Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

291–300 of 355 posts

Re: Transmission BitTorrent app contained malware

#291

Post by Philipp__ »

Can someone explain me what Xprotect.plist contains? Are those malware's that are recognized by Apple and are blocked and dealt with?

I saw some post on forum where dude said how his Xprotect now contains at the top OSX.KeRanger.A entry, and said how it means he got infected. It didn't made much sense to me, but I checked mine this morning and found the same entry? Does it mean I am infected too?

But I didn't download anything from their website like 3 months back, I just did the update to 2.90 in Thursday or Friday can't remember, and yesterday as soon as I saw the news I update everything and checked for malicious files and processes which weren't present on my machine.

Re: Transmission BitTorrent app contained malware

#292

Post by russjr08 »

Philipp__ wrote: post #291

Can someone explain me what Xprotect.plist contains? Are those malware's that are recognized by Apple and are blocked and dealt with? I saw some post on forum where dude said how his Xprotect now contains at the top OSX.KeRanger.A entry, and said how it means he got infected. It didn't made much sense to me, but I checked mine this morning and found the same entry? Does it mean I am infected too? But I didn't downloa…

If I recall correctly, they are file signatures that OS X uses to identify and remove malware. Not sure when and how the files on your drive are checked (potentially right before they are opened?), but the XProtect.plist file is automatically updated by Apple, and that's what you're seeing.

The entry doesn't exactly mean you're infected, but just that your copy of the file was updated.

I have the entry for instance, but I was never infected. You can check your copy of XProtect with this command (I have 2076):

defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta Version

Edit: Looks like you do get a message before launching an app, if it's identified by XProtect/File Quarantine.

Re: Transmission BitTorrent app contained malware

#293

Post by __david__ »

CiPHPerCoder wrote: post #160
__david__ wrote: post #157

Earlier quoted context omitted.

It is given the following attack scenario: attacker is man-in-the-middling, and the SHA (but not the actual binary) is delivered via https. In the case where the attacked has direct control over the website then you're right, it doesn't help at all.

> In the case where the attacked has direct control over the website then you're right, it doesn't help at all. I was pretty sure that's the threat model we were discussing: Software authenticity. The only way to automatically know if a piece of software is legitimate is to have a trusted public key that can verify a signature. Also, HTTPS is implied these days. If you're not using HTTPS, you are either malicious, ne…

> If you're not using HTTPS, you are either malicious, negligent, incompetent…

Or poor. Hosting large amounts of binaries over https isn't cheap. I just priced Amazon S3 and cloudfront and for the amount of data that I serve it would cost $300 per month. That's a lot to commit for a GPL-ed binary that brings in practically zero revenue. Maybe there's a cut rate VPS out there that can handle 150GB of data and 3TB of bandwidth per month on the cheap, but I haven't found it yet.

Re: Transmission BitTorrent app contained malware

#294

Post by astrodust »

hayleox wrote: post #8

Do the developers have an explanation anywhere as to how this happened? The homepage ( https://transmissionbt.com/ ) has a big red warning to upgrade to 2.91, but I can't find any info about how someone went about putting malware in the download.

If you release commercial or popular open-source software, it's probably a super-bad idea to keep your signing key on a notebook computer you use outside of the office.

Have a trusted machine kept in a secure location to sign it for you if that's practical.

I bet someone's key leaked out here.

Re: Transmission BitTorrent app contained malware

#295

Post by Intermernet »

conceit wrote: post #216
flerchin wrote: post #190

On a related note, Windows Defender detects malware when downloading the windows putty installer. Trojan: Win32/Varpes.J!plock http://www.chiark.greenend.org.uk/~sgtatham/putty/download.h... Not sure how to report.

try uploading the file to virustotal, avira etc. Windows Defender should in the alert have a button to report to microsoft.

Looks clean. Maybe false positive from Windows Defender...

https://www.virustotal.com/en/url/73d82ff580cd445b907c6334c7...

Re: Transmission BitTorrent app contained malware

#299

Post by Philipp__ »

russjr08 wrote: post #292
Philipp__ wrote: post #291

Can someone explain me what Xprotect.plist contains? Are those malware's that are recognized by Apple and are blocked and dealt with? I saw some post on forum where dude said how his Xprotect now contains at the top OSX.KeRanger.A entry, and said how it means he got infected. It didn't made much sense to me, but I checked mine this morning and found the same entry? Does it mean I am infected too? But I didn't downloa…

If I recall correctly, they are file signatures that OS X uses to identify and remove malware. Not sure when and how the files on your drive are checked (potentially right before they are opened?), but the XProtect.plist file is automatically updated by Apple, and that's what you're seeing. The entry doesn't exactly mean you're infected, but just that your copy of the file was updated. I have the entry for instance,…

Yeah, I have 2076 too. Now after the update of Xprotect you get the message, but what if you ran the app for example on Friday (4th) and got infected then?

Checked on IRC, it seems that sparkles prevented infection for those who updated their app, like I did. Screw all this, as I read in one of the comments here, I will run transmission through Docker container on RPi running FreeBSD.

Re: Transmission BitTorrent app contained malware

#300

Post by pilif »

The fact that the binary was infected, I can somewhat understand. However, the way communication happened/is happening on this issue is very disconcerning and basically makes it impossible to know whether it's safe to currently download 2.92 from their site.

Questions like

- how did the compromised binary get there? Was the source code hijacked or was the binary altered after it had been built?

- Were the SHA256 hashes on the site also compromised (btw: Having hashes on the site is good enough for making sure you're not installing a corrupted binary. It doesn't do anything against intentional alterations of the binary though. These hashes need to be stored on an external site)?

- How did the compromise happen?

- what steps were taken to ensure that the same compromise doesn't happen to new binaries posted?

- Did the attacker leave any foothold on the compromised system(s)?

- How were such footholds removed?

All questions that need to be answered before it's safe to upgrade transmission either from the website or with the AutoUpdate feature. A red warning telling me that one binary was infected and that I have to download another binary isn't good enough.

I know the transmission people are volunteer developers and no PR people and I can totally accept that, but there's some things that just need to be made clear before we can safely update to later versions (and thankfully, 2.8 keeps running just fine)

Post reply on HN