131–140 of 355 posts
The headline should probably say "at least Mac". I hope we soon learn the source of the compromise, but nothing so far indicates that Linux distributions' packages would be affected by a Mac malware.
Earlier quoted context omitted.
> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware in…
I thought only apps signed by "identified developers" are run by default on Macs with Gatekeeper now. Shouldn't code-signing have prevented this? Unless they inserted the malware before the signing process.
VirusTotal has some more info, including the files it writes: https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc... (Look under the "Behavioural information" tab) Written Files and Created Processes are interesting: [Transmission] /Users/user1/Library/kernel_service (successful) [unknown] /Users/user1/Library/.kernel_pid (successful) [unknown] /Users/user1/Library/Saved Application State/org.m0k.transmissio…
Here's an analysis of the malware - http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
It's fascinating!
Transmission put up a new version - 2.92 that supposedly checks for and removes the malware.
Earlier quoted context omitted.
Here's an analysis of the malware - http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
Copy/pasting the helpful parts of that article: How to Protect Yourself Users who have directly downloaded Transmission installer from official website after 11:00am PST, March 4, 2016 and before 7:00pm PST, March 5, 2016, may be been infected by KeRanger. If the Transmission installer was downloaded earlier or downloaded from any third party websites, we also suggest users perform the following security checks. User…
It's not. Condoms aren't used against a hostile opponent. If your partner is intent on exposing you, a condom won't provide any protection.
I'm on 2.90 and can't find any weird processes running. I'll hold off on 2.91 until they've explained what happened.
that feels like a pretty week standard for knowing if your machine is infected. I will look for a virus scanner myself, and seriously think about reinstalling if it finds anything
Earlier quoted context omitted.
I thought only apps signed by "identified developers" are run by default on Macs with Gatekeeper now. Shouldn't code-signing have prevented this? Unless they inserted the malware before the signing process.
The malware version was signed with the Transmission developer key.
“The two KeRanger infected Transmission installers were signed with a legitimate certificate issued by Apple. The developer ID in this certificate is “POLISAN BOYA SANAYI VE TICARET ANONIM SIRKETI (Z7276PX673)”, which was different from the developer ID used to sign previous versions of the Transmission installer. In the code signing information, we found that these installers were generated and signed on the morning of March 4.”
From: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
Earlier quoted context omitted.
I'd definitely run a virus scan to be sure... If you don't have one just install a Trial version and remove it again after a week.
Noted: I've gone with BitDefender from the Map App Store. Will report back results. EDIT: welp, BitDefender found nothing, all clear.
Earlier quoted context omitted.
I thought only apps signed by "identified developers" are run by default on Macs with Gatekeeper now. Shouldn't code-signing have prevented this? Unless they inserted the malware before the signing process.
The malware version was signed with the Transmission developer key.