Transmission BitTorrent app contained malware • Hacker News Board

Re: Transmission BitTorrent app contained malware

#311

Post by noondip » Mon, Mar 07, 2016, 11:42 AM UTC

x0 wrote: post #250

noondip wrote: post #72

Earlier quoted context omitted.

> can anyone recommend a good antivirus for OSX? Common Sense 2016, see https://github.com/drduh/OS-X-Security-and-Privacy-Guide

Common Sense 2016 would not have prevented a malicious Transmission update though

Agreed - it would not defend against this presumed watering-hole attack. However, neither would have AV: https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc...

Nevertheless, I still believe Common Sense to be a better alternative to bloated, vulnerable anti-virus programs.

Re: Transmission BitTorrent app contained malware

#312

Post by theinternetman » Mon, Mar 07, 2016, 11:43 AM UTC

JetSpiegel wrote: post #105

microtonal wrote: post #56

Earlier quoted context omitted.

Linux package managers are looking like one of the only straightforward ways to distribute applications securely. Unless you are a small independent app developer. Virtually no distribution wants to take proprietary software. And you have to package for a wide variety of different distributions. On the other hand, the Windows and OS X App Stores are awful. The Mac App store works pretty much effortless for me. It's s…

You can run your own repo. It's basically a folder with some metadata. DEB and RPM variants should get you 80% of the way.

How is that any more secure than just providing a download?

Re: Transmission BitTorrent app contained malware

#313

Post by b1460151 » Mon, Mar 07, 2016, 11:46 AM UTC

TazeTSchnitzel wrote: post #82

dave2000 wrote: post #75

All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it. When you can't (be b…

Beware that VMs are not necessarily secure. They can be escaped!

Yes but if you run a compromised App in VM A and have your sensitive data in VM B then they have to break out of the VM A and then break into VM B. It's no longer worth the effort. There are often easier ways like phising.

Re: Transmission BitTorrent app contained malware

#314

Post by theinternetman » Mon, Mar 07, 2016, 11:53 AM UTC

woodman wrote: post #255

kentonv wrote: post #247

Earlier quoted context omitted.

If you have to wipe the user account anyway, then wiping the system at the same time hardly adds any more effort -- in fact it's probably easier. Your system files are the easiest part of your system to recover, because the originals are readily accessible from the vendor.

I guess it depends. In the grandma scenario it adds a lot more effort. A corporate laptop in a standard AD environment, no problem. In a situation where you've customized the system (custom packages, sshd.conf tuning, flags in rc/csh/sysctl/resolv/loader/randomsbinutilityinstalled2yearsago.conf) it would be a lot more work than just reinstalling the OS. Use backups you say? What if I told you that you could use the v…

Not sure why anyone with a compromised machine would rather have the risk of a lingering backdoor just to save 1-2 hours clean formatting and reinstalling

Re: Transmission BitTorrent app contained malware

#315

Post by theinternetman » Mon, Mar 07, 2016, 11:55 AM UTC

jsn117 wrote: post #261

jariz wrote: post #134

Earlier quoted context omitted.

Threw away Transmission as soon as I read this (even though I was running a old version), my trust is pretty much gone now, never installing it again. Shame because it really was a nice app.

flying the day after 9/11 was the safest time, I really doubt this sort of thing will happen again to the same software

This would be true if they knew how it was compromised, they've been silent on that issue so far.

The current version could be being compromised this minute for all we know.

Re: Transmission BitTorrent app contained malware

#316

Post by pjf » Mon, Mar 07, 2016, 12:07 PM UTC

any reason why it's correlated with dht.transmissionbt.com loosing its AAAA record? it's the only IPv6 DHT bootstrap node on the Internet

Re: Transmission BitTorrent app contained malware

#317

Post by bartvk » Mon, Mar 07, 2016, 12:09 PM UTC

kobayashi wrote: post #245

dave2000 wrote: post #75

All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it. When you can't (be b…

Admittedly, this might reasonably be considered a basic question, but how do you recommend running a VM on a Mac?

http://veertu.com

Note that I've only used it to run Linux so far.

Re: Transmission BitTorrent app contained malware

#318

Post by julie1 » Mon, Mar 07, 2016, 12:15 PM UTC

Razengan wrote: post #182

julie1 wrote: post #31

The strength of a chain is the strength of its weakest link, and the more "apps" are provided as the system the longer and more vulnerable is the chain. When it comes to checksums with have the chicken egg problem plus the collision attack of md5. MD5 has been the standard for too long (and is deprecated since 10 years for crypto checksum). And for next generation of softwares to install that don't do modern checksum…

> There is a tyranny of computer engineers regarding what is safe for people having a life not concerned about geeky technology that is a tad annoying. You know you can make that complaint about any tool or technology, right? "Gosh why do I have to follow all these rules and observe traffic lights to drive a car?" (something that actually intimidates me, in fact, because I've never driven a car.) "Why do I have to wo…

You know all engineers do not always blame users?

There are fields of engineering where an accident even due to human causes is systematically seen as an engineering problem.

And that may be the reason why traveling by plane and train are safer than by car.

But US engineers made a great job at convincing legal department that poorly engineered goods where not the causes of accidents.

Re: Transmission BitTorrent app contained malware

#319

Post by Philipp__ » Mon, Mar 07, 2016, 12:16 PM UTC

russjr08 wrote: post #302

Philipp__ wrote: post #299

Earlier quoted context omitted.

Yeah, I have 2076 too. Now after the update of Xprotect you get the message, but what if you ran the app for example on Friday (4th) and got infected then? Checked on IRC, it seems that sparkles prevented infection for those who updated their app, like I did. Screw all this, as I read in one of the comments here, I will run transmission through Docker container on RPi running FreeBSD.

If you ran the app before the XProtect definitions were updated, then it would've ran with no problem and you would've been infected.

Now it bugs me cause i can't find info on when the file was edited... Stats and defaults read display 20th January. wierd thing is that I ran the app during problematic time interval but havent found any single process or file that was mentioned in Palo Alto Security page, no kernel_services process or any other misbehaving. Anyway I did Time Capsule backup 10 days ago, and haven't plugged the drive into my computer since, so if anything happens I will roll it back. We shall see, but it is kinda uncomfortable to keep using "maybe infected" machine. Who knows what else may be left, supposedly nothing... Thanks anyway for the help! Cheers

Re: Transmission BitTorrent app contained malware

#320

Post by talles » Mon, Mar 07, 2016, 12:25 PM UTC

conceit wrote: post #251

thaumasiotes wrote: post #246

Earlier quoted context omitted.

"ratio". > from Greek analogia "proportion," from ana- "upon, according to" (see ana-) + logos "ratio," also "word, speech, reckoning" (see logos). A mathematical term used in a wider sense by Plato. http://www.etymonline.com/index.php?allowed_in_frame=0&searc...

so, what do you think where logic comes from? I'll spare you the effort: > [...] from properly feminine of λογικός ‎(logikós, “of or pertaining to speech or reason or reasoning, rational, reasonable”), from λόγος ‎(lógos, “speech, reason”). https://en.wiktionary.org/wiki/logic There is no analogy without logic. I even fail to recognize a difference between speech and logic, speech without logic, by analogy, would be…

> There is no analogy without logic. I even fail to recognize a difference between speech and logic, speech without logic, by analogy, would be just noise.

Sure. That's why sometimes we see such bad analogies, the logic doesn't match so well the actual idea. When the idea you are trying to convey isn't that complicated at all you're probably better off using just pure logic and not complicated constructs such as analogies.

As for speech, indeed, there's a deep logic bounding the language structures we use. The problem with language (logic and meaning wise) is that language is relative to the environment and to the speakers of the conversation. You have to figure out the "language game" where the conversation is being held. As for logic, we expect no subjectivity (if there is subjectivity it's bad logic).