0
1
Tavis Ormandy, an IT security researcher at Google’s Project Zero has identified a critical flaw in Transmission BitTorrent app that if exploited lets attackers take full control of a targeted computer on Linux or Windows operating system.
Ormandy warned that the flaw (CVE-2018-5702) is present in Transmission Function that allows attackers to control the BitTorrent app through their web browser and other BitTorrent clients can also be their prime target.
The proof of concept published by Ormandy explains that the flaw currently works on computers running Chrome and FireFox browsers on Linux and Windows operating system. However, there are chances that the flaw might also work on other platforms such as macOS browsers if the user has enabled remote access.
Furthermore, the PoC explains, since a number of users use this function without any password, an attacker can compromise a device using domain name system (DNS) rebinding method and take control of it remotely. This explains that those who do not use this feature with a password are the prime targets of this flaw.
Moreover, the flaw allows attackers to change the download directory of torrents and use Transmission to run commands once the app finishes downloading. In a Tweet, Ormandy explained that the flaw is the “first of a few remote code execution flaws in various popular torrent clients”.
To read the original article:
https://www.hackread.com/bittorrent-flaw-linux-windows-devices-hacking/
