While we're here, can anyone recommend a good antivirus for OSX?
I've just been looking at BitDefender, which looks promising, but would rather get this right than faff around with potentially crappy AV tools.
Transmission BitTorrent app contained malware
61–70 of 355 posts
Re: Transmission BitTorrent app contained malware
#62Earlier quoted context omitted.
It's quite popular everywhere. Interesting that 2.90 just showed up in Fedora updates.
At least Linux distributions usually compile from source. I wonder if the source was also modified, or only the binaries. EDIT: I downloaded the Transmission 0.90 and 0.91 source code and took a look. The diff between them is quite small, with nothing suspicious being removed, and the 0.90 .tar.xz MD5 matches what Fedora used (according to http://pkgs.fedoraproject.org/cgit/rpms/transmission.git/com... ). So, unless…
> I wonder if the source was also modified, or only the binaries.
Personally, pending further information, I've removed Transmission from my machine.
Re: Transmission BitTorrent app contained malware
#63Earlier quoted context omitted.
>unless the main site is secure but the downloads aren't which is idiotic by 2016 standards anyway https adds a performance hit. The security of "checksum over https and actual file over http", if the checksum is checked, is the same as "actual file over https", barring preimage attacks.
This is a persistent myth https://istlsfastyet.com
I've seen whonix say this
https://www.whonix.org/wiki/Download_Security
>Practically it is difficult to provide SSL protected downloads at all. Many important software projects can only be downloaded in the clear, such as Ubuntu, Debian, Tails, Qubes OS, etc. This is because someone has to pay the bill and SSL (encryption) makes it more expensive. At the moment we don't have any mirror supporting SSL. We're looking for SSL supported mirrors to share the load.
Is it not true that mirrors supporting SSL are more expensive?
Re: Transmission BitTorrent app contained malware
#64I've become increasingly paranoid lately, given that things like these happen and major bugs are uncovered in software that I use almost every day. It's good that the Transmission developer reacted quickly and made waves so that people can at least be aware that they might have been exposed.. But I wonder how many more applications from the hundreds that I have installed on my machines contain weird stuff - either in…
> Open source software is especially vulnerable ... the hacker can just compile the program from sources and add his own code
You must be too young to remember how computer viruses originally spread by way of modified executable files: http://computervirus.uw.hu/ch04lev1sec2.html
Re: Transmission BitTorrent app contained malware
#65Earlier quoted context omitted.
Most people download software from websites using GUI browsers, while performing a checksum generally requires opening a terminal, changing directories to where the file was downloaded, and running the checksum program there. Maybe the web browser should provide a UI for doing checksums directly in the download manager. For example, each download entry could have a blank "checksum" text box where you can paste in the…
This doesn't solve the problem. At all. A checksum is NOT a substitute for a digital signature. https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass...
Right. All I have to do is distribute the correct hash for my binary as a malicious software distributor because there's no authenticity verification at all, only that the bits in my binary blob match a certain pattern.
Re: Transmission BitTorrent app contained malware
#66Earlier quoted context omitted.
> I updated from the previous version to 2.90 through the app built-in update... Same, and I also don't see any `kernel_service` process running. Fingers crossed for the in-app update not being affected by the hack.
I'd definitely run a virus scan to be sure... If you don't have one just install a Trial version and remove it again after a week.
Noted: I've gone with BitDefender from the Map App Store. Will report back results.
EDIT: welp, BitDefender found nothing, all clear.
Re: Transmission BitTorrent app contained malware
#67Do the developers have an explanation anywhere as to how this happened? The homepage ( https://transmissionbt.com/ ) has a big red warning to upgrade to 2.91, but I can't find any info about how someone went about putting malware in the download.
Yep, this deserves a more detailed explanation (or maybe they still don't know what happened). I updated from the previous version to 2.90 through the app built-in update, and I don't seem to have any "kernel_service" process running. Can someone that has that process in their system tell us where they downloaded the program?
Agreed. I don't have the process running either.
Screenshot of Transmission 2.90 red warning to update to 2.91.
http://imgur.com/aQdHJ3b
Re: Transmission BitTorrent app contained malware
#68It seems that is a ransomware campaign
http://www.reuters.com/article/us-apple-ransomware-idUSKCN0W...
Next monday, tomorrow could pave terror on the office.
Re: Transmission BitTorrent app contained malware
#69Earlier quoted context omitted.
>unless the main site is secure but the downloads aren't which is idiotic by 2016 standards anyway https adds a performance hit. The security of "checksum over https and actual file over http", if the checksum is checked, is the same as "actual file over https", barring preimage attacks.
This attitude is completely irresponsible. HTTPS will ensure integrity of your download automatically with no action required from the user. Checksums require the user to perform the integrity check manually, and 99.9% of users wont bother. Please don't put your users at risk just to save a negligibly small number of CPU cycles.
Granted, the project I saw this reasoning on (https://www.whonix.org/wiki/Download_Security) is one where users are especially likely to do security checks, and they generally aren't satisfied with the security of SSL anyway.
> just to save a negligibly small number of CPU cycles
The link above says they can't afford the additional cost. If it's so negligible, would you sponder the cost of those extra cycles? I'm sure they would host on SSL if someone covered the cost.
Re: Transmission BitTorrent app contained malware
#70While we're here, can anyone recommend a good antivirus for OSX? I've just been looking at BitDefender, which looks promising, but would rather get this right than faff around with potentially crappy AV tools.
It seems an up to date OS is the way to go (as in this case it was detected by OSX)