Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

141–150 of 355 posts

Re: Transmission BitTorrent app contained malware

#141

Post by ycmbntrthrwaway »

yeukhon wrote: post #76
0x0 wrote: post #57

Earlier quoted context omitted.

Maybe take a look around https://build.transmissionbt.com/ - but then again maybe the svn repo wasn't compromised? I tried a "svn diff svn://svn.transmissionbt.com/Transmission/tags/2.90 svn://svn.transmissionbt.com/Transmission/tags/2.91" and didn't see anything suspicious on a fast scroll-through

Side topic: probably not a good idea to expose Jenkins externally, especially if you don't keep Jenkins up-to-date all the time (for transmission bt it is up-to-date right now). This Jenkins probably contain the key to the svn server, so if someone finds a hole...

> Jenkins probably contain the key to the svn server

Why should it? For open-source software build-server can even be ran by a third party.

Re: Transmission BitTorrent app contained malware

#143

Post by dzhiurgis »

Popular Mac rumour/news site 9to5mac (that is rapidly decreasing in quality) actually posted about this malicious update few days ago.

Somehow I found it out of place, especially as they have never posted about TransmissionBT before. They sure did get lots of people to update after putting in on front page.

Re: Transmission BitTorrent app contained malware

#144

Post by jdc »

TazeTSchnitzel wrote: post #121
nikanj wrote: post #119

Earlier quoted context omitted.

I can't think of a more hostile opponent than an HIV virus. And we're still not sure if Transmission was spreading the virii intentionally, making the condom analogy even more fitting.

HIV is not a threat crafted by an active adversary, it's a product of evolution.

I think the point is that viruses can exploit properties of their hosts regardless of how they came to do so.

Re: Transmission BitTorrent app contained malware

#145

Post by gcb0 »

zepto wrote: post #28
zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

How is the OSX App Store 'awful' compared to a Linux package manager?

app store: anyone gets a id. sign whatever. just have to get past the automated detection.

Debian: have to also fool several people involved in the packaging of said package upstream and everyone using it and building from source

Re: Transmission BitTorrent app contained malware

#146

Post by lukasb »

dzhiurgis wrote: post #143

Popular Mac rumour/news site 9to5mac (that is rapidly decreasing in quality) actually posted about this malicious update few days ago. Somehow I found it out of place, especially as they have never posted about TransmissionBT before. They sure did get lots of people to update after putting in on front page.

Good for them.

Re: Transmission BitTorrent app contained malware

#147

Post by popinman322 »

resoluteteeth wrote: post #14
zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware in…

You'd think there would be some sort of global torrent network that simultaneously distributes binaries and signatures.

Doesn't seem like a horrible idea to me: you could just add the developer's key to your client, have your client broadcast interest, receive a _signed_ list of available software with appropriate magnet info... Download servers could serve as initial trackers until enough information has propagated through the network for downloads to be trackerless. Checksums? Guaranteed. Signatures? Acquired. Checking? Performed automagically.

Granted, this just moves the point of failure to the developer's key. (Key acquisition needn't necessarily take place on the developer's site, a friend in the network could pass you a link containing the dev's key and the application's magnet info.)

Re: Transmission BitTorrent app contained malware

#148

Post by yeukhon »

ycmbntrthrwaway wrote: post #141
yeukhon wrote: post #76

Earlier quoted context omitted.

Side topic: probably not a good idea to expose Jenkins externally, especially if you don't keep Jenkins up-to-date all the time (for transmission bt it is up-to-date right now). This Jenkins probably contain the key to the svn server, so if someone finds a hole...

> Jenkins probably contain the key to the svn server Why should it? For open-source software build-server can even be ran by a third party.

I am not following your comment here. Most Jenkins setup use global credentials or use the server-side config file like .ssh/config, .gitconfig link.

Re: Transmission BitTorrent app contained malware

#149

Post by [deleted] »

dzhiurgis wrote: post #143

Popular Mac rumour/news site 9to5mac (that is rapidly decreasing in quality) actually posted about this malicious update few days ago. Somehow I found it out of place, especially as they have never posted about TransmissionBT before. They sure did get lots of people to update after putting in on front page.

[deleted]

Re: Transmission BitTorrent app contained malware

#150

Post by lottin »

arm wrote: post #138
zyxley wrote: post #132

Earlier quoted context omitted.

The malware version was signed with the Transmission developer key.

No, it wasn’t: “ The two KeRanger infected Transmission installers were signed with a legitimate certificate issued by Apple. The developer ID in this certificate is “POLISAN BOYA SANAYI VE TICARET ANONIM SIRKETI (Z7276PX673)”, which was different from the developer ID used to sign previous versions of the Transmission installer. In the code signing information, we found that these installers were generated and signe…

> which was different from the developer ID used to sign previous versions of the Transmission installer

and that didn't ring any alarm bells?

Post reply on HN