Private Tracker users (SceneAccess) got deanonimized using BBcode injection

[zhang888 1066]

Hello, you might have heard about a recent "vulnerability" that is making some headlines,

specifically the one that allowed a private tracker user to embed an object to a 3d party location,

where he set up a sniffer with logs on his own server.

 

The full story is available on TorrentFreak:

 

https://torrentfreak.com/private-tracker-member-data-leaked-via-bbcode-exploit-160313/

 

 

Now, if you ask yourself why did Air implement the external resource redirect warning - this was

done in order to mitigate such issues, as well as many more. Another great addition by Air is the

image proxy - so now if you load an Avatar or a signature, or try to embed anything using BBcode,

that URL will be pre-processed and in case an image will be found, an external script will pick up

this image from the remote server without exposing your real IP.

 

So AirVPN community was never vulnerable to such attack classes in the first place

 

 

 

This is another good example why it is mandatory to use VPNs when you access torrent trackers or

any other content on the internet where a 3d party may log or analyze your activities.