Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

241–250 of 355 posts

Re: Transmission BitTorrent app contained malware

#241

Post by acdha »

voltagex_ wrote: post #238
iam-TJ wrote: post #80

Earlier quoted context omitted.

In Debian and Ubuntu at least, all published files containing binary executable files (ISOs, .deb packages, etc.) are hashed and the hash signed by a well-known system pre-installed PGP key. Given trust in the protection of the private key used to sign the hash list file the integrity of the executable content can be proved (assuming useful SHA1 collision creation is prohibitively expensive). Coincidentally I was wri…

Shouldn't you be using HTTPS for all downloads and grabbing the sha1s and image from different mirrors?

That is a good idea but note the use of GPG - if you aren't able to forge that signature, the verification step will fail.

Re: Transmission BitTorrent app contained malware

#242

Post by diebir »

ricardobeat wrote: post #225
diebir wrote: post #179

Earlier quoted context omitted.

First, obviously you can make an account for running the untrusted software, like Bittorrent clients (which are known to carry malware frequently). Second, most malware requires and counts on having admin privileges on target machine. The task of auditing, cleaning and finding out that malware is present is significantly easier if malware is limited to a non-privileged account. With malware running as a non-privilege…

His comment went right past you. What you care about the most on your computer is your personal data, and all of it sits under $HOME. Any script running as $USER can steal sensitive data, wipe out personal and work files, maybe even cloud storage services. None of that requires admin rights. The only solution is sandboxing everything.

For things that are likely to carry malware, use a separate account. Probably a good idea for a Bittorent client in any case.

In practice, however, it is much easier to deal with malware if there's no admin rights. It matters even for a clueless user, since the OS mechanisms of detection can't be altered and more much so for a power user.

This specific malware installs a kernel module, as far I can tell. I am guessing it would be harder to encrypt data and not be noticed and removed quickly.

Of course, there are even more obvious reasons, like sharing a computer with... kids that tend to bring malware at every turn.

We really need to educate the devs and change the culture. There's no reason for something like a word processor and file sharing app to require full access to the system. That's why we have access controls in the first place.

Re: Transmission BitTorrent app contained malware

#243

Post by tbirdz »

ianlevesque wrote: post #53
ikeboy wrote: post #25

Earlier quoted context omitted.

>unless the main site is secure but the downloads aren't which is idiotic by 2016 standards anyway https adds a performance hit. The security of "checksum over https and actual file over http", if the checksum is checked, is the same as "actual file over https", barring preimage attacks.

This is a persistent myth https://istlsfastyet.com

This is only true for Intel and AMD x86_64 servers that have hardware accelerated AES with the AES-NI instruction set. Software implementations of AES and the other ciphers are much, much slower than AES with hardware acceleration. RC4 was the fastest decent software cipher for a while, but that has been found to be insecure and its use is discouraged. The fastest possible replacement would probably be ChaCha20, but that cipher is not widely supported yet. The other software ciphers are very slow, and certainly wouldn't be considered as "fast yet".

Re: Transmission BitTorrent app contained malware

#245

Post by kobayashi »

dave2000 wrote: post #75

All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it. When you can't (be b…

Admittedly, this might reasonably be considered a basic question, but how do you recommend running a VM on a Mac?

Re: Transmission BitTorrent app contained malware

#246

Post by thaumasiotes »

conceit wrote: post #210
ycmbntrthrwaway wrote: post #142

Earlier quoted context omitted.

This is what happens when you start using analogy instead of logic.

What do you think the logy in analogy stands for?

"ratio".

> from Greek analogia "proportion," from ana- "upon, according to" (see ana-) + logos "ratio," also "word, speech, reckoning" (see logos). A mathematical term used in a wider sense by Plato.

http://www.etymonline.com/index.php?allowed_in_frame=0&searc...

Re: Transmission BitTorrent app contained malware

#247

Post by kentonv »

woodman wrote: post #194
Nullabillity wrote: post #156

Earlier quoted context omitted.

> Throw the application into ~/Applications as a Mac bundle, worst that will happen is your account will be compromised. On a typical single-user setup, there's not much difference between an account compromise and a machine compromise anyway.

That is only true if you have no interest in recovery post compromise. A user level account shouldn't be able to put the system in such a state that online recovery is impossible, whereas a system level account easily can - think loadable kernel modules. Only offline recovery works once you lose trust in the kernel. That is the difference between "Alright grandma, lemme remote in" and "Sorry old lady, better start lo…

If you have to wipe the user account anyway, then wiping the system at the same time hardly adds any more effort -- in fact it's probably easier. Your system files are the easiest part of your system to recover, because the originals are readily accessible from the vendor.

Re: Transmission BitTorrent app contained malware

#248

Post by x0 »

owaislone wrote: post #221
ikeboy wrote: post #115

Earlier quoted context omitted.

None of affects the point they're making, which is that they can't find SSL mirrors that aren't more expensive. If you find one, let them know and I'm sure they'll be happy to switch over.

It is 2016. SSL is not slow anymore. Only case it could be deemed slow would be on a webpage where the browser has to download a ton of small files likes images. Each image would require a new connection and each connection would require full SSL handshake. Even then the fix is not to not use SSL but to bundle all the images/files into 1.

Maybe not computationally, but if you're 100ms, 200ms, 300ms or more away from the rest of the internet, all the SSL handshakes really add up.

Re: Transmission BitTorrent app contained malware

#249

Post by kccqzy »

voltagex_ wrote: post #234
orionblastar wrote: post #196

Earlier quoted context omitted.

For Windows there is SandboxIE: http://www.sandboxie.com/index.php?DownloadSandboxie It should be able to sandbox Windows Apps, except for Metro/Modern UI Apps and Microsoft Edge. Too many programs are having a backdoor or Trojan in them now. It is a good idea to run any app that accesses the Internet in a sandbox first to see what it does.

I have no problem paying for apps but for people who have paid for SandboxIE, do you think you've got your money's worth out of it?

Yes. Back when I still used Windows five years ago, the app was an essential tool for me. All web browsers, downloaders and basically anything else that I consider high risk must be run in a sandbox, which is routinely emptied. Less risky apps are sometimes also installed in a sandbox, which is emptied much less frequently. And it's great for trying out trial versions of software before I fully trust their publishers. I didn't run any antivirus on that machine at all and I'm that confident. Nowadays I've switched to OS X but I still miss the easy sandboxing of basically any app.

Re: Transmission BitTorrent app contained malware

#250

Post by x0 »

noondip wrote: post #72
s_kilk wrote: post #61

While we're here, can anyone recommend a good antivirus for OSX? I've just been looking at BitDefender, which looks promising, but would rather get this right than faff around with potentially crappy AV tools.

> can anyone recommend a good antivirus for OSX? Common Sense 2016, see https://github.com/drduh/OS-X-Security-and-Privacy-Guide

Common Sense 2016 would not have prevented a malicious Transmission update though
Post reply on HN