Transmission BitTorrent app contained malware • Hacker News Board

Re: Transmission BitTorrent app contained malware

#111

Post by Sammi » Sun, Mar 06, 2016, 8:14 PM UTC

noondip wrote: post #86

moyix wrote: post #40

VirusTotal has some more info, including the files it writes: https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc... (Look under the "Behavioural information" tab) Written Files and Created Processes are interesting: [Transmission] /Users/user1/Library/kernel_service (successful) [unknown] /Users/user1/Library/.kernel_pid (successful) [unknown] /Users/user1/Library/Saved Application State/org.m0k.transmissio…

Here's an analysis of the malware - http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...

Copy/pasting the helpful parts of that article:

How to Protect Yourself

Users who have directly downloaded Transmission installer from official website after 11:00am PST, March 4, 2016 and before 7:00pm PST, March 5, 2016, may be been infected by KeRanger. If the Transmission installer was downloaded earlier or downloaded from any third party websites, we also suggest users perform the following security checks. Users of older versions of Transmission do not appear to be affected as of now.

We suggest users take the following steps to identify and remove KeRanger holds their files for ransom:

1. Using either Terminal or Finder, check whether /Applications/Transmission.app/Contents/Resources/ General.rtf or /Volumes/Transmission/Transmission.app/Contents/Resources/ General.rtf exist. If any of these exist, the Transmission application is infected and we suggest deleting this version of Transmission.

2. Using “Activity Monitor” preinstalled in OS X, check whether any process named “kernel_service” is running. If so, double check the process, choose the “Open Files and Ports” and check whether there is a file name like “/Users//Library/kernel_service” (Figure 12). If so, the process is KeRanger’s main process. We suggest terminating it with “Quit -> Force Quit”.

3. After these steps, we also recommend users check whether the files “.kernel_pid”, “.kernel_time”, “.kernel_complete” or “kernel_service” existing in ~/Library directory. If so, you should delete them.

Re: Transmission BitTorrent app contained malware

#112

Post by thesimon » Sun, Mar 06, 2016, 8:14 PM UTC

jakobegger wrote: post #55

sd8f9iu wrote: post #26

Earlier quoted context omitted.

I thought only apps signed by "identified developers" are run by default on Macs with Gatekeeper now. Shouldn't code-signing have prevented this? Unless they inserted the malware before the signing process.

Anyone can sign up for the Apple Developer Program to become an "identified developer", so there's nothing that stops an attacker from signing their malware.

And according to the analysis [0], this is exactly what they did. They used a different cert to sign their malware.

I have to admit that Windows' UAC is better in that regard, as it shows the signees name. But of course this is only useful if you know the "right" name.

[0] http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...

Re: Transmission BitTorrent app contained malware

#113

Post by nmjohn » Sun, Mar 06, 2016, 8:15 PM UTC

ikeboy wrote: post #69

jakobegger wrote: post #60

Earlier quoted context omitted.

This attitude is completely irresponsible. HTTPS will ensure integrity of your download automatically with no action required from the user. Checksums require the user to perform the integrity check manually, and 99.9% of users wont bother. Please don't put your users at risk just to save a negligibly small number of CPU cycles.

Granted, the project I saw this reasoning on ( https://www.whonix.org/wiki/Download_Security ) is one where users are especially likely to do security checks, and they generally aren't satisfied with the security of SSL anyway. > just to save a negligibly small number of CPU cycles The link above says they can't afford the additional cost. If it's so negligible, would you sponder the cost of those extra cycles? I'm s…

Quote from a google engineer in 2010 (it's only gotten cheaper in the last 6 years w/ advances in CPU tech) regarding SSL overhead:

> On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that. [0]

[0]: https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...

Re: Transmission BitTorrent app contained malware

#114

Post by mixologic » Sun, Mar 06, 2016, 8:15 PM UTC

mmgutz wrote: post #16

Does installing 2.9.1 remove it completely or just from the Transmission app? I'm concerned the malware is still there.

Looks like the developer is working on a version that will remove the malware if it has been installed :https://github.com/transmission/transmission/commit/dc60d256...

Re: Transmission BitTorrent app contained malware

#115

Post by ikeboy » Sun, Mar 06, 2016, 8:17 PM UTC

nmjohn wrote: post #113

ikeboy wrote: post #69

Earlier quoted context omitted.

Granted, the project I saw this reasoning on ( https://www.whonix.org/wiki/Download_Security ) is one where users are especially likely to do security checks, and they generally aren't satisfied with the security of SSL anyway. > just to save a negligibly small number of CPU cycles The link above says they can't afford the additional cost. If it's so negligible, would you sponder the cost of those extra cycles? I'm s…

Quote from a google engineer in 2010 (it's only gotten cheaper in the last 6 years w/ advances in CPU tech) regarding SSL overhead: > On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help…

None of affects the point they're making, which is that they can't find SSL mirrors that aren't more expensive. If you find one, let them know and I'm sure they'll be happy to switch over.

Re: Transmission BitTorrent app contained malware

#116

Post by CiPHPerCoder » Sun, Mar 06, 2016, 8:20 PM UTC

rhizome wrote: post #110

Hydraulix989 wrote: post #65

Earlier quoted context omitted.

Right. All I have to do is distribute the correct hash for my binary as a malicious software distributor because there's no authenticity verification at all, only that the bits in my binary blob match a certain pattern.

Is that supposed to be sarcasm? Hard to tell.

I suspect not.

Re: Transmission BitTorrent app contained malware

#117

Post by pfg » Sun, Mar 06, 2016, 8:20 PM UTC

en4bz wrote: post #85

darfs wrote: post #6

Isn't it quite popular on Debian and derivates too? It's Pre-installed with GNOME there as far as I know. Fair enough, it's extremly interesteing. Never saw such an infection in the "free World", outside the laboratory. I hope they can find the source.

It seems the most recent version is 2.84 on ubuntu 15.10. The last update to the package was on July 2015.

There's a fairly popular PPA which is currently on 2.90[1]. However, it seems like only OS X binaries included malware (... hopefully).

[1]: https://launchpad.net/~transmissionbt/+archive/ubuntu/ppa

Re: Transmission BitTorrent app contained malware

#118

Post by 0x0 » Sun, Mar 06, 2016, 8:25 PM UTC

mixologic wrote: post #114

mmgutz wrote: post #16

Does installing 2.9.1 remove it completely or just from the Transmission app? I'm concerned the malware is still there.

Looks like the developer is working on a version that will remove the malware if it has been installed : https://github.com/transmission/transmission/commit/dc60d256...

Interesting and scary. Wouldn't that risk removing any chance of actually recovering files (by paying the ransom?)

Re: Transmission BitTorrent app contained malware

#119

Post by nikanj » Sun, Mar 06, 2016, 8:28 PM UTC

MichaelGG wrote: post #103

It's not. Condoms aren't used against a hostile opponent. If your partner is intent on exposing you, a condom won't provide any protection.

I can't think of a more hostile opponent than an HIV virus. And we're still not sure if Transmission was spreading the virii intentionally, making the condom analogy even more fitting.

Re: Transmission BitTorrent app contained malware

#120

Post by Mandatum » Sun, Mar 06, 2016, 8:29 PM UTC

zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

The app made it onto the OSX App Store and the author's certs were revoked. This isn't a case of verify source, verify application. This is a case of anything can be infected and it's damn near impossible to check everything.