Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

51–60 of 355 posts

Re: Transmission BitTorrent app contained malware

#51

Post by TickleSteve »

saganus wrote: post #12
rcthompson wrote: post #5

Earlier quoted context omitted.

Most people download software from websites using GUI browsers, while performing a checksum generally requires opening a terminal, changing directories to where the file was downloaded, and running the checksum program there. Maybe the web browser should provide a UI for doing checksums directly in the download manager. For example, each download entry could have a blank "checksum" text box where you can paste in the…

That would be a useful extension/plugin for browsers actually. Maybe like pointed out in another reply, not for checksums but for signatures. So you just copy/paste the signature after selecting a file, and then it can verify it's validity. Is there no such extension yet? it seems like there should be one already.

yeah, maybe they should call it something like.... https??

Re: Transmission BitTorrent app contained malware

#52

Post by wlesieutre »

sandstrom wrote: post #39
wlesieutre wrote: post #20

Earlier quoted context omitted.

Additionally, what does the malware do? "OSX.KeRanger.A" appears to be a name that Apple assigned it in their malware definitions, but Google doesn't know anything except the pages about Transmission. I'm curious what sort of malware we're looking at. Botnet? General remote access/control? Harvesting keychains?

According to this article it's ransomware. http://www.cnbc.com/2016/03/06/reuters-america-apple-users-t...

Thanks! Guess my search was too specific. The important bit:

> The malware is programmed to encrypt files on an infected personal computer three days after the original infection, according to Olson.

Anyone who may have been hit, update your backups NOW so you can restore the files.

Re: Transmission BitTorrent app contained malware

#53

Post by ianlevesque »

ikeboy wrote: post #25
resoluteteeth wrote: post #14

Earlier quoted context omitted.

> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware in…

>unless the main site is secure but the downloads aren't which is idiotic by 2016 standards anyway https adds a performance hit. The security of "checksum over https and actual file over http", if the checksum is checked, is the same as "actual file over https", barring preimage attacks.

This is a persistent myth https://istlsfastyet.com

Re: Transmission BitTorrent app contained malware

#54

Post by DavideNL »

s_kilk wrote: post #23
carlosrg wrote: post #15

Earlier quoted context omitted.

Yep, this deserves a more detailed explanation (or maybe they still don't know what happened). I updated from the previous version to 2.90 through the app built-in update, and I don't seem to have any "kernel_service" process running. Can someone that has that process in their system tell us where they downloaded the program?

> I updated from the previous version to 2.90 through the app built-in update... Same, and I also don't see any `kernel_service` process running. Fingers crossed for the in-app update not being affected by the hack.

I'd definitely run a virus scan to be sure... If you don't have one just install a Trial version and remove it again after a week.

Re: Transmission BitTorrent app contained malware

#55

Post by jakobegger »

sd8f9iu wrote: post #26
resoluteteeth wrote: post #14

Earlier quoted context omitted.

> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware in…

I thought only apps signed by "identified developers" are run by default on Macs with Gatekeeper now. Shouldn't code-signing have prevented this? Unless they inserted the malware before the signing process.

Anyone can sign up for the Apple Developer Program to become an "identified developer", so there's nothing that stops an attacker from signing their malware.

Re: Transmission BitTorrent app contained malware

#56

Post by microtonal »

zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

Unless you are a small independent app developer. Virtually no distribution wants to take proprietary software. And you have to package for a wide variety of different distributions.

On the other hand, the Windows and OS X App Stores are awful.

The Mac App store works pretty much effortless for me. It's sometimes a bit slow, but other than that it's pretty trivial to use.

Re: Transmission BitTorrent app contained malware

#57

Post by 0x0 »

moyix wrote: post #40

VirusTotal has some more info, including the files it writes: https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc... (Look under the "Behavioural information" tab) Written Files and Created Processes are interesting: [Transmission] /Users/user1/Library/kernel_service (successful) [unknown] /Users/user1/Library/.kernel_pid (successful) [unknown] /Users/user1/Library/Saved Application State/org.m0k.transmissio…

Maybe take a look around https://build.transmissionbt.com/ - but then again maybe the svn repo wasn't compromised? I tried a "svn diff svn://svn.transmissionbt.com/Transmission/tags/2.90 svn://svn.transmissionbt.com/Transmission/tags/2.91" and didn't see anything suspicious on a fast scroll-through

Re: Transmission BitTorrent app contained malware

#58

Post by [deleted] »

CiPHPerCoder wrote: post #7
rcthompson wrote: post #5

Earlier quoted context omitted.

Most people download software from websites using GUI browsers, while performing a checksum generally requires opening a terminal, changing directories to where the file was downloaded, and running the checksum program there. Maybe the web browser should provide a UI for doing checksums directly in the download manager. For example, each download entry could have a blank "checksum" text box where you can paste in the…

This doesn't solve the problem. At all. A checksum is NOT a substitute for a digital signature. https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass...

[deleted]

Re: Transmission BitTorrent app contained malware

#59

Post by microtonal »

microtonal wrote: post #48
justsaysmthng wrote: post #32

I've become increasingly paranoid lately, given that things like these happen and major bugs are uncovered in software that I use almost every day. It's good that the Transmission developer reacted quickly and made waves so that people can at least be aware that they might have been exposed.. But I wonder how many more applications from the hundreds that I have installed on my machines contain weird stuff - either in…

If a hacker gets access to a server holding the binaries for an open source app (which most people download), the hacker can just compile the program from sources and add his own code in there and place the installer online. Code signing is used to prevent this. So, either the attacker has an Apple developer account (and is hopefully traceable through their credit card information), the Transmission project was slopp…

So, either the attacker has an Apple developer account (and is hopefully traceable through their credit card information), the Transmission project was sloppy with their signing key, or the machine of the developer with the signing key was compromised.

Sorry, I forgot another possibility: some other developer's key was compromised.

Re: Transmission BitTorrent app contained malware

#60

Post by jakobegger »

ikeboy wrote: post #25
resoluteteeth wrote: post #14

Earlier quoted context omitted.

> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware in…

>unless the main site is secure but the downloads aren't which is idiotic by 2016 standards anyway https adds a performance hit. The security of "checksum over https and actual file over http", if the checksum is checked, is the same as "actual file over https", barring preimage attacks.

This attitude is completely irresponsible.

HTTPS will ensure integrity of your download automatically with no action required from the user.

Checksums require the user to perform the integrity check manually, and 99.9% of users wont bother.

Please don't put your users at risk just to save a negligibly small number of CPU cycles.

Post reply on HN