Transmission BitTorrent app contained malware • Hacker News Board

Re: Transmission BitTorrent app contained malware

#341

Post by adidalal » Mon, Mar 07, 2016, 8:24 PM UTC

soraminazuki wrote: post #304

adidalal wrote: post #176

If you installed/updated via Homebrew-Cask [1], you should not be affected. 2.90 was not always compromised, and looking at Caskroom history, the checksum was only updated for the 2.84 -> 2.90 bump once [2]. It is updated and at 2.92 now, also [3]. (I'm one of the maintainers of Homebrew Cask) [1] https://github.com/caskroom/homebrew-cask [2] https://github.com/caskroom/homebrew-cask/issues/19504#issue... [3] https:/…

Homebrew Cask is awesome, but I still think security is an issue here because you still have to trust the upstream binaries are safe, each built and hosted by totally different people. Verifying checksums is certainly better than not checking them, but you still haven't escaped from the trust-whatever-binary-you-downloaded-from-the-internet-style of doing things. I really wish package managers like Homebrew Cask offe…

You are absolutely correct. Homebrew-Cask favors convenience and availability of as many applications as possible, though we make reasonable efforts to avoid malicious actors by verifying checksums, download links, and (soon) GPG verification where possible.

You may be interested in https://www.macports.org for a build-from-source solution for OSS projects.

Re: Transmission BitTorrent app contained malware

#342

Post by woodman » Tue, Mar 08, 2016, 12:16 AM UTC

theinternetman wrote: post #314

woodman wrote: post #255

Earlier quoted context omitted.

I guess it depends. In the grandma scenario it adds a lot more effort. A corporate laptop in a standard AD environment, no problem. In a situation where you've customized the system (custom packages, sshd.conf tuning, flags in rc/csh/sysctl/resolv/loader/randomsbinutilityinstalled2yearsago.conf) it would be a lot more work than just reinstalling the OS. Use backups you say? What if I told you that you could use the v…

Not sure why anyone with a compromised machine would rather have the risk of a lingering backdoor just to save 1-2 hours clean formatting and reinstalling

Because unless an unknown method of privilege elevation was used, it doesn't make sense. Do you throw a pinch of table salt over your shoulder as well? It also has a very strong Microsoft smell to it, where instead of doing root cause analysis on why Windows is misbehaving - you just reboot and cross your fingers.

Re: Transmission BitTorrent app contained malware

#343

Post by woodman » Tue, Mar 08, 2016, 1:42 AM UTC

justsaysmthng wrote: post #309

woodman wrote: post #64

Earlier quoted context omitted.

> Open source software is especially vulnerable ... the hacker can just compile the program from sources and add his own code You must be too young to remember how computer viruses originally spread by way of modified executable files: http://computervirus.uw.hu/ch04lev1sec2.html

Actually, dabbling in virus writing was the most exciting thing I could do on my 4.77Mhz 8086 running MSDOS 3.3 back in the day :). Patching is possible, but why bother when you can compile the app from sources? Nice book btw.

> but why bother when you can compile the app from sources?

Well, imagine that you are the attacker here. Would you rather keep your malware source in sync with the upstream code and build every target every update, or just use an off the shelf binary wrapper. Would you answer the same if you were targeting more than one app (in the case of a CDN attack)?

The only scenario in which source level malware makes sense to me is this: you are targeting a specific application and you are able to get your code into the project's SCM. In this scenario OSS is no more vulnerable than closed source.

Re: Transmission BitTorrent app contained malware

#344

Post by feld » Tue, Mar 08, 2016, 3:19 AM UTC

lawnchair_larry wrote: post #329

feld wrote: post #328

Earlier quoted context omitted.

This argument is only similar if the condom is known to have huge design flaws VMs have tons of well documented issues. If you want a smaller attack surface, try OS virtualization technologies (zones/jails)

This makes no sense. VMs are by far the most secure form of isolation. No one is going to get infected with malware that escapes VMs - it is far too valuable.

How can you honestly think VMs are the most secure form of isolation?

Re: Transmission BitTorrent app contained malware

#345

Post by kentonv » Tue, Mar 08, 2016, 6:58 AM UTC

woodman wrote: post #342

theinternetman wrote: post #314

Earlier quoted context omitted.

Not sure why anyone with a compromised machine would rather have the risk of a lingering backdoor just to save 1-2 hours clean formatting and reinstalling

Because unless an unknown method of privilege elevation was used, it doesn't make sense. Do you throw a pinch of table salt over your shoulder as well? It also has a very strong Microsoft smell to it, where instead of doing root cause analysis on why Windows is misbehaving - you just reboot and cross your fingers.

> Because unless an unknown method of privilege elevation was used

You seem to think that is unlikely. Why? New privesc bugs are found on a monthly basis in Linux and Windows. Does Grandma stay on top of kernel patches?

Nobody who does sandbox security (hint: I do sandbox security) thinks UID separation is sufficient to cordon malware anymore.

Re: Transmission BitTorrent app contained malware

#346

Post by woodman » Tue, Mar 08, 2016, 10:11 AM UTC

kentonv wrote: post #345

woodman wrote: post #342

Earlier quoted context omitted.

Because unless an unknown method of privilege elevation was used, it doesn't make sense. Do you throw a pinch of table salt over your shoulder as well? It also has a very strong Microsoft smell to it, where instead of doing root cause analysis on why Windows is misbehaving - you just reboot and cross your fingers.

> Because unless an unknown method of privilege elevation was used You seem to think that is unlikely. Why? New privesc bugs are found on a monthly basis in Linux and Windows. Does Grandma stay on top of kernel patches? Nobody who does sandbox security (hint: I do sandbox security) thinks UID separation is sufficient to cordon malware anymore.

> You seem to think that is unlikely. Why?

Because of the single user pc context. I've never seen a dropper that didn't have ring 0 later pull down a payload that escalated privilege. I'm not saying that it isn't possible, but at best it is very uncommon. I understand the better safe than sorry position, but with the context in mind, what safety are you getting by just assuming UID separation failed and going through the rigmarole of reinstallation? The user data has already been exposed.

I just don't agree with the simplified decision tree of "Infected --> reinstall", which disregards your work in sandboxing. Why should I even bother with the additional complexity of capability mode in my software, if we're all just assuming our defense has no depth.

Re: Transmission BitTorrent app contained malware

#347

Post by tedks » Tue, Mar 08, 2016, 6:19 PM UTC

uxp wrote: post #205

tedks wrote: post #186

Earlier quoted context omitted.

But humans and viruses aren't competing in the same game. A better metaphor for the adversary in that situation is the person you're having sex with poking a hole in your condom.

These metaphors are hard to follow. Does anyone have a car analogy to phrase this better? Seems like that's all we're missing in this thread.

Anti-lock breaks won't help you if your brake line is cut.

Re: Transmission BitTorrent app contained malware

#348

Post by kobayashi » Tue, Mar 08, 2016, 7:44 PM UTC

bartvk wrote: post #317

kobayashi wrote: post #245

Earlier quoted context omitted.

Admittedly, this might reasonably be considered a basic question, but how do you recommend running a VM on a Mac?

http://veertu.com Note that I've only used it to run Linux so far.

Does it run much better than in VirtualBox?

Re: Transmission BitTorrent app contained malware

#349

Post by [deleted] » Wed, Mar 09, 2016, 1:59 AM UTC

kruczek wrote: post #306

__david__ wrote: post #293

Earlier quoted context omitted.

> If you're not using HTTPS, you are either malicious, negligent, incompetent… Or poor. Hosting large amounts of binaries over https isn't cheap. I just priced Amazon S3 and cloudfront and for the amount of data that I serve it would cost $300 per month. That's a lot to commit for a GPL-ed binary that brings in practically zero revenue. Maybe there's a cut rate VPS out there that can handle 150GB of data and 3TB of b…

How much is it for the same volume of non-HTTPS traffic?

[deleted]

Re: Transmission BitTorrent app contained malware

#350

Post by kentonv » Thu, Mar 10, 2016, 3:52 AM UTC

woodman wrote: post #346

kentonv wrote: post #345

Earlier quoted context omitted.

> Because unless an unknown method of privilege elevation was used You seem to think that is unlikely. Why? New privesc bugs are found on a monthly basis in Linux and Windows. Does Grandma stay on top of kernel patches? Nobody who does sandbox security (hint: I do sandbox security) thinks UID separation is sufficient to cordon malware anymore.

> You seem to think that is unlikely. Why? Because of the single user pc context. I've never seen a dropper that didn't have ring 0 later pull down a payload that escalated privilege. I'm not saying that it isn't possible, but at best it is very uncommon. I understand the better safe than sorry position, but with the context in mind, what safety are you getting by just assuming UID separation failed and going through…

> I've never seen a dropper that didn't have ring 0 later pull down a payload that escalated privilege.

Probably because it isn't very useful to the attacker. Pwning the single user's account is sufficient. But I wouldn't bet on that being the case if it happened to me.

> what safety are you getting by just assuming UID separation failed and going through the rigmarole of reinstallation? The user data has already been exposed.

Most user data is not executable, so can probably safely be copied over. But if you don't wipe all executable software on the system it's hard to tell if some of it is still infected.

> Why should I even bother with the additional complexity of capability mode in my software, if we're all just assuming our defense has no depth.

Well, I'm talking about today's legacy desktop (and, to some extent, server) OSs, which have not prioritized user isolation because it hasn't really mattered ever since people stopped using timeshare systems.

Modern OSs that sandbox applications (e.g. ChromeOS, Android, iOS) are another story. I would expect that one Android app being malicious does not mean you have to wipe your phone, just uninstall the app. I would expect that ChromeOS can even recover from a full sandbox breakout, given secure boot.

But I don't trust Linux, Windows, or Mac OS desktops to be suitably hardened nor able to recover. And as wiping the whole system does not add very much cost over the cost of wiping the user account, it seems to me worth it to go all the way.