I was also flabbergasted when I observed this. No idea why this is not default, but you can configure "Fail downloads" = "Executables", "Potentially dangerous" in the Sonarr Indexer options to prevent these downloads. Enable advanced settings first.
post
replies:
The author getting pissed every step of the way is really funny, great write-up!
I blacklist just about anything executable from downloading in Qbit but it stills feels a little clunky, I wish the ARRs would inspect the torrents and immediately ignore the .exe ones before they even hit Qbit, I feel like it should be a default option to help the Newbies out.
replies:
I remember spotting this when the Mario Galaxy film came out. The top seed was a 2GB exe.
I hope we come full circle and we get "Avril Lavine - Girlfriend.mp3.exe"
replies:
Settings -> Indexers -> Pick one -> Fail Downloads -> Select "Executables" and "Potentially dangerous"
You still have to remove the malware from your torrent client, but at least sonarr will give up importing it and try a different torrent.
replies:
I know that qBit has an "excluded file name" option so just add *.exe to it.
replies:
Cool to see someone pull this kind of malware apart. Interesting read.
The problem is your roommate, your parent, or 3am you double clicking it in the downloads folder. (do NOT execute execute the skid malware)>
Yeah, like any of those scrubs has access to any folders of any importance.
I've been hit by this a few times recently too. No ill effects other than needing to clear it from the queue thankfully.
I have been using cleanuparr to automate this. I have exes blocked in the download client and then cleanuparr sees they aren't being downloaded and removes them and triggers another search.
This shit is why I never used the arr stack. Never automate incoming data. It fetches what I intend it to fetch.
replies:
Shit like this is why I’m done with public trackers.
What torrent sites are affected?
replies:
I don't know why you are annoyed by this.
You use an automatic tool. It's bound to fail or make a mistake once in a while.
The "uploader" likely knew this, so they had some fun. It's not like what you are doing is legal or anything. "Le me go complain on my blog about someone messing with how I do my illegal activites".
replies:
Imagine trusting Torrents when Usenet is right there.
replies:
I've been getting exe's and such since I've been using the tech for a decade or more, though it does seem to be more common lately. I only wish sonarr would have an option to automatically blacklist and search. But at least now it does have an option to fail the download before even attempting to import it.
Rargb included a .exe which if you changed to .txt was just a message saying don't reupload. It was to prevent indexers or something with basic "don't download .exe" rules. So that is probably why it is not fail by default in Sonarr for everyone? I don't know for sure but it is something.
2 comments in c/pulse_of_truth@infosec.pub view that post
the 886 MB of random junk isn't there because scanners give up after a certain file size, it's there so the quality profiles in sonarr pick it up as a legit episode
It grabs stiky notes because a lot of people save passwords on sticky notes
all 70 comments