Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

91–100 of 355 posts

Re: Transmission BitTorrent app contained malware

#91

Post by nikanj »

TazeTSchnitzel wrote: post #82
dave2000 wrote: post #75

All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it. When you can't (be b…

Beware that VMs are not necessarily secure. They can be escaped!

This argument is similar to "a condom can always break". Technically you are correct, but I'd still use one.

Re: Transmission BitTorrent app contained malware

#93

Post by azernik »

coldtea wrote: post #41
zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

> Though I think most people can't be bothered to verify the checksum on a file every time they download it. This wouldn't help anyway. If the malicious party had access to alter the downloads (as they did here) they could just as well change the checksum shown on the page to. > On the other hand, the Windows and OS X App Stores are awful. Haven't used the Windows one, but what's "awful" about the OS X one? Quick, on…

In the original thread, the initial reporters specifically pointed out that the files they had downloaded did not match the checksums on the Transmission page. My guess would be that the attackers compromised a mirror, but not the web server serving up the user-visible page with the checksum.

Re: Transmission BitTorrent app contained malware

#94

Post by nevir »

dave2000 wrote: post #87
TazeTSchnitzel wrote: post #82

Earlier quoted context omitted.

Beware that VMs are not necessarily secure. They can be escaped!

Sure, in theory. Are there any current exploits for VirtualBox? The way I see it, they're more secure that running the same apps on bare metal. Ubuntu host running a Fedora VM; the latter (with Transmission etc) only running when I need the apps running - seems an almost entirely painless way of providing a lot of security.

Unsure if there are any currently publicly known exploits, but it sure isn't unheard of for VirtualBox:

* http://arstechnica.com/security/2015/05/extremely-serious-vi...

* http://www.securityfocus.com/archive/1/495095

* https://www.cert.be/advisories/oracle-vm-virtualbox-two-priv...

* http://www.coresecurity.com/content/virtualbox-privilege-esc...

Re: Transmission BitTorrent app contained malware

#95

Post by azernik »

Looking more at this issue, it seems like the problem may have been (hard to tell, not a lot of information) a compromise of a third-party mirror to which https://www.transmissionbt.com/ redirected users; the checksum on the HTTPS site was unaltered, and was used to identify the altered download.

Perhaps a defense against this kind of attack would be an altered version of HSTS - one that protected the content of download links, and not just of sub-resources included on the page.

Re: Transmission BitTorrent app contained malware

#96

Post by alextgordon »

microtonal wrote: post #48
justsaysmthng wrote: post #32

I've become increasingly paranoid lately, given that things like these happen and major bugs are uncovered in software that I use almost every day. It's good that the Transmission developer reacted quickly and made waves so that people can at least be aware that they might have been exposed.. But I wonder how many more applications from the hundreds that I have installed on my machines contain weird stuff - either in…

If a hacker gets access to a server holding the binaries for an open source app (which most people download), the hacker can just compile the program from sources and add his own code in there and place the installer online. Code signing is used to prevent this. So, either the attacker has an Apple developer account (and is hopefully traceable through their credit card information), the Transmission project was slopp…

OK so let's imagine sandboxing is on by default, then "Transmission" pushes an update that asks for read/write access to the whole home directory. You don't know if Transmission has some legitimate need for that or not, so you just shrug and click Allow. Boom—infected.

So I think sandboxing is basically useless against these kinds of attacks. Either they allow apps to elevate their entitlements in an update, or they don't and developers will always out-out from the start (or pick the widest set of entitlements available).

If sandboxing is forced with no opt-out, then users will have to jailbreak their computers so they can install Parallels...

Re: Transmission BitTorrent app contained malware

#98

Post by orik »

Matt3o12_ wrote: post #74

Can anyone tell me if this also applies to brew's cask's builds? I needed to download CentOS the other day and wanted to go with a torrent. I got pretty pissed after I realized that BitTorrent installed some adware called Spigot. I tried to remove it as good as possible (I mainly killed the process, removed `Library/Application Support/Spigot` and ran a `sudo find / | grep -i Spigot`). Ironically I decided to use the…

My build from cask didn't start the process but force removed it anyways and am waiting for cask room to point towards 2.91.

Re: Transmission BitTorrent app contained malware

#99

Post by ikeboy »

snom380 wrote: post #90
ikeboy wrote: post #63

Earlier quoted context omitted.

I've seen whonix say this https://www.whonix.org/wiki/Download_Security >Practically it is difficult to provide SSL protected downloads at all. Many important software projects can only be downloaded in the clear, such as Ubuntu, Debian, Tails, Qubes OS, etc. This is because someone has to pay the bill and SSL (encryption) makes it more expensive. At the moment we don't have any mirror supporting SSL. We're looking f…

No, it's not true anymore. From the link you replied to: "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10 KB of memory per connection and less than 2% of network overhead. Many people believe that SSL/TLS takes a lot of CPU time and we hope the preceding numbers will help to dispel that." - Adam Langley, Google Getting an SSL certificate used to be a cost, but that…

So can you recommend a mirror for them that supports SSL?

There are multiple named projects there that aren't using SSL, and I don't think it's just laziness. If you know of a way for them to use SSL mirrors for no additional cost, I'll work on getting them to switch over.

Post reply on HN