uTorrent Site Compromised, Serves Malware to Downloaders
BitTorrent, the company that develops and maintains the BitTorrent protocol as well as the BitTorrent and the uTorrent software applications, announced yesterday, September 13th, that the uTorrent.com webpage and web servers were compromised.
An unknown attacker (or attackers) compromised the site and servers at about 4:20 a.m. Pacific Daylight Time and replaced the standard Windows download with a scareware program (fake antivirus that tricks the user into thinking his system is infected, then asks for money to remove the phony infection). Little after 6AM Pacific Time the BitTorrent team uncovered the breach. It took the servers offline to address the problem.
The threat has been neutralized and uTorrent servers are now back online. “We take the security of our systems and the safety of our users very seriously. We sincerely apologize to any users who were affected,” said the BitTorrent team.
The scareware the attackers replaced the standard Windows download with is a program called “Security Shield”. It behaves just like any other fake antivirus does: it keeps blasting the user with popups and prompts that claim a virus has been detected, and when the user wants to remove the virus, it asks him to pay up to remove the virus.
If you downloaded software from uTorrent.com between 4:20 a.m. and 6:10 a.m. Pacific time, it’s best to run a security scan and make sure you’re not infected. If you downloaded software from uTorrent.com and you see popups from Security Shield, you’re definitely infected. Take the appropriate measures to remove the fake antivirus. Whatever you do, do not pay – Security Shield is only trying to scam you out of your money.
The BitTorrent team initially believed that BitTorrent.com had been compromised as well. But after further analysis, it uncovered that only uTorrent.com was affected; BitTorrent.com or the BitTorrent Mainline/Chrysalis clients were not.
An unknown attacker (or attackers) compromised the site and servers at about 4:20 a.m. Pacific Daylight Time and replaced the standard Windows download with a scareware program (fake antivirus that tricks the user into thinking his system is infected, then asks for money to remove the phony infection). Little after 6AM Pacific Time the BitTorrent team uncovered the breach. It took the servers offline to address the problem.
The threat has been neutralized and uTorrent servers are now back online. “We take the security of our systems and the safety of our users very seriously. We sincerely apologize to any users who were affected,” said the BitTorrent team.
The scareware the attackers replaced the standard Windows download with is a program called “Security Shield”. It behaves just like any other fake antivirus does: it keeps blasting the user with popups and prompts that claim a virus has been detected, and when the user wants to remove the virus, it asks him to pay up to remove the virus.
If you downloaded software from uTorrent.com between 4:20 a.m. and 6:10 a.m. Pacific time, it’s best to run a security scan and make sure you’re not infected. If you downloaded software from uTorrent.com and you see popups from Security Shield, you’re definitely infected. Take the appropriate measures to remove the fake antivirus. Whatever you do, do not pay – Security Shield is only trying to scam you out of your money.
The BitTorrent team initially believed that BitTorrent.com had been compromised as well. But after further analysis, it uncovered that only uTorrent.com was affected; BitTorrent.com or the BitTorrent Mainline/Chrysalis clients were not.
