Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

331–340 of 355 posts

Re: Transmission BitTorrent app contained malware

#331

Post by gwbas1c »

pilif wrote: post #300

The fact that the binary was infected, I can somewhat understand. However, the way communication happened/is happening on this issue is very disconcerning and basically makes it impossible to know whether it's safe to currently download 2.92 from their site. Questions like - how did the compromised binary get there? Was the source code hijacked or was the binary altered after it had been built? - Were the SHA256 hash…

It will probably take time to get all of the answers, but in this case, automatic updates are safe.

Although I'm not a Transmission developer, I develop software that uses the same automatic update mechanism. It appears that the hacker did not update the MD5 present in the automatic update mechanism. (Sparkle) Thus, when the automatic update mechanism downloaded the hacked version of Transmission, it reported it as a corrupted download.

You can see the comment here: https://forum.transmissionbt.com/viewtopic.php?f=4&t=17834#p...

Re: Transmission BitTorrent app contained malware

#332

Post by mordocai »

theinternetman wrote: post #315
jsn117 wrote: post #261

Earlier quoted context omitted.

flying the day after 9/11 was the safest time, I really doubt this sort of thing will happen again to the same software

This would be true if they knew how it was compromised, they've been silent on that issue so far. The current version could be being compromised this minute for all we know.

Not an official comment, but from other parts of the hacker news thread it sounds like one of the mirrors the main site redirects to was hacked, not the main site itself. The SHA sums on the main site where apparently unaltered. So it sounds like the only fault on the developers is trusting that mirror.

Re: Transmission BitTorrent app contained malware

#333

Post by samuellb »

rhizome wrote: post #106
zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. I'm game, but I need a little help. What are your favorite techniques for verifying downloaded programs?

There's no completely secure way, except for getting the public key directly from the developer over a trusted channel (or in person). And even that won't protect you in case the developer's keys gets compromised.

But there are a number of things that can be done:

- always verify the checksum (if available), in case the download mirror (but not the web site itself) got compromised.

- check for strange strings in the binary (use "strings" and "grep"). E.g. URLs

- scan the downloaded file on Jotti or VirusTotal.

- unpack the binary manually with 7-zip or similar if it's a self-extracting file.

- check installation scripts, build files, etc. (if applicable).

- if downloading source code, check a couple of files at random. Will most likely not protect you, but if everyone does it, it helps detecting embedded malware (or bugs) early.

- run "strace" (Linux/Unix) or "FileMon" (Windows) or similar software and log what the software does when you install and run it for the first time.

- and check Hacker New regularly ;)

Re: Transmission BitTorrent app contained malware

#334

Post by pilif »

gwbas1c wrote: post #331
pilif wrote: post #300

The fact that the binary was infected, I can somewhat understand. However, the way communication happened/is happening on this issue is very disconcerning and basically makes it impossible to know whether it's safe to currently download 2.92 from their site. Questions like - how did the compromised binary get there? Was the source code hijacked or was the binary altered after it had been built? - Were the SHA256 hash…

It will probably take time to get all of the answers, but in this case, automatic updates are safe. Although I'm not a Transmission developer, I develop software that uses the same automatic update mechanism. It appears that the hacker did not update the MD5 present in the automatic update mechanism. (Sparkle) Thus, when the automatic update mechanism downloaded the hacked version of Transmission, it reported it as a…

> It appears that the hacker did not update the MD5 present in the automatic update mechanism. (Sparkle) Thus, when the automatic update mechanism downloaded the hacked version of Transmission, it reported it as a corrupted download

yeah. But not knowing how the attacker got access, we have no idea whether they have changed the current 2.92 binary again, this time remembering to update the hash in the appcast or whether this time around the binary is actually pristine.

The fact that the site was never down between this happening and the red warning text appearing makes me suspect that only a hasty cleanup was performed and that the actual security flaw might still exist.

Re: Transmission BitTorrent app contained malware

#335

Post by zepto »

gcb0 wrote: post #145
zepto wrote: post #28

Earlier quoted context omitted.

How is the OSX App Store 'awful' compared to a Linux package manager?

app store: anyone gets a id. sign whatever. just have to get past the automated detection. Debian: have to also fool several people involved in the packaging of said package upstream and everyone using it and building from source

Fair point. How is a compromised package revoked in the Debian case?

Re: Transmission BitTorrent app contained malware

#336

Post by sergiotapia »

jariz wrote: post #134
svetly0 wrote: post #125

Transmission put up a new version - 2.92 that supposedly checks for and removes the malware.

Threw away Transmission as soon as I read this (even though I was running a old version), my trust is pretty much gone now, never installing it again. Shame because it really was a nice app.

Same here, into the garbage it goes. What did you switch to by the way, Deluge? I switched TO Transmission because it was open source and supposed to be pure.

Re: Transmission BitTorrent app contained malware

#337

Post by jws »

leonroy wrote: post #322
jws wrote: post #164

Just an anecdatum: I got infected by this yesterday when I installed Transmission to download a Debian install CD. When I read about this at MacRumors I checked and had the kernel_service process running and the two hidden files hiding in Library. I've unplugged and archived the TimeMachine backup disk and done the prescribed cleanup actions to remove he malware. I guess time will tell if it had any other tricks up i…

Do a search for any files in /Users and connected volumes which are suffixed with .encrypted . Apparently that's the interim filename suffix used by the malware.

Thanks, I appear to be clear of .encrypted files.

The good of this mess is that I realized I only had one Time Machine backup going on that machine. I had turned off the remote backup a month ago while shoving backups around on the remote server to make more room and hadn't restored it. One backup is too few.

The weakness exposed is that if the remote were mounted, this malware would have nailed it too. I'll have to look at having the remote make filesystem snapshots on its end so malware can't corrupt my older backups.

Re: Transmission BitTorrent app contained malware

#338

Post by capripot »

zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

Why there isn't a default protocol for sending a the SHA key and verifying the downloaded file automatically?

Re: Transmission BitTorrent app contained malware

#339

Post by Aloisius »

TheCoreh wrote: post #232
Angostura wrote: post #229

Earlier quoted context omitted.

In what respect is the OS X AppStore awful?

- The APIs exposed to Mac App Store apps are more limited (because the OS X sandbox is not completely comprehensive in what it provides). This limits the types of apps that can be sold on the store. - There's no means of providing paid upgrades. E.g. for a major version bump, which a lot of developers rely on to keep their business afloat. - The store interface and navigation are also much slower than the iOS counter…

- There's no means of providing paid upgrades. E.g. for a major version bump, which a lot of developers rely on to keep their business afloat.

Apple and other do this by simply numbering the names of apps. They don't allow you to specify special "upgrade" pricing, but the effect of this was that developers no longer really have full retail pricing and everything is just set to the upgrade price.

Logic Pro 8 for instance used to retail at $499. The upgrade price was $199. Now Logic Pro X on the Mac App Store is just $199 regardless of whether you are first time user or someone who had the previous version.

- The store interface and navigation are also much slower than the iOS counterpart.

I haven't really found that the Mac Store is any slower. I've found that they are both slow.

- Not 100% sure on this one: You can't download older app versions if your OS is no longer supported.

I don't believe it will even show you newer versions of the apps as long as the developer properly specifies the minimum OS version.

Re: Transmission BitTorrent app contained malware

#340

Post by zZorgz »

pilif wrote: post #334
gwbas1c wrote: post #331

Earlier quoted context omitted.

It will probably take time to get all of the answers, but in this case, automatic updates are safe. Although I'm not a Transmission developer, I develop software that uses the same automatic update mechanism. It appears that the hacker did not update the MD5 present in the automatic update mechanism. (Sparkle) Thus, when the automatic update mechanism downloaded the hacked version of Transmission, it reported it as a…

> It appears that the hacker did not update the MD5 present in the automatic update mechanism. (Sparkle) Thus, when the automatic update mechanism downloaded the hacked version of Transmission, it reported it as a corrupted download yeah. But not knowing how the attacker got access, we have no idea whether they have changed the current 2.92 binary again, this time remembering to update the hash in the appcast or whet…

An attacker would need the private key to update the signature in the app cast. It's possible the devs store their private key on the server, although that would be silly.

Although that doesn't discount the recent MITM vulnerability Sparkle had and if transmission is still using an old version of the framework.

Post reply on HN