A member of support staff at Xirvik, a company selling seedboxes and other related services, told us a little about b4rt and the serious exploit one of their customers has just discovered.

“Torrentflux-b4rt is one of the major fully multi-user BitTorrent frontends that exist. It supports several clients (such as BitTornado and Transmission), the source code is available, and it’s been around for a long time.”

Xirvik told TorrentFreak that they have discovered a major bug in TorrentFlux-b4rt, one which could lead to users having access to other users’ torrents. While that might not initially sound that threatening, for private tracker users it constitutes quite a security breach. Contained in those .torrent files is the user’s unique torrent passkey which allows sharing on a private site. Getting access to this allows the attacker to masquerade as the other user on private trackers

A user can access another user’s torrents if he already knows the exact name of the torrent (easy to find from any search engine) and provided, of course, it is present on the server.

“Given a torrent with a name such as Ubuntu.8.10.Server-CANONICAL.torrent that already exists on the server, another user could upload another torrent with the name ubuntu.8.10.server-canonical.torrent (not necessarily all lowercase – just one different character is enough) and get access to the first file,” Xirvik explains.

Luckily Xirvik has not only found the bug and reported it, but have also worked on a fix which can be found here on the TorrentFlux-b4rt forums.

Source: Seedboxes Beware: Major Bug in TorrentFlux-b4rt

Torrentflux-b4rt started out as an attempt to integrate all the existing torrentflux hacks that users have made over the years. As they explain on their website: “torrentflux-b4rt was an attempt to sidestep the complicated mess of adding hacks and modifications to the base torrentflux system in a random way, as well as allowing users more choice in which BitTorrent clients they used with torrentflux.”

The software currently includes 4 different BitTorrent clients, Azureus, Transmission, BitTorrent mainline and BitTornado, which can be configured separately for every .torrent you download. In addition it can handle .nzb files to download easily from Usenet, and uses wGet to download files over HTTP/FTP.

Torrentflux-b4rt is pretty much a fully-featured filesharing portal, it comes with a built in file-manager that can extract rar-archives, and a great web-player (VLC) that allows you to stream media files to your local computer. The software is easy to install and configure through any web browser. It is an ideal solution if you want to manage your downloads on a computer other than your desktop machine.

The software runs on any Unix like OS. It has a command line version for advanced users, so you can set cron jobs to watch folders for new torrent files, automatically download .torrent files from RSS feeds, and much more.

Below is a screenshot of the index page, more info and screenshots can be found at TorrentFlux b4rt’s homepage.

Click to enlarge

Source: Download from BitTorrent and Usenet with Your Web Server