Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

271–280 of 355 posts

Re: Transmission BitTorrent app contained malware

#271

All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it. When you can't (be b…

Wouldn't have a container for this be good enough ?

A container may be "good enough", but running within a container generally doesn't give the same security posture as running within a virtual machine.

Re: Transmission BitTorrent app contained malware

#273
If the file /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.plist contains:

        
                Description
                OSX.KeRanger.A
                LaunchServices
                
                        LSItemContentType
                        com.apple.application-bundle
                
                Matches
                
                        
                                MatchFile
                                
                                        NSURLTypeIdentifierKey
                                        public.unix-executable
                                
                                MatchType
                                Match
                                Pattern
                                488DBDD0EFFFFFBE00000000BA0004000031C04989D8*31F64C89E7*83F8FF7457C785C4EBFFFF00000000
                        
                
        
Does that mean I am infected?

Re: Transmission BitTorrent app contained malware

#274

Earlier quoted context omitted.

Beware that VMs are not necessarily secure. They can be escaped!

Sure, in theory. Are there any current exploits for VirtualBox? The way I see it, they're more secure that running the same apps on bare metal. Ubuntu host running a Fedora VM; the latter (with Transmission etc) only running when I need the apps running - seems an almost entirely painless way of providing a lot of security.

Yes! Some reliable ways to extract an RSA key, and some less reliable ways to swap two cache lines. Virtualization on x86 is a helpful tool for configuration management, but should not be mistaken for a security feature.

Re: Transmission BitTorrent app contained malware

#275

If the file /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.plist contains: Description OSX.KeRanger.A LaunchServices LSItemContentType com.apple.application-bundle Matches MatchFile NSURLTypeIdentifierKey public.unix-executable MatchType Match Pattern 488DBDD0EFFFFFBE00000000BA0004000031C04989D8*31F64C89E7*83F8FF7457C785C4EBFFFF00000000 Does that mean I am infected?

No. That means you have up to date protection against being infected.

Re: Transmission BitTorrent app contained malware

#276
post #76
post #57

Earlier quoted context omitted.

Maybe take a look around https://build.transmissionbt.com/ - but then again maybe the svn repo wasn't compromised? I tried a "svn diff svn://svn.transmissionbt.com/Transmission/tags/2.90 svn://svn.transmissionbt.com/Transmission/tags/2.91" and didn't see anything suspicious on a fast scroll-through

Side topic: probably not a good idea to expose Jenkins externally, especially if you don't keep Jenkins up-to-date all the time (for transmission bt it is up-to-date right now). This Jenkins probably contain the key to the svn server, so if someone finds a hole...

Transmission, as an open source project, should probably evaluate another CI service such as Travis rather than run their own Jenkins services.

Re: Transmission BitTorrent app contained malware

#277

Earlier quoted context omitted.

Your extremely ignorant argument immediately implies that the clubs used to hit baseballs are necessarily related to flying mammals. The facts that the english word analogy descends in a complicated manner from a greek word referring to mathematical proprotions, and the english word logic descends in a somewhat less complicated manner from a greek word referring to speech, and that those greek words shared their pron…

The similarity between according to" + "ratio," and “of or pertaining to speech or reason or reasoning, rational, reasonable” is just too simple and striking to be missed and forgotten. No linguistic reasoning is needed however, to see that an analogy essentially needs logic to work in any language. It helps however. EG in English tongue still language in an idiomatic metaphorical sense, analog to the original meanin…

I don't know about the second part of your argument, where you claim you don't need any linguistic reasoning to see that analogy needs logic (I'm personally not convinced). However, your argument about the connection-in the context you are putting it in-of the words logic and analogy is absolutely false.

Αναλογία means the comparative association of two (antithetical) objects in quantity, size, etc.

Λογική means to reason with a basis in reality.

Re: Transmission BitTorrent app contained malware

#278
post #138
post #132

Earlier quoted context omitted.

The malware version was signed with the Transmission developer key.

No, it wasn’t: “ The two KeRanger infected Transmission installers were signed with a legitimate certificate issued by Apple. The developer ID in this certificate is “POLISAN BOYA SANAYI VE TICARET ANONIM SIRKETI (Z7276PX673)”, which was different from the developer ID used to sign previous versions of the Transmission installer. In the code signing information, we found that these installers were generated and signe…

What. That's interesting -- Polisan is a relatively well-known paint company in Turkey. I don't think they have a part in this -- maybe they did not store their private keys well enough?

Re: Transmission BitTorrent app contained malware

#279
post #66

Earlier quoted context omitted.

I'd definitely run a virus scan to be sure... If you don't have one just install a Trial version and remove it again after a week.

Noted: I've gone with BitDefender from the Map App Store. Will report back results. EDIT: welp, BitDefender found nothing, all clear.

Maybe give Malwarebytes Anti-Malware for Mac [1] a try? I've used their Windows products for a while now.

[1] https://www.malwarebytes.org/antimalware/mac/

Re: Transmission BitTorrent app contained malware

#280

All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it. When you can't (be b…

> soulseek

Neat. Never heard of this one before - what makes it special?

Post reply on HN