Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

251–260 of 355 posts

Re: Transmission BitTorrent app contained malware

#251

Post by conceit »

thaumasiotes wrote: post #246
conceit wrote: post #210

Earlier quoted context omitted.

What do you think the logy in analogy stands for?

"ratio". > from Greek analogia "proportion," from ana- "upon, according to" (see ana-) + logos "ratio," also "word, speech, reckoning" (see logos). A mathematical term used in a wider sense by Plato. http://www.etymonline.com/index.php?allowed_in_frame=0&searc...

so, what do you think where logic comes from? I'll spare you the effort:

> [...] from properly feminine of λογικός ‎(logikós, “of or pertaining to speech or reason or reasoning, rational, reasonable”), from λόγος ‎(lógos, “speech, reason”).

https://en.wiktionary.org/wiki/logic

There is no analogy without logic. I even fail to recognize a difference between speech and logic, speech without logic, by analogy, would be just noise.

Re: Transmission BitTorrent app contained malware

#252

Post by cyphar »

resoluteteeth wrote: post #14
zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware in…

There is also the web of trust for PGP, which sort of solves the problem of needing a central store of the key. It does require being inside the web though (bootstrapping). But once you are, you can construct how much you trust a key from someone you haven't met.

Re: Transmission BitTorrent app contained malware

#253

Post by adidalal »

kazazes wrote: post #227
Philipp__ wrote: post #220

Oh dear god. Used 2.90 past week, when I saw the news I updated immediately, checked for all the files, found nothing. I hope my MacBook will stay fine tomorrow. I got it backed up on Time Machine anyway. Where do we go from here, since I lost the trust, what are the alternatives? And from now one, I'll go with Brew Cask for everything possible. F * GUI /s

Would brew cask have helped you here? It doesn't build from source, it just downloads a precompiled binary.

In this case, yes, as it verifies the download against a (best-effort) known-good checksum. It's not a perfect system, but did work out in this case.

GPG verification where available and refusing to install Casks without a checksum is also in the pipeline.

(I'm one of the maintainers of Homebrew Cask)

Re: Transmission BitTorrent app contained malware

#254

Post by moyix »

vmorgulis wrote: post #218
Matt3o12_ wrote: post #213

Earlier quoted context omitted.

Thanks, I just realized it after reading Claud Xiao and Jin Chen's analysis, too. Apparently, this ransomware uses Tor to hide its origin. Analysis: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...

I liked the "We have ticket system." (in the screenshot of "README_TO_DECRYPT.txt"). They ask (only) 1 BtC as a ransom.

And they decrypt one file for free, to prove they can do it. Nice touch.

Screenshots of the web UI:

https://twitter.com/moyix/status/706577507965870080/photo/1

Re: Transmission BitTorrent app contained malware

#255

Post by woodman »

kentonv wrote: post #247
woodman wrote: post #194

Earlier quoted context omitted.

That is only true if you have no interest in recovery post compromise. A user level account shouldn't be able to put the system in such a state that online recovery is impossible, whereas a system level account easily can - think loadable kernel modules. Only offline recovery works once you lose trust in the kernel. That is the difference between "Alright grandma, lemme remote in" and "Sorry old lady, better start lo…

If you have to wipe the user account anyway, then wiping the system at the same time hardly adds any more effort -- in fact it's probably easier. Your system files are the easiest part of your system to recover, because the originals are readily accessible from the vendor.

I guess it depends. In the grandma scenario it adds a lot more effort. A corporate laptop in a standard AD environment, no problem. In a situation where you've customized the system (custom packages, sshd.conf tuning, flags in rc/csh/sysctl/resolv/loader/randomsbinutilityinstalled2yearsago.conf) it would be a lot more work than just reinstalling the OS. Use backups you say? What if I told you that you could use the very same backups to rollback changes to the user's home directory, in 5 minutes, and not have to reimage the entire machine? I'm just saying: even on a single user setup - there is a world of difference in what options you have open to you, depending upon whether you let the malware hit ring 0 or not.

Re: Transmission BitTorrent app contained malware

#256

Post by cyphar »

regularfry wrote: post #44
r0muald wrote: post #19

Earlier quoted context omitted.

No, Linux distributions offer packages and operating systems that are the result of painstaking work in which all upstream code is reviewed, patched for any inconsistency, and often blocked from going into public archives until known bugs are fixed.

That's... optimistic.

That's how OpenSUSE works. Debian too AFAIK.

Re: Transmission BitTorrent app contained malware

#257

Post by thaumasiotes »

conceit wrote: post #251
thaumasiotes wrote: post #246

Earlier quoted context omitted.

"ratio". > from Greek analogia "proportion," from ana- "upon, according to" (see ana-) + logos "ratio," also "word, speech, reckoning" (see logos). A mathematical term used in a wider sense by Plato. http://www.etymonline.com/index.php?allowed_in_frame=0&searc...

so, what do you think where logic comes from? I'll spare you the effort: > [...] from properly feminine of λογικός ‎(logikós, “of or pertaining to speech or reason or reasoning, rational, reasonable”), from λόγος ‎(lógos, “speech, reason”). https://en.wiktionary.org/wiki/logic There is no analogy without logic. I even fail to recognize a difference between speech and logic, speech without logic, by analogy, would be…

Your extremely ignorant argument immediately implies that the clubs used to hit baseballs are necessarily related to flying mammals.

The facts that the english word analogy descends in a complicated manner from a greek word referring to mathematical proprotions, and the english word logic descends in a somewhat less complicated manner from a greek word referring to speech, and that those greek words shared their pronunciation, tell us nothing about the relationship between analogies and logic.

A standard chinese term for "analogy" (also, "metaphor") is 比喻 biyu. The term for "logic" is 逻辑 luoji (it is a loan word from english). Are you prepared to grant that, while analogies and logic are necessarily intertwined for people who speak english or greek, they are unrelated for people who speak modern mandarin chinese?

Re: Transmission BitTorrent app contained malware

#258

Post by 27182818284 »

yeukhon wrote: post #76
0x0 wrote: post #57

Earlier quoted context omitted.

Maybe take a look around https://build.transmissionbt.com/ - but then again maybe the svn repo wasn't compromised? I tried a "svn diff svn://svn.transmissionbt.com/Transmission/tags/2.90 svn://svn.transmissionbt.com/Transmission/tags/2.91" and didn't see anything suspicious on a fast scroll-through

Side topic: probably not a good idea to expose Jenkins externally, especially if you don't keep Jenkins up-to-date all the time (for transmission bt it is up-to-date right now). This Jenkins probably contain the key to the svn server, so if someone finds a hole...

>Side topic: probably not a good idea to expose Jenkins externally

Jenkins (and CI in general) can be a very weak point. This was posted on Hacker News a while back https://github.com/samratashok/ContinuousIntrusion

Re: Transmission BitTorrent app contained malware

#259

Post by drdaeman »

orionblastar wrote: post #196
Aleman360 wrote: post #177

Earlier quoted context omitted.

This is exactly why sandboxed apps (e.g., iOS/UWP/etc.) are a good thing.

For Windows there is SandboxIE: http://www.sandboxie.com/index.php?DownloadSandboxie It should be able to sandbox Windows Apps, except for Metro/Modern UI Apps and Microsoft Edge. Too many programs are having a backdoor or Trojan in them now. It is a good idea to run any app that accesses the Internet in a sandbox first to see what it does.

Just a warning: by default it doesn't protect your documents from reading.

It isolates the process, all writes (filesystem, registry) go to the sandbox instead of the host filesystem, so a malicious software can't easily install itself. But reading data is mostly unprotected by default, so a malware ran in a sandbox may steal some sensitive data. To protect such data you have to pre-configure sandbox manually.

Re: Transmission BitTorrent app contained malware

#260

Post by ceejayoz »

kobayashi wrote: post #245
dave2000 wrote: post #75

All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it. When you can't (be b…

Admittedly, this might reasonably be considered a basic question, but how do you recommend running a VM on a Mac?

https://www.virtualbox.org/wiki/Downloads
Post reply on HN