Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

21–30 of 355 posts

Re: Transmission BitTorrent app contained malware

#21

Post by nkulig »

carlosrg wrote: post #15
hayleox wrote: post #8

Do the developers have an explanation anywhere as to how this happened? The homepage ( https://transmissionbt.com/ ) has a big red warning to upgrade to 2.91, but I can't find any info about how someone went about putting malware in the download.

Yep, this deserves a more detailed explanation (or maybe they still don't know what happened). I updated from the previous version to 2.90 through the app built-in update, and I don't seem to have any "kernel_service" process running. Can someone that has that process in their system tell us where they downloaded the program?

I also did not have that process running in the background. I just updated through the app to 2.91 and it's still not there. So, I am also curious where they got Transmission from.

Re: Transmission BitTorrent app contained malware

#22

Post by finnn »

mhurron wrote: post #13
zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

> Linux package managers are looking like one of the only straightforward ways to distribute applications securely. Linux distributions package what is released upstream. If upstream is compromised, so is the Linux package.

Generally, Linux package maintainers grab the upstream source, while most of these compromises seem to be of the binaries. And, of course, the maintainers generally review the changes before publishing them

Re: Transmission BitTorrent app contained malware

#23

Post by s_kilk »

carlosrg wrote: post #15
hayleox wrote: post #8

Do the developers have an explanation anywhere as to how this happened? The homepage ( https://transmissionbt.com/ ) has a big red warning to upgrade to 2.91, but I can't find any info about how someone went about putting malware in the download.

Yep, this deserves a more detailed explanation (or maybe they still don't know what happened). I updated from the previous version to 2.90 through the app built-in update, and I don't seem to have any "kernel_service" process running. Can someone that has that process in their system tell us where they downloaded the program?

> I updated from the previous version to 2.90 through the app built-in update...

Same, and I also don't see any `kernel_service` process running.

Fingers crossed for the in-app update not being affected by the hack.

Re: Transmission BitTorrent app contained malware

#24

Post by wlesieutre »

ikeboy wrote: post #11

Hm. https://trac.transmissionbt.com/wiki/Changes#version-2.91 lists the following under Mac changes for 2.90 >Allow downloading files from http servers (not https) on OS X 10.11+ Mac version affected in OP was 10.10, though. Maybe it had something to do with >Change Sparkle Update URL to use HTTPS instead of HTTP (addresses Sparkle vulnerability) ? Edit: it appears the infection was downloaded from a website, in whic…

>Allow downloading files from http servers (not https) on OS X 10.11+

This reads like they disabled Apple's "App Transport Security", which only allows HTTPS connections unless a program explicitly makes an exception. Introduced in iOS 9 and OS 10.11 (El Capitan). I bet the failing HTTP connections caused a bug in Transmission, and it was an easier fix to disable ATS than to transition whatever connection to HTTPS.

https://developer.apple.com/library/prerelease/ios/documenta...

Re: Transmission BitTorrent app contained malware

#25

Post by ikeboy »

resoluteteeth wrote: post #14
zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware in…

>unless the main site is secure but the downloads aren't which is idiotic by 2016 standards anyway

https adds a performance hit. The security of "checksum over https and actual file over http", if the checksum is checked, is the same as "actual file over https", barring preimage attacks.

Re: Transmission BitTorrent app contained malware

#26

Post by sd8f9iu »

resoluteteeth wrote: post #14
zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware in…

I thought only apps signed by "identified developers" are run by default on Macs with Gatekeeper now. Shouldn't code-signing have prevented this? Unless they inserted the malware before the signing process.

Re: Transmission BitTorrent app contained malware

#27

Post by ikeboy »

saganus wrote: post #12
rcthompson wrote: post #5

Earlier quoted context omitted.

Most people download software from websites using GUI browsers, while performing a checksum generally requires opening a terminal, changing directories to where the file was downloaded, and running the checksum program there. Maybe the web browser should provide a UI for doing checksums directly in the download manager. For example, each download entry could have a blank "checksum" text box where you can paste in the…

That would be a useful extension/plugin for browsers actually. Maybe like pointed out in another reply, not for checksums but for signatures. So you just copy/paste the signature after selecting a file, and then it can verify it's validity. Is there no such extension yet? it seems like there should be one already.

Tried to search, found https://tails.boum.org/blueprint/bootstrapping/extension/, and links to https://chrome.google.com/webstore/detail/satori/oncomejlklh..., with code at https://github.com/glamrock/satori

Re: Transmission BitTorrent app contained malware

#28

Post by zepto »

zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

How is the OSX App Store 'awful' compared to a Linux package manager?

Re: Transmission BitTorrent app contained malware

#29

Post by [deleted] »

carlosrg wrote: post #15
hayleox wrote: post #8

Do the developers have an explanation anywhere as to how this happened? The homepage ( https://transmissionbt.com/ ) has a big red warning to upgrade to 2.91, but I can't find any info about how someone went about putting malware in the download.

Yep, this deserves a more detailed explanation (or maybe they still don't know what happened). I updated from the previous version to 2.90 through the app built-in update, and I don't seem to have any "kernel_service" process running. Can someone that has that process in their system tell us where they downloaded the program?

[deleted]
Post reply on HN