Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 249264

Summary: net-p2p/transmission-1.22 acts as a spyware
Product: Gentoo Security Reporter: Vault13 <go0>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED INVALID    
Severity: normal    
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard:
Package list:
Runtime testing required: ---
Attachments:
Description Flags
full strace output, strace wrapper script and emerge--info none

Description Vault13 2008-11-29 14:45:20 UTC
Transmission man page says "transmission is a fast and easy BitTorrent client"

In my experience transmission is slow-to-stop spyware. It does not stop when I tell it so. It accesses network before I ask it to do anything.

To experience infinite stop time: remove all network cables, start transmission by typing its name in the terminal, attempt to close the program by pressing mouse on the cross in the upper-right corner. It does not close for several hours (I waited for the whole night)

To see what it is doing, use strace

IMHO transmission tries to talk to gateway (my gateway is 192.168.50.1) and find smth on the Internet. 
================================= strace output fragment start ==============
open("/proc/net/route", O_RDONLY) = 19
fstat(19, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaaceb1000
read(19, "Iface\tDestination\tGateway \tFlags\tRefCnt\tUse\tMetric\tMask\t\tMTU\tWindow\tIRTT                                                       \neth1\t0032A8C0\t00000000\t0001\t0\t0\t0\t00FFFFFF\t0\t0\t0                                                                               \nlo\t0000007F\t00000000\t0001\t0\t0\t0\t000000FF\t0\t0\t0                                                                                 \neth1\t00000000\t0132A8C0\t0003\t0\t0\t0\t00000000\t0\t0\t0                                                                               \n", 1024) = 512
close(19)                               = 0
munmap(0x2aaaaceb1000, 4096)            = 0
connect(18, {sa_family=AF_INET, sin_port=htons(5351), sin_addr=inet_addr("192.168.50.1")}, 16) = 0-1.22
gettimeofday({1227968655, 376751}, NULL) = 0
sendto(18, "\0\0", 2, 0, NULL, 0)       = 2
gettimeofday({1227968655, 376820}, NULL) = 0
gettimeofday({1227968655, 376848}, NULL) = 0
gettimeofday({1227968655, 376871}, NULL) = 0
gettimeofday({1227968655, 376892}, NULL) = 0
socket(PF_FILE, SOCK_STREAM, 0)         = 19
connect(19, {sa_family=AF_FILE, path="/var/run/minissdpd.sock"}, 110) = -1 ENOENT (No such file or directory)
close(19)                               = 0
socket(PF_FILE, SOCK_STREAM, 0)         = 19
connect(19, {sa_family=AF_FILE, path="/var/run/minissdpd.sock"}, 110) = -1 ENOENT (No such file or directory)
close(19)                               = 0
socket(PF_FILE, SOCK_STREAM, 0)         = 19
connect(19, {sa_family=AF_FILE, path="/var/run/minissdpd.sock"}, 110) = -1 ENOENT (No such file or directory)
close(19)                               = 0
socket(PF_FILE, SOCK_STREAM, 0)         = 19
connect(19, {sa_family=AF_FILE, path="/var/run/minissdpd.sock"}, 110) = -1 ENOENT (No such file or directory)
close(19)                               = 0
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 19
setsockopt(19, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
bind(19, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("0.0.0.0")}, 16) = 0
sendto(19, "M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:InternetGatewayDevice:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\n\r\n", 137, 0, {sa_family=AF_INET, sin_port=htons(1900), sin_addr=inet_addr("239.255.255.250")}, 16) = 137
poll([{fd=19, events=POLLIN}], 1, 2000) = 0
sendto(19, "M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:service:WANIPConnection:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\n\r\n", 132, 0, {sa_family=AF_INET, sin_port=htons(1900), sin_addr=inet_addr("239.255.255.250")}, 16) = 132
poll([{fd=19, events=POLLIN}], 1, 2000) = 0
sendto(19, "M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:service:WANPPPConnection:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\n\r\n", 133, 0, {sa_family=AF_INET, sin_port=htons(1900), sin_addr=inet_addr("239.255.255.250")}, 16) = 133
poll([{fd=19, events=POLLIN}], 1, 2000) = 0
sendto(19, "M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: upnp:rootdevice\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\n\r\n", 101, 0, {sa_family=AF_INET, sin_port=htons(1900), sin_addr=inet_addr("239.255.255.250")}, 16) = 101
poll([{fd=19, events=POLLIN}], 1, 2000) = 0
close(19)                               = 0
gettimeofday({1227968663, 374988}, NULL) = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 19
fcntl(19, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
setsockopt(19, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
bind(19, {sa_family=AF_INET, sin_port=htons(51413), sin_addr=inet_addr("0.0.0.0")}, 16) = 0
gettimeofday({1227968663, 375120}, NULL) = 0
listen(19, 5)                           = 0
accept(19, 0x40803f60, [15404562534010716176]) = -1 EAGAIN (Resource temporarily unavailable)
epoll_wait(13, {{EPOLLIN, {u32=7855568, u64=7855568}}}, 1023, 1000) = 1
clock_gettime(CLOCK_MONOTONIC, {291720, 921402209}) = 0
read(11, "r", 1)                        = 1
read(11, "\0\301C\0\0\0\0\0\220\235w\0\0\0\0\0", 16) = 16
gettimeofday({1227968663, 375321}, NULL) = 0
recvfrom(18, 0x40803ed0, 16, 0, 0x40803ec0, 0x40803eec) = -1 EAGAIN (Resource temporarily unavailable)
================================= strace output fragment end  ==============

Neither man page or files in usr/share/doc/transmission-1.22, nor any preference option suggest any network activity in idle state. 

I want all my software to start and stop for a fraction of second, but not to loop infinetly 

I want no virusware/spyware on my computer

I suggest that net-p2p/transmission be removed from gentoo portage tree
Comment 1 Vault13 2008-11-29 14:47:33 UTC
Created attachment 173761 [details]
full strace output, strace wrapper script and emerge--info
Comment 2 Robert Buchholz (RETIRED) gentoo-dev 2008-11-29 16:05:57 UTC
I cannot reproduce your infinite loop when starting without network connection with transmission 1.33 -- can you please try with that?

As far as contacting the gateway goes, this is perfectly fine and documented behaviour, and is caused by having upnp (via libnatpmp) enabled. Please bother to check your source code before claiming spyware activities.