever-evolving. If you get caught cheating, you won’t even be warned – it’s a permanent ban for you and bye-bye for good.

9. Set a proper Upload Limit

Setting a proper upload limit in the BT client makes all the difference! You’ll want to supply a high enough limit to maximize uploading, but not have it eat into your download bandwidth. The general rule is to set it at 80 – 85% of your upload limit. To figure this out, visit www.speedtest.net and conduct the simple test. Results are shown in kilobits, so divide the result by 1/8 and then multiply that by 0.85. This will give you the proper number in KB/s (KiloBytes).

In µtorrent, go to OPTIONS > Preferences… > Connection and enter your upload rate. Click “Apply” and then “OK” to save the changes. While your in that same ’settings’ page, make sure to use a port number from the good list (e.g. 49152 – 65535).

10. And if all else fails…donate

Most sites allow for monetary contributions to keep up with the server costs. If you enjoy a particular site immensely but cannot seem to be able to approach a decent sharing ratio (due to turning off your computer at night, going to work, or sharing your computer with your kids, wife, husband or siblings), think about donating. In most cases even a not-so-generous gratuity will robustly affect your account status – plus you’ll feel good about helping out the BitTorrent community.

Other Tips – Follow ‘The Rules’

Yeah, we know: you hate rules! That’s why you probably moved out of your parents’ basement. Rules are probably why some turned to P2P.

Nevertheless, rules are an important aspect to private BT sites – they ensure healthy torrents and blazing-fast download speeds for all. Each site will have their “rules” posted – the link is usually not hard to find. Below are some general rules / tips that pertain to any private BitTorrent site:

Use an ‘Accepted’ BitTorrent client

Not all private trackers are the same – and each one has different rules in regards to which BitTorrent client is on the “allowable” list. Most sites recommend µtorrent, but only specific versions (or builds) of it. If you stick with v1.6.1 or the latest version v1.7.7 (recommended), you can’t go wrong with ANY private site (avoid any versions in between these numbers). And do not use BitComet on private trackers.

Proper BitTorrent client configuration:

Many trackers recommend that you disable DHT and Peer Exchange (PEX) in your BT client’s settings. To do this in µtorrent, go to OPTIONS > Preferences… > and select the BitTorrent tab. Remove the three checkmarks that pertain to DHT and PEX (see image below):

Do not ‘Hit & Run’ a Private BT site:

A ‘Hit & Run’ (or H&R) is when someone joins a private tracker, and downloads as much as they can before making off without uploading to a proper ratio. While this practice is frowned upon even on public sites such as mininova.org, it is deplorable to private sites. This can (and sometimes will) lead to your IP address being banned from the site – forever.

Stick within these guidelines for HAPPY Torrenting!

Article from: TorrentFreak, check out our new blog at FreakBits.

Why would anyone bother accessing a private site when you can get great stuff from PirateBay or Mininova? Most users cite better download speeds, great timing and availability of content while others believe they have better security. Most private trackers require that the user maintains a good ‘ratio’ – i.e he uploads back to the community the amount of data that he took. Because this behavior is monitored and enforced by a range of punishments, the user tends to seed more to avoid them. The ultimate punishment for not sharing is banning, which means the member can no longer access the content indexed within, well – that’s usually the case.

Information has been published showing a method for non-members to access and download stuff from private sites, using the (optional) Azureus Peer Injector plug-in and lists of peers (BitTorrent users IP addresses and ports they use) harvested from well known private trackers. Usually it’s the tracker on a site that decides if you can join the swarm or not (while recording your stats/ratio) but by using this method it’s theoretically possible to enter the swarm of a particular torrent without ever connecting to the tracker. The theory says that as long as you can access a .torrent file originating from the site (via a torrent dump site such as mininova, a friend or the site’s unprotected RSS feed for example) plus an accurate and up to date peerlist, you can download without being a member, ratio-free.

However useful this might sound to some, there is a cost. For the method to work, the group needs to harvest user’s IP addresses from each tracker they wish to exploit and make them available for people to download. They appear to have already compromised the privacy of users of TorrentLeech and SceneTorrents by publishing their IP addresses in a peerlist, at the same time claiming the method improves the individual’s privacy.

Its common on P2P forums for people to debate the benefits and drawbacks of public and private sites. Some feel private sites restrict, while others understand that a site’s growth sometimes needs to be artificially limited due to technical, staffing or budget issues. Some feel it’s wrong to ring-fence the available media and that it should really be ’set-free’ while others feel that it’s neat being a member at a fast tracker with great image and they’re quite happy at being part of an ‘exclusive’ club.

In any event, I guess both parties are on roughly the same side in the end and they would likely agree – although of limited use on their own, the user’s IPs on sites like TorrentLeech, SceneTorrents and any other tracker should definitely be kept as private as possible, even if others believe the torrents shouldn’t be.

Article from: TorrentFreak, check out our new blog at FreakBits.

Shortly after we published, we had a contact from Milen Georgiev Dzhumerov, a regular reader of TorrentFreak and Mac software programmer. “When I saw the Tracker Checker I thought it was a great idea – so simple and useful” he said, “I’m waiting to start uni in October, I’ve got nothing better to do except write software! As I am a Mac user, I decided to create a Mac version of the app.”

The application arrives in .DMG format at just 221kb. Full installation instructions are included in the README file but it’s simply a question of dragging the software’s icon (created by YellowIcon) into the ‘Applications’ folder.

Launching is achieved by browsing to the app and double-clicking it. The .DMG file comes with a trackers.xml file (containing the tracker information) and is pre-configured with 67 trackers. Simply navigate to the .DMG, select the trackers.xml and import it.

There are 4 main buttons on the toolbar (created by Matt Ball Design):

Reload – Manually “reloads” all trackers
Add – Adds a new tracker to the list
Remove – Removes the currently selected tracker
Info – Opens the “Tracker Inspector” allowing the modification of tracker properties.

In the lower right corner there is a setting for selecting how many concurrent connections to open when checking the trackers. Tested on an 8mbit down connection, 15-20 connections produced ideal results.

Positive match type in the ‘Inspector’ is defined as marking the tracker as open if the find string is found and negative is just reversing the result of whatever the positive is returning, i.e if it doesn’t find the string you have selected negative, the tracker will be marked as open.

One of the criticisms leveled at the PC version of Tracker Checker 2 was that it checked sites for signups at a too regular interval of just 60 seconds. The Mac version addresses this with the chance for the user to choose the update interval.

Milen goes on to explain that he had another motive to develop the app: “The other reason for doing it was to actually see how good Cocoa stacks up against .NET/Java for simple applications like this one. I wanted to prove to myself that you can write applications in Cocoa rapidly. I would say that the app took me about a day/day and a half of proper work (I’m subtracting the time where I jumped in to play some games or watch a movie). I didn’t encounter any problems when using Apple’s well-designed frameworks and I’m very happy with how it turned out.”

More features are planned for the next release:

- Localization (definitely German + unconfirmed others)
- Growl support
- HTTP authentication and redirection support

Anyone wishing to translate the app, suggest features or report bugs, should get in touch with Milen on gamehack@gmail.com

Article from: TorrentFreak, check out our new blog at FreakBits.

Update June 26, 2007
Demonoid Offline For a Few Days

Update January 3 2007

Demonoid is currently down for maintenance
Will be back soon

Just to let you know, demonoid.com is open for registration. Demonoid is one of the biggest private torrent sites on the web and the most widely used BitTorrent tracker, together with the piratebay.

Get in before it’s too late.

You will be rewarded!

Article from: TorrentFreak, check out our new blog at FreakBits.