Transmission Malware Transmitted Through Server Hack, Downloaded 6,500 Times

Over the weekend, the first instance of Mac ransomware was found in a malicious update to the Transmission BitTorrent client. Version 2.90 of Transmission downloaded from the Transmission website was infected with "KeRanger" ransomware.

"Ransomware" is a class of malware that encrypts a user's hard drive and files, demanding money to decrypt it. In this case, KeRanger would have required Mac users to shell out a bitcoin for decryption, equivalent to approximately $400.

transmission-29
The developers behind Transmission have shared some additional details on the attack with Reuters, giving us some insight into how it occurred. The server that delivers the Transmission software to customers was breached in a cyber attack, allowing the KeRanger malware to be added to the disk-image of its software.

Transmission representative John Clay told Reuters via email that the ransomware was added to disk-image of its software after the project's server was compromised in a cyber attack.

"We're not commenting on the avenue of attack, other than to say that it was our main server that was compromised," he said. "The normal disk image (was) replaced by the compromised one."

During the time that the malware-infected version of Transmission was available, it was downloaded approximately 6,500 times before the vulnerability was discovered. Security on the server has since been increased, ensuring a similar attack can't occur a second time.

On Sunday, Transmission's developers released software updates to block the malicious software and to remove it from the Macs of users who had unwittingly installed the malicious version. Apple also updated its software protections to keep the malware from affecting Mac users and to prevent the bad version from being installed on additional machines.

Customers who have downloaded the Transmission BitTorrent client should make sure they have updated the software to version 2.92, which will remove the malware from infected computers. Additional details on how to determine if you have the malware installed are available through Palo Alto Networks.

Popular Stories

iPhone 15 Pro Cameras

iPhone 17 Pro Max Will Be First Model to Feature Three 48MP Cameras

Thursday July 11, 2024 12:20 am PDT by
Next year's iPhone 17 Pro Max will feature an upgraded 48-megapixel Tetraprism camera for enhanced photo quality and zoom functionality, according to Apple analyst Ming-Chi Kuo. In his n-iphone-tetraprism-upgrade-ca62dd37e364">latest investor note published to Medium, Kuo said the key specification change would be a 1/2.6" 48MP CIS sensor, up from the 1/3.1" 12MP sensor expected to be used...
Beyond iPhone 13 Better Blue Face ID Single Camera Hole

10 Reasons to Wait for Next Year's iPhone 17

Monday July 8, 2024 5:00 am PDT by
Apple's iPhone development roadmap runs several years into the future and the company is continually working with suppliers on several successive iPhone models simultaneously, which is why we sometimes get rumored feature leaks so far ahead of launch. The iPhone 17 series is no different – already we have some idea of what to expect from Apple's 2025 smartphone lineup. If you plan to skip...
maxresdefault

Apple's AirPods Pro 2 vs. Samsung's Galaxy Buds3 Pro

Saturday July 13, 2024 8:00 am PDT by
Samsung this week introduced its latest earbuds, the Galaxy Buds3 Pro, which look quite a bit like Apple's AirPods Pro 2. Given the similarities, we thought we'd compare Samsung's new earbuds to the AirPods Pro. Subscribe to the MacRumors YouTube channel for more videos. Design wise, you could potentially mistake Samsung's Galaxy Buds3 Pro for the AirPods Pro. The Buds3 Pro have the same...
primeday2020 feature3

The Best Early Prime Day Deals on Apple Products

Saturday July 13, 2024 6:23 am PDT by
Amazon is soon to be back with its annual summertime Prime Day event, lasting for just two days from July 16-17. As it does every year, Prime Day offers shoppers a huge selection of deals across Amazon's storefront, and there are already many deals you can get on sale ahead of the event. Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may...

Top Rated Comments

Junipr Avatar
109 months ago
I have zero sympathy for people who pirate stuff
Guessing the guys that think torrenting is strictly for piracy are the same guys that think an FBI backdoor gives us more freedom...
Score: 24 Votes (Like | Disagree)
benjitek Avatar
109 months ago
It'd be nice if the Transmission developers would explain how their site got compromised.

Still no word from them at all. We need a statement from them to show how this happened and the steps they are taking to prevent it from happening again, otherwise all trust in this developer is pretty much gone.
It's an open source project, and they're probably scrambling to get rid of it, figure out how it got there, before they make a public statement. First fix was a ransomware free version, and the 2nd included detection and removal of the ransomware. So far, that's pretty darn good ;)
Score: 7 Votes (Like | Disagree)
diddl14 Avatar
109 months ago
Guess this is why a restricted sandbox for each app is not such a bad idea...
Score: 7 Votes (Like | Disagree)
zorinlynx Avatar
109 months ago
It'd be nice if the Transmission developers would explain how their site got compromised.

Still no word from them at all. We need a statement from them to show how this happened and the steps they are taking to prevent it from happening again, otherwise all trust in this developer is pretty much gone.
Score: 7 Votes (Like | Disagree)
oneMadRssn Avatar
109 months ago
I like that the Transmission developers built-in a solution to the problem into the update, instead of just telling users to get an anti-virus to figure it out. This is good of them, and something that I don't ever see in the Windows world.
Score: 7 Votes (Like | Disagree)
TitoC Avatar
109 months ago
Torrenting is used overwhelming for pirating. I have zero sympathy for those that pirate.
First off - I have never been a fan of any torrent site or applications. I get all my files from legitimate sources and I pay for my music/videos.
I also have ZERO sympathy. But for people who know very little or who are completely oblivious to the real world use of torrenting and comment like they are in the "know" and lift their noses in disgust. I have several clients and collaborators who I constantly share very large files with. Many of my clients are game developers and video editors and they deal with large chunks of files that are much easier and quicker to download as a torrent as opposed to a large single file when collaborating.

Here are just a few examples of LEGAL everyday uses of torrenting:


* Blizzard Entertainment uses its own BitTorrent client to download World of Warcraft, Starcraft II, and Diablo III games. When you purchase one of these games and download it, you’re actually just downloading a BitTorrent client that will do the rest of the work.
* Facebook and Twitter Use BitTorrent Internally
* Many government agencies use torrent files.

While yes, most pirated items are shared and downloaded via torrent files, not all torrent files are used for pirating. That's like saying that most car thieves use coat hangers to break into cars so anyone who uses a coat hanger must be a thief. Please!
Score: 6 Votes (Like | Disagree)