Transmission BitTorrent app contained malware • Hacker News Board

Re: Transmission BitTorrent app contained malware

#321

Post by andreamazz » Mon, Mar 07, 2016, 1:15 PM UTC

Angostura wrote: post #229

zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

In what respect is the OS X AppStore awful?

The guys at Bohemian coding discussed (even if not too in detail) it here: http://blog.sketchapp.com/post/134322691555/leaving-the-mac-...

Re: Transmission BitTorrent app contained malware

#322

Post by leonroy » Mon, Mar 07, 2016, 1:15 PM UTC

jws wrote: post #164

Just an anecdatum: I got infected by this yesterday when I installed Transmission to download a Debian install CD. When I read about this at MacRumors I checked and had the kernel_service process running and the two hidden files hiding in Library. I've unplugged and archived the TimeMachine backup disk and done the prescribed cleanup actions to remove he malware. I guess time will tell if it had any other tricks up i…

Do a search for any files in /Users and connected volumes which are suffixed with .encrypted. Apparently that's the interim filename suffix used by the malware.

Re: Transmission BitTorrent app contained malware

#323

Post by zZorgz » Mon, Mar 07, 2016, 1:18 PM UTC

This is really bad but there are two good security defenses that came out of that forum thread (which is better than not having them at all).

1. Apple revoked the certificate already. Thus people that have gatekeeper on are safer.

2. Sparkle (for auto updater) denied the malware infected update. Thus downloading from the main website is not necessarily safer, even with the recent mitm sparkle vulnerability.

Re: Transmission BitTorrent app contained malware

#324

Post by bartvk » Mon, Mar 07, 2016, 1:45 PM UTC

theinternetman wrote: post #314

woodman wrote: post #255

Earlier quoted context omitted.

I guess it depends. In the grandma scenario it adds a lot more effort. A corporate laptop in a standard AD environment, no problem. In a situation where you've customized the system (custom packages, sshd.conf tuning, flags in rc/csh/sysctl/resolv/loader/randomsbinutilityinstalled2yearsago.conf) it would be a lot more work than just reinstalling the OS. Use backups you say? What if I told you that you could use the v…

Not sure why anyone with a compromised machine would rather have the risk of a lingering backdoor just to save 1-2 hours clean formatting and reinstalling

Me neither, but there's a whole industry of software for Windows users that promises to remove malware.

Re: Transmission BitTorrent app contained malware

#325

Post by thrillgore » Mon, Mar 07, 2016, 1:59 PM UTC

zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

What amazes me is that this process can be totally automated and made invisible to the user.

Alas, nobody wants to invest the day or so in actually writing the methods to do it.

Re: Transmission BitTorrent app contained malware

#326

Post by thrillgore » Mon, Mar 07, 2016, 2:07 PM UTC

I checked my version of Transmission and i'm still on 2.84. I guess I dodged a big bullet, but tonight i'll go through the diagnostics to see if any versions prior to 2.90 were infected. I may do it sooner if I get a quiet moment at work.

I'm also running the usual litany of tools to check for activity (Wireshark on my WAN Tap, Anti-virus, etc)

My Synology NAS uses transmissiond for its BT Client, so I will be contacting them to see if they are affected by this issue.

Re: Transmission BitTorrent app contained malware

#327

Post by technomancy » Mon, Mar 07, 2016, 2:26 PM UTC

lottin wrote: post #150

arm wrote: post #138

Earlier quoted context omitted.

No, it wasn’t: “ The two KeRanger infected Transmission installers were signed with a legitimate certificate issued by Apple. The developer ID in this certificate is “POLISAN BOYA SANAYI VE TICARET ANONIM SIRKETI (Z7276PX673)”, which was different from the developer ID used to sign previous versions of the Transmission installer. In the code signing information, we found that these installers were generated and signe…

> which was different from the developer ID used to sign previous versions of the Transmission installer and that didn't ring any alarm bells?

It could cause a failure for updates but not fresh installs.

Many people would uninstall and download it over again when running into that kind of error message.

Re: Transmission BitTorrent app contained malware

#328

Post by feld » Mon, Mar 07, 2016, 2:42 PM UTC

nikanj wrote: post #91

TazeTSchnitzel wrote: post #82

Earlier quoted context omitted.

Beware that VMs are not necessarily secure. They can be escaped!

This argument is similar to "a condom can always break". Technically you are correct, but I'd still use one.

This argument is only similar if the condom is known to have huge design flaws

VMs have tons of well documented issues. If you want a smaller attack surface, try OS virtualization technologies (zones/jails)

Re: Transmission BitTorrent app contained malware

#329

Post by lawnchair_larry » Mon, Mar 07, 2016, 3:08 PM UTC

feld wrote: post #328

nikanj wrote: post #91

Earlier quoted context omitted.

This argument is similar to "a condom can always break". Technically you are correct, but I'd still use one.

This argument is only similar if the condom is known to have huge design flaws VMs have tons of well documented issues. If you want a smaller attack surface, try OS virtualization technologies (zones/jails)

This makes no sense. VMs are by far the most secure form of isolation. No one is going to get infected with malware that escapes VMs - it is far too valuable.

Re: Transmission BitTorrent app contained malware

#330

Post by samuellb » Mon, Mar 07, 2016, 3:48 PM UTC

theinternetman wrote: post #312

JetSpiegel wrote: post #105

Earlier quoted context omitted.

You can run your own repo. It's basically a folder with some metadata. DEB and RPM variants should get you 80% of the way.

How is that any more secure than just providing a download?

It's not at the time of installation, but prior to updates the package management system will check signatures of the packages. (And it will only accept packages signed with your key, so the attack used against Transmission wouldn't work)