4 ms·

Official releases of the Transmission BitTorrent client might be compromised?

61 points by Reubend 3y ago

akerl_ 3y ago
Again? https://www.malwarebytes.com/blog/news/2016/09/transmission-hijacked-again-to-spread-malware/amp https://www.malwarebytes.com/blog/news/2016/09/transmission-...
deleted 3y ago
[deleted]
Rebelgecko 3y ago
Seems to happen pretty regularly
i-use-nixos-btw 3y ago
Loving the enthusiasm in which this is addressed on the issue thread.
- rendaw 3y ago
  The project members dismiss the concerns. Are you talking about the reporters?
henriquez 3y ago
It’s funny too because you have to pay for Transmission bfore Panic says you should pay $48 extra to be a pirate
- akerl_ 3y ago
  Are you thinking of Transit?
usr1106 3y ago
Redacted title. Maybe that's OK because the original title is really meaningless out of context. But at least it could mention Windows, as a Linux user I don't need to care. (Not claiming that Linux is inherintly more secure in this aspect. Packages are typically installed as root and a bad package can have fatal consequences. The bug does not discuss whether their Windows installer is signed and who signed it.)
- cyclotron3k 3y ago
  Although, this is not the first time malware has been bundled with Transmission. It's not even the second time. You have to start wondering about their overall approach to security.
  - CableNinja 3y ago
    Not sayin youre makin it up, but if you have sources about previous malware in transmission, id like to see
    - cyclotron3k 3y ago
      Sure, here you go: https://www.malwarebytes.com/blog/news/2016/09/transmission-hijacked-again-to-spread-malware/amp https://www.malwarebytes.com/blog/news/2016/09/transmission-...
      - CableNinja 3y ago
        Kinda crazy that despite this transmission devs are acting the way they are
deleted 3y ago
[deleted]
cedws 3y ago
It's scary how much of the software supply chain we assume is safe. We pull stuff off of GitHub, Docker Hub, npm all the time simply trusting the author isn't up to no good and that the source hasn't been compromised.
demarq 3y ago
Is mikedld serious? The evidence in that thread is overwhelming
throwaway67743 3y ago
Strikes as clueless developers right there, may have to reconsider choice of software...
sigmar 3y ago
When multiple people report your app release as having a keylogger, maybe don't get super defensive and actually investigate? They (two of the three lead devs) seem to just be repeating "that's not in the source code" over and over as if that excuses a supply chain compromise...
- ehPReth 3y ago
  the maintainers' response and unwillingness to investigate or ask for more information is really disappointing. perhaps it's because they're hit by false positive fatigue? but, still... an odd conversation there.

61 points by Reubend 3y ago

Again? https://www.malwarebytes.com/blog/news/2016/09/transmission-hijacked-again-to-spread-malware/amp https://www.malwarebytes.com/blog/news/2016/09/transmission-...

deleted 3y ago

[deleted]

Rebelgecko 3y ago

Seems to happen pretty regularly

i-use-nixos-btw 3y ago

Loving the enthusiasm in which this is addressed on the issue thread.

rendaw 3y ago
The project members dismiss the concerns. Are you talking about the reporters?

henriquez 3y ago

It’s funny too because you have to pay for Transmission bfore Panic says you should pay $48 extra to be a pirate

akerl_ 3y ago
Are you thinking of Transit?

usr1106 3y ago

Redacted title. Maybe that's OK because the original title is really meaningless out of context. But at least it could mention Windows, as a Linux user I don't need to care. (Not claiming that Linux is inherintly more secure in this aspect. Packages are typically installed as root and a bad package can have fatal consequences. The bug does not discuss whether their Windows installer is signed and who signed it.)

cyclotron3k 3y ago
Although, this is not the first time malware has been bundled with Transmission. It's not even the second time. You have to start wondering about their overall approach to security.
- CableNinja 3y ago
  Not sayin youre makin it up, but if you have sources about previous malware in transmission, id like to see
  - cyclotron3k 3y ago
    Sure, here you go: https://www.malwarebytes.com/blog/news/2016/09/transmission-hijacked-again-to-spread-malware/amp https://www.malwarebytes.com/blog/news/2016/09/transmission-...
    - CableNinja 3y ago
      Kinda crazy that despite this transmission devs are acting the way they are

deleted 3y ago

[deleted]

cedws 3y ago

It's scary how much of the software supply chain we assume is safe. We pull stuff off of GitHub, Docker Hub, npm all the time simply trusting the author isn't up to no good and that the source hasn't been compromised.

demarq 3y ago

Is mikedld serious? The evidence in that thread is overwhelming

throwaway67743 3y ago

Strikes as clueless developers right there, may have to reconsider choice of software...

sigmar 3y ago

When multiple people report your app release as having a keylogger, maybe don't get super defensive and actually investigate? They (two of the three lead devs) seem to just be repeating "that's not in the source code" over and over as if that excuses a supply chain compromise...

ehPReth 3y ago
the maintainers' response and unwillingness to investigate or ask for more information is really disappointing. perhaps it's because they're hit by false positive fatigue? but, still... an odd conversation there.