Torrentreactor breach serves potent exploit cocktail
iframe redirection redux
Torrentreactor has long been regarded as one of the top bit torrent search engines, and with the demise of The Pirate Bay, it's likely bigger than ever. Now, it's been breached and is serving a potent cocktail of exploits to people browsing the site, Websense Security Labs says.
Attackers have managed to inject an iframe into the site that scours Torrentreactor visitors' computers from a long list of vulnerable applications, including Adobe's Reader and Shockwave programs and Microsoft's Internet Explorer and Office Snapshot Viewer. When it finds one, it downloads and runs a malicious file.
This isn't the first time that security researchers have reported Torrentreactor is foisting malware on its users. In March 2008, the site suffered a similar iframe attack, according to Dancho Danchev.
The malicious file in the latest compromise communicates with a server at 220.127.116.11, an IP address that web searches suggest has ties to the Russian Business Network. We'll be steering clear of this site for the time being. ®
...it misses the step of downloading infected files out.
As poster above says, if it wasn't for the crap we receive, I wouldn't care. Download and visit dodgy stuff, pay the price....
Now to order those penis enlarging, fat busting, cancer beating pills from the mail in my inbox....it's on the web, so must be safe.
If these muppet users were not then used to send me SPAM, id say f*** the lot of em and keep quiet, after all the users are a bunch of krooks anyway. Shame their illegal activities will result in more friggin SPAM in my inbox!
Playing it safe!
iptables -I INPUT -s 18.104.22.168 -j DROP