Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

301–310 of 355 posts

Re: Transmission BitTorrent app contained malware

#301

Post by conceit »

thaumasiotes wrote: post #290
conceit wrote: post #265

Earlier quoted context omitted.

The similarity between according to" + "ratio," and “of or pertaining to speech or reason or reasoning, rational, reasonable” is just too simple and striking to be missed and forgotten. No linguistic reasoning is needed however, to see that an analogy essentially needs logic to work in any language. It helps however. EG in English tongue still language in an idiomatic metaphorical sense, analog to the original meanin…

You are making an argument which includes, but is even dumber than, the etymological fallacy ( https://en.wikipedia.org/wiki/Etymological_fallacy ). I stand by "extremely ignorant".

I'm sorry, the initial analogy, that a condom is easy to pierce was just an example for the general assumption, that security is easy if the thread is not purposefully malignant, for varying measures of malignant.

Someone who doesn't even understand that and that the linguistic argument is of the table, and still keeps going, shouldn't try to talk about logic, as right as some of the individual arguments might be. Ana-logically, I shouldn't be writing any more about this.

Re: Transmission BitTorrent app contained malware

#302

Post by russjr08 »

Philipp__ wrote: post #299
russjr08 wrote: post #292

Earlier quoted context omitted.

If I recall correctly, they are file signatures that OS X uses to identify and remove malware. Not sure when and how the files on your drive are checked (potentially right before they are opened?), but the XProtect.plist file is automatically updated by Apple, and that's what you're seeing. The entry doesn't exactly mean you're infected, but just that your copy of the file was updated. I have the entry for instance,…

Yeah, I have 2076 too. Now after the update of Xprotect you get the message, but what if you ran the app for example on Friday (4th) and got infected then? Checked on IRC, it seems that sparkles prevented infection for those who updated their app, like I did. Screw all this, as I read in one of the comments here, I will run transmission through Docker container on RPi running FreeBSD.

If you ran the app before the XProtect definitions were updated, then it would've ran with no problem and you would've been infected.

Re: Transmission BitTorrent app contained malware

#303

Post by xnyhps »

Heis wrote: post #89

Can someone please confirm that the in-app update is not affected by the hack?

Reports indicate it isn't, but they're still including a vulnerable version of Sparkle [1], so I wouldn't trust the auto-update at all [2].

[1] = https://sparkle-project.org/documentation/security/

[2] = https://trac.transmissionbt.com/log/tags/2.92/macosx/Sparkle...

Re: Transmission BitTorrent app contained malware

#304

Post by soraminazuki »

adidalal wrote: post #176

If you installed/updated via Homebrew-Cask [1], you should not be affected. 2.90 was not always compromised, and looking at Caskroom history, the checksum was only updated for the 2.84 -> 2.90 bump once [2]. It is updated and at 2.92 now, also [3]. (I'm one of the maintainers of Homebrew Cask) [1] https://github.com/caskroom/homebrew-cask [2] https://github.com/caskroom/homebrew-cask/issues/19504#issue... [3] https:/…

Homebrew Cask is awesome, but I still think security is an issue here because you still have to trust the upstream binaries are safe, each built and hosted by totally different people. Verifying checksums is certainly better than not checking them, but you still haven't escaped from the trust-whatever-binary-you-downloaded-from-the-internet-style of doing things. I really wish package managers like Homebrew Cask offer some level of trust by building applications from source and signing them, like Debian.

Re: Transmission BitTorrent app contained malware

#306

Post by kruczek »

__david__ wrote: post #293
CiPHPerCoder wrote: post #160

Earlier quoted context omitted.

> In the case where the attacked has direct control over the website then you're right, it doesn't help at all. I was pretty sure that's the threat model we were discussing: Software authenticity. The only way to automatically know if a piece of software is legitimate is to have a trusted public key that can verify a signature. Also, HTTPS is implied these days. If you're not using HTTPS, you are either malicious, ne…

> If you're not using HTTPS, you are either malicious, negligent, incompetent… Or poor. Hosting large amounts of binaries over https isn't cheap. I just priced Amazon S3 and cloudfront and for the amount of data that I serve it would cost $300 per month. That's a lot to commit for a GPL-ed binary that brings in practically zero revenue. Maybe there's a cut rate VPS out there that can handle 150GB of data and 3TB of b…

How much is it for the same volume of non-HTTPS traffic?

Re: Transmission BitTorrent app contained malware

#307

Post by microtonal »

arm wrote: post #163
microtonal wrote: post #59

Earlier quoted context omitted.

So, either the attacker has an Apple developer account (and is hopefully traceable through their credit card information), the Transmission project was sloppy with their signing key, or the machine of the developer with the signing key was compromised. Sorry, I forgot another possibility: some other developer's key was compromised.

Or, as is the case here, the malicious party was simply issued a key by Apple (for apps that are downloaded from places other than the Mac App Store, developers can get a unique Developer ID from Apple (for free) and use it to digitally sign their apps, the purpose being that Apple can revoke it after the fact if it turns out to be malware): “ The two KeRanger infected Transmission installers were signed with a legit…

Interesting. It seems that this is actually a legitimate company:

http://www.bloomberg.com/research/stocks/private/snapshot.as...

So, it could be that the malicious part was not issued a key, but stole the key from this company.

Re: Transmission BitTorrent app contained malware

#308

Post by microtonal »

alextgordon wrote: post #96
microtonal wrote: post #48

Earlier quoted context omitted.

If a hacker gets access to a server holding the binaries for an open source app (which most people download), the hacker can just compile the program from sources and add his own code in there and place the installer online. Code signing is used to prevent this. So, either the attacker has an Apple developer account (and is hopefully traceable through their credit card information), the Transmission project was slopp…

OK so let's imagine sandboxing is on by default, then "Transmission" pushes an update that asks for read/write access to the whole home directory. You don't know if Transmission has some legitimate need for that or not, so you just shrug and click Allow. Boom—infected. So I think sandboxing is basically useless against these kinds of attacks. Either they allow apps to elevate their entitlements in an update, or they…

then "Transmission" pushes an update that asks for read/write access to the whole home directory.

There is no such entitlement:

https://developer.apple.com/library/mac/documentation/Miscel...

If you are talking about the 'open directory' dialog. Well, if a user is careless enough to just give a sandboxed app access to their complete home directory - tough luck.

So I think sandboxing is basically useless against these kinds of attacks.

No, it's not, because no entitlement allows blanket access to the user's home directory. Hence, an application cannot just encrypt all of the user's data.

Re: Transmission BitTorrent app contained malware

#309

Post by justsaysmthng »

woodman wrote: post #64
justsaysmthng wrote: post #32

I've become increasingly paranoid lately, given that things like these happen and major bugs are uncovered in software that I use almost every day. It's good that the Transmission developer reacted quickly and made waves so that people can at least be aware that they might have been exposed.. But I wonder how many more applications from the hundreds that I have installed on my machines contain weird stuff - either in…

> Open source software is especially vulnerable ... the hacker can just compile the program from sources and add his own code You must be too young to remember how computer viruses originally spread by way of modified executable files: http://computervirus.uw.hu/ch04lev1sec2.html

Actually, dabbling in virus writing was the most exciting thing I could do on my 4.77Mhz 8086 running MSDOS 3.3 back in the day :).

Patching is possible, but why bother when you can compile the app from sources?

Nice book btw.

Re: Transmission BitTorrent app contained malware

#310

Post by sleepyhead »

jariz wrote: post #134
svetly0 wrote: post #125

Transmission put up a new version - 2.92 that supposedly checks for and removes the malware.

Threw away Transmission as soon as I read this (even though I was running a old version), my trust is pretty much gone now, never installing it again. Shame because it really was a nice app.

Do you trust the alternatives?
Post reply on HN