With great displeasure we need to inform you that a malicious actor has successfully carried out a massive peer scraping attack on our tracker on Thursday.
The unknown actor has downloaded the majority of our torrent files and corresponding peer lists.
This means the malicious third party is now in possession of most of our users' torrent client information (seeding IP, client port, torrents seeded).
As far as we can observe their immediate goal is downloading a huge part of our library, but we do not know if they have further plans with the collected data.
As a mitigation, we recommend that users change their torrent client ports, or seeding IP (for example users seeding from behind a VPN) if possible to thwart whatever (further) intentions the attacker has.
We detected the attack about six hours after the peer scraping had been carried out. Unfortunately there is nothing we can do about this incident at this point, other than preventing the malicious user's further access to our site and tracker.
This attack should have been prevented by code we have in place, but for a yet unknown reason was not. Since the moment we noticed the incident we have devised, and in parts already implemented, further protection mechanisms. However, this whole incident is most dissatisfying for us, as we recognize the sensitive nature of the data. We strive to do better.
"Update 1: changing the ports of your bittorrent is to stop the actor from being able to find you in the swarm and download from you. We doubt they are interested in your identity, only the data."
Source Reddit
The unknown actor has downloaded the majority of our torrent files and corresponding peer lists.
This means the malicious third party is now in possession of most of our users' torrent client information (seeding IP, client port, torrents seeded).
As far as we can observe their immediate goal is downloading a huge part of our library, but we do not know if they have further plans with the collected data.
As a mitigation, we recommend that users change their torrent client ports, or seeding IP (for example users seeding from behind a VPN) if possible to thwart whatever (further) intentions the attacker has.
We detected the attack about six hours after the peer scraping had been carried out. Unfortunately there is nothing we can do about this incident at this point, other than preventing the malicious user's further access to our site and tracker.
This attack should have been prevented by code we have in place, but for a yet unknown reason was not. Since the moment we noticed the incident we have devised, and in parts already implemented, further protection mechanisms. However, this whole incident is most dissatisfying for us, as we recognize the sensitive nature of the data. We strive to do better.
"Update 1: changing the ports of your bittorrent is to stop the actor from being able to find you in the swarm and download from you. We doubt they are interested in your identity, only the data."
Source Reddit