Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 6 Mar 2016 21:12:03 +0200
From: Elad Alfassa <>
Subject: Transmission BT 2.90 Mac malware. Website compromised?

Hello oss-security.

According to these three links,

and the project homepage

The mac build of version 2.90 of the popular Transmission bittorent
client was infected by malware. However, there's not much information
about the source of the actual malware:

* How did it get to the official download location? Was it a
compromised server or someone with access abusing it to distribute
malware? What steps did the transmission project take to ensure that
the attacker no longer has access to their server? When were the
infected files uploaded to the server? And, most importantly, are
builds for other platforms and source code archive download affected
in any way?

Transmission is included in many Linux distributions (default in some
of them). If the source code archives (which are not signed, there's
only a checksum on their website, but if it was compromised then it's
not exactly useful) used by these distributions to build Transmission
were tampered with as well this might mean malicious code is already
inside the Transmission packages in these distributions. While the
malware mentioned in the link above is Mac specific, it is still
possible that other downloads have been infected by different types of

Since I couldn't find any security related email address or mailing
list for the transmission project specifically, I'm sending this to
oss-security in hopes that relevant people will see this and will shed
more light on this story.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.