Thread: Hacked torrent client

Just got after 2 days of being trashed for cheating and finally found out that I have a hacked uTorrent client and basically go f* myself, literary

Well, not very polite, but they did have a point, so I have been wasting a couple of hours trying to find out how to identify a hacked uTorrent client (my version was 2.21 but have upgraded since) and how to avoid being hacked again. I only download from the official site if you wonder.

Since I am probably not the only one who got hacked and there are no dedicated topics I could find on T-I, I suggest the following questions for an open discussion:

1. How to identify a hacked torrent client and can the method give false positives if used on the trackers end.
2. How to avoid getting hacked
3. How to cure the hack (I upgraded but still do not know if it solved the problem)
4. Have you ever been hacked and what did you do about it

Your torrent client cannot be hacked by someone else after you have already downloaded it. You can only download a modded or "hacked" one to begin with, or you can go the safe route and use the actual torrent client website to get your client.

So you are saying you went to the official site and downloaded a modded client from there? Sounds very suspicious to me.
You can see something about modded clients on the guide to spot cheaters at the intro section

Beforehand, I must mention that I have no relevant statistics of such incidents. I have been member of private trackers for almost 3 years and this is the first incident of this nature, on only one tracker, nevertheless better to prevent than to treat.

I actually downloaded the software from the uTorrent.com site, I always try to download from offical sites or trusted sources like Softpedia.

I am not sure it was hacked, the guys did not tell me why they say it is, they just said it is hacked and that I am cheating. I believed it because they might see on their end stuff I cannot see on mine an also it seem suspicious that my uTorrent client did not show the updates to version 3.

I upgraded to uTorrent 3.1 in the mean time and but a lingering discomfort about the situation made me look for uTorrent 2.2.1 to check if the update issue is due to the hacker not wanting me update my client or it was built in.

Found an older version here
Old Version of uTorrent 2.2.1 Download - OldApps.com
Installed it on a computer without P2P clients and sure enough it is built in so my only reason for suspecting a hack is gone, uTorrent 2.2.1 does not know to upgrade to 3.x (weird!)



So maybe I did not have a hacked client (should have made a copy before upgrading in case somebody wanted to study it) so the question remains, how can you identify hacked client.

To answer quickly the questions so far.

RedMamba: I understand you are saying a uTorrent cannot e hacked after being installed, Are you sure, mallware can patch almost any program? Could then maybe an app be a source? I have Skins and TED installed but tried several before removing them

Fractal: I do not use modded clients, not unless they are from the official site. I also tend not to adopt the newest version to remain compatible across the trackers I use. The new 2.2.1 client I downloaded today from OldApps.com exhibits the same behavior as my old client, so I might not have had a hacked client after all.

The reason I feel the issue is important is simple, if I was accused of cheating for using a hacked client, without evidence presented, I only have two options believe them or not. Either way it will not help me prove I have a hacked client or not in case such allegations lead to a ban.

Is there a way to at least identify such a hack, how can a user know it has a hacked client without access to the tracker side of the data. If people who are familiar with the internals of a tracker site care to comment, is the evidence for a hacked client foolproof or can it give false positives?

Here is a question... To what end would someone bother to remotely hack your torrent client and cause it to post fake stats to your account? It would not benefit them in any way. What you are claiming makes little sense.

afacerea, dont worry about it. No one is accusing you here. I have seen in the past, staff making mistakes. However, in your answer, you mentioned you used 3.1 and quite recently, alot of trackers are banning this client due to a serious bug wth ban peers sending bad data and how utorrent handles it.

If you got it from the offical utorrent website, then its impossible that it was hacked. Either you configured it wrong, or using a "banned version client". Ive also seen users getting banned because they forgot to disable DHT and Peer sharing.

Originally Posted by PanamaExpat

Here is a question... To what end would someone bother to remotely hack your torrent client and cause it to post fake stats to your account? It would not benefit them in any way. What you are claiming makes little sense.

Exactly my point. What would the potential benefit be? If there is no benefit for a third party, and my client is "official" it remains the next open question why an official client be perceived as a hack?

Also to answer Crack0r_Jack Is just not fun being accused of cheating and I am worried it could happen again if I do not get at the bottom of why it was seen this way. I have DHT disabled as default and I also prefer 2.2.1 and reluctantly upgraded to uTorrent 3.1 only as a solution to the "hack". I am more inclined to believe at this point I was actually not hacked and must be some sort of error or miss-configuration. I was looking over this topic

http://forum.utorrent.com/viewtopic.php?id=4769&p=1

and unfortunately it seems there is little to be done in terms of identifying a hacked client. Bad news for somebody trying to defend against mall intent since is the user word against tracker techs.

Maybe you downloaded a blacklisted version, or a faulty one, but if it was from the developer site then the staff is incompetent for not blocking it from conecting to the tracker, specially such old version.

Originally Posted by Fractal

Maybe you downloaded a blacklisted version, or a faulty one, but if it was from the developer site then the staff is incompetent for not blocking it from conecting to the tracker, specially such old version.

Based on the suggestions I received here and the research I did over the past 2 days I am indeed more and more inclined to believe my client was not hacked. I might move back to Azureus (although being open source it should be even easier to hack) but I have torrents that I seed for more than 1 year and I feel sorry to loose my bragging rights :-(

Anyway back to the issue at hand, some conclusions so far:

1. Client torrents cannot be hacked form outside or there is very little incentive to do it
2. There is almost nothing one can do to identify a modded/hacked client that hides its purpose.

I found a striking example that I installed on my test computer to see if I can tell the difference:

Sacrry, on the surface it looks identical to my regular client except for blue logo instead of the regular green one:


However the "about uTorrent" reveals the hack



I did not look for other examples but I am sure there are more

3. It seems to me most hacked or modded clients will not try to hide it since they are meant to be used by users with intent to cheat ratios (that futility of cheating is discussed here Spotting a Scammer or Cheater). The good news: it is fairly easy to identify a modded/hacked client that is not trying to conceal its function to the user.

4. Finally considering to above, most users of modded clients are probably cheaters and a very small percentage are "naive" for using a cheating tool. Even so, I had to do some serious search for modded clients to find one that might pass as the real thing at first inspection, so a naive person will have a hard time justifying how it got on the computer while competent enough to find it.

Please correct me if I am wrong so far.

On a personal note, it also means my torrent client was fine and Fractal is right (thanks), but it could be miss-configured. Crack0r_Jack could you please elaborate on the Peer sharing. I have all DHT options disabled, but have 2 peer related options that are enabled by default.

Found this question answered here:
Torrentleech: DHT, PEX and local peer discovery
Will uncheck mine although I had no trouble from TL because of this in more than 2 years since I am a member.