Hacker News

Someone on Torrent Sites Kept Fucking with My Sonarr

79 points by speckx ago | 28 comments

aftbit |next [-]

How is the *arr stack so fracking complicated? Once upon a time, all you needed was a browser, a torrent client, and VLC. Maybe your torrent client had an RSS feed built in.

Now you need 9 different pieces of software that end in *arr, all of which implement parts of the solution that you want and parts that you don't, and none of them is even a torrent client!

And they don't even work with torrent sites reliably, so people then spend money on a Usenet subscription like it's 1990 again.

bhaney |next |previous [-]

Sonarr has an advanced setting in "Settings > Indexers > [Your indexer] > Fail Downloads" which you should add "Executables" to. Then these kinds of downloads get automatically marked as failed/blacklisted and a new search and new download is attempted without you needing to manually intervene. You may also have to tweak some conflicting settings on qbit.

Alternatively, if there's a way to have qbit itself mark the download as "Failed" when it detects and refuses to download an executable, that would work too. I don't use qbit personally so I don't know if that's a thing it can be configured to do.

shmoil |next |previous [-]

If you are too lazy to join private trackers, at least use TraSH guides to set up quality profiles

https://trash-guides.info/

gradstudent |root |parent |next [-]

Join how, exactly, and for what benefit? The private trackers I've heard of are not open or you have to pay to join (lol!). From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene. I bet theres a leaderboard somewhere with weektop and sitetop numbers. I'm too old for that shit.

shmoil |root |parent |next [-]

If you are basic, then Torrentleech will cover 99.999% of your needs. It costs a few $ to join (a one time fee, and you get 1 month of free VPN), or just sign up for r/opensignups, and wait until they are open for registrations (typically once per year).

If you are too old for trackers, then just sign up for usenet. You will have to pay for it though.

lelandfe |root |parent |next |previous [-]

> The private trackers I've heard of are not open… From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene

TBF this isn’t a revival of some 90s thing, this is just how private trackers have been. What was the same in the aughts, for instance.

torben-friis |root |parent |next |previous [-]

You can get into some not paying. You're just required to either have a minimum ratio or share several days, whatever's reached sooner (so you don't get stuck sharing something nobody wants for eternity).

In practice, it's just adding an API key, setting a rule in the app to remove after x and then you can go back to ignoring it.

SSLy |root |parent |next |previous [-]

I'm on them for over 10 years. Last time I've cared about ratio was 9.

aaron695 |root |parent |previous [-]

[dead]

Havoc |next |previous [-]

> It even grabs your Sticky Notes for WHAT????

The whole sticky notes next to monitor is not a joke. I bet you could grab some crypto recovery keys this way

josu |next |previous [-]

Everything got flooded with those exes, not just South Park. All most seeded TV episodes on most public trackers were (are?) those EXEs. It will be interesting to know who launched the attack.

LoganDark |root |parent [-]

Started running bitmagnet a few weeks ago after getting fed up with BTDigg dying and other DHT crawlers actually complying with DMCA notices for some reason (???). Pretty much everything even slightly popular that I search for has one of these EXEs lying around.

egberts1 |next |previous [-]

Sonarr could have ignored those EXE filetypes, no?

hoppp |next |previous [-]

An excellent read. Thank you. I enjoyed it!

dd_xplore |next |previous [-]

The same happens for other series as well! I was frustrated with it! Good thing you decompiled this monstrosity

para_parolu |next |previous [-]

Ince I discovered usenet I rarely want to deal with torrents

stronglikedan |root |parent [-]

As someone who still pays for usenet, the benefit of torrents is anything older than a couple of days, since stuff gets pulled from usenet servers almost as soon as it's posted. Of course, if you have everything pre-configured to find and grab everything you're interested in, you won't even notice, but sometimes I just get an itch to watch something older off the cuff, and that's where torrents shine.

joloooo |next |previous [-]

Haven't seen this on usenet so far. Wonder if its more torrent prone.

redrove |root |parent |next [-]

Got this in my sabnzbd instance and had to do .exe rules there too. An exe in a linux container…very smart.

I’m as upset as OP, get a job skid.

bhaney |root |parent |previous [-]

It's by far the most common on public torrent trackers, but I occasionally see it on usenet too. Never bothered to check which indexers they tend to come from.

bastard_op |next |previous [-]

Welcome to piracy, you must be new here. This has been occurring for some time, I've seen it for years to occasionally find a media named exe to delete and manually redownload.

Scammers always have a new trick up their sleeve.

comrade1234 |next |previous [-]

Tell your downloader (in my case qbittorrent) to not download .exe, .scr, .zip, etc, etc, etc. It’s been this way for years. You do have to clean out qbittorrent every few days so that sonarr will search again, so that’s a pain. But hey, I’m pirating media. Someone trying to scam me at the same time is expected.

c-hendricks |root |parent |next [-]

Plenty of my iso's intentionally contain those names though. Really, sonarr / radarr should have implemented this a long time ago since they're the ones doing the searching, downloading, and inspecting of files: https://github.com/Sonarr/Sonarr/pull/8775

Using settings on the indexer isn't great since with Prowlarr the user doesn't actually interact with the indexer portion of Sonarr.

Doing it in release profiles by bumping down their score is a cute workaround but then the torrents will just stop saying ".exe" in their title.

Really it's a thing Sonarr have to do, as evidenced by the multiple PRs they have to try and finally do it.

yborg |root |parent |next |previous [-]

Yeah, this whole post felt like some weird deja vu from 25 years ago on a web forum. "Bastards are putting malware exe's on file sharing, wtf??"

queenkjuul |root |parent |previous [-]

Join a private tracker and never think about it again

serf |root |parent [-]

yeah!

let's all join a private tracker!

that'll fix the problem, the bad actors won't chase the crowd, and it definitely wont end in a burning of the library of alexandria loss-of-history what.cd style event again and again if the public can't archive it.

/s

how about we just create an exe/bat/com exclusion on our dumb-as-dick media downloaders like sensible people have been doing for 30+ years?

hparadiz |next |previous [-]

This has been a thing since torrents have existed.

|next |previous [-]

LoganDark |next |previous [-]

> But you put the address in the malware anyway so what's the point for fetching from Gist and YouTube????

The ability to change it, dude. Have you never written a malware before?

Often a primary concern is the security response, so you want redundancy for the ability to work around enforcement action, such as website takedowns.

Hardcoding a scapegoat into the malware itself also buys you time, so that the first enforcement action is less likely to spend your backups right away.

> And to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware.

People have been making infostealers that support hundreds or thousands of different apps and corners of your computer for decades. Plenty of vendors pride themselves on it.

Meanwhile you used LLM to write a bunch of your article, and seemingly to do the RE too...

|previous [-]