A vulnerability in the popular BitTorrent Transmission application allows malicious users to remotely control computers running the program. The revelation was made by Google Project Zero researcher Tavis Ormandy who said that there is a possibility that the same security flaw exists in other BitTorrent clients.
The flaw lies in the feature that allows users to control BitTorrent from the programs browsing and this feature is available in most BitTorrent applications out there. 
Ormandy he also says, that many are running those without a password because they believe that physical access to the system is required by hackers. But if someone who knows uses an attack method called DNS rebinding can take control of the computer running the application.
All it takes is a web page that hosts the malicious code needed to exploit the vulnerability. At the moment it seems that both Google Chrome and the Mozilla Firefox on Windows and Linux can be used for the attack.
The technical analysis of the vulnerability shows that hackers can change their download list torrents and at the same time use Transmission to run commands when downloads are finished.
The worst thing is that Transmission programmers have so far ignored Ormandy who says he has been contacting them for a long time.
Please note that all the security flaws discovered by Project Zero are publicly disclosed 90 days after the company that developed the application. In the event that the company has not released any vulnerability update, Project Zero policy allows the vulnerability to be publicly announced. This time, however, Ormandy decided to publish all the details 40 days after the vulnerability was announced.
But see the following image from the qBitTorrent I use:
And below the web ui of Transmission:
According to the above images, I should mention that BitTorrent clients I know and I have used this feature disabled by default, so the Ormandy rush was probably not needed.
Have you met a client with remote control enabled?
