Ben Sarmiento
patreon
Your Real-Debrid account is compromised and you don't even know it
🕑 Added 2024-10-26 09:17:24 +0000 UTCUPDATE: Less than 1 hour of posting this, Real-Debrid has fixed the issue, thanks to u/LayeZee from r/elfhosted's report.
TL;DR: Real-Debrid’s HTTP folder links are publicly accessible without authentication, making your account vulnerable if these links are leaked or indexed. Real-Debrid needs to implement better security measures to protect user accounts.
Hey reddit,
Lately, I've seen a surge in posts about Real-Debrid accounts receiving warnings or bans. However, many of these posts lack concrete information, often speculating about old routers (lol!), dynamic mobile IPs, and other vague reasons that don’t add up. Determined to get to the bottom of this, I did some digging and discovered a potential security issue that you might not be aware of.
First off, most of you are familiar with the API token available at Real-Debrid API Token. Real-Debrid clearly states:
This token is not meant to be used into public apps, it is insecure !
Thankfully, there’s an option to refresh the token if it gets leaked, which adds a layer of security.
However, there's another "token" within your Real-Debrid account that poses a significant risk. If this token is leaked, it grants full access to your files—both torrents and downloads—and there’s currently no way to reset it.
How to Check Your Account
Visit Your Account Page: Go to Real-Debrid Account.
Locate the HTTP Folder: You'll find an HTTP folder that contains all your torrents and downloads.
Understand the Link Generation: When you click on a link within this folder, it generates a download link specific to your account. Anyone with this link can download your files.
The HTTP folder is PUBLIC. To demonstrate, just open it in an incognito/private browsing tab. It works just as well, meaning anyone with the link can access your files without any additional authentication. Real-Debrid tracks account sharing by these special download links that are tied to your account.
What if it doesn't have to be leaked? What if you could just guess? It's a 13 character token with a limited character space. If you did the math, you'll figure out that there's over 400 trillion times the number of stars in the universe combinations out there so likely it cannot be bruteforced. Yet, a well-known search engine with a bird in their logo seems to have a ton of RD HTTP folders indexed. They don't seem to care about https://my.real-debrid.com/robots.txt and just exposed a lot of accounts. Something, somewhere is leaking our files (a browser extension? Google's address bar autocomplete?), and RD is not recognizing their security flaw and blaming their users for "sharing" their accounts.
Here's the thing, unless Real-Debrid implements an authentication mechanism to the HTTP folder, your account is as good as compromised. I hope they take action! And please stop gaslighting people who are getting these warnings!
Stay safe!
