Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware identified in CCleaner 5.33

blog.talosintelligence.com

Post reply on HN
Print view View original

11–20 of 229 posts

Re: Malware identified in CCleaner 5.33

#11

Post by westoque »

princekolt wrote: post #10

There has been a number of cases of installers from trusted developers being infected lately. (For example Transmission being infected twice...) On our side (developers) we need to be careful with this idea that "we will know" when something is wrong and be more careful when deploying software. It would also be nice if some form of tool could be used to test a binary to make sure it only contains what it should conta…

Binary analysis for each software you install might be too cumbersome for most developers.

I suggest you use something like "Little Snitch" for mac which warns you when software makes inside/outside connections.

It might not be the best, but it's definitely something that works to mitigate some hacks.

Re: Malware identified in CCleaner 5.33

#12

Post by princekolt »

westoque wrote: post #11
princekolt wrote: post #10

There has been a number of cases of installers from trusted developers being infected lately. (For example Transmission being infected twice...) On our side (developers) we need to be careful with this idea that "we will know" when something is wrong and be more careful when deploying software. It would also be nice if some form of tool could be used to test a binary to make sure it only contains what it should conta…

Binary analysis for each software you install might be too cumbersome for most developers. I suggest you use something like "Little Snitch" for mac which warns you when software makes inside/outside connections. It might not be the best, but it's definitely something that works to mitigate some hacks.

Thing is, you can't even trust little snitch these days[1] :(

At least a binary check after compilation+signing (by the developer) should improve security a little bit.

[1]: https://objective-see.com/blog/blog_0x21.html

Re: Malware identified in CCleaner 5.33

#15

Post by mollusk »

princekolt wrote: post #10

There has been a number of cases of installers from trusted developers being infected lately. (For example Transmission being infected twice...) On our side (developers) we need to be careful with this idea that "we will know" when something is wrong and be more careful when deploying software. It would also be nice if some form of tool could be used to test a binary to make sure it only contains what it should conta…

>Transmission being infected twice

Could you please elaborate? I only recall one instance of compromised Transmission installer.

Re: Malware identified in CCleaner 5.33

#16

Post by princekolt »

mollusk wrote: post #15
princekolt wrote: post #10

There has been a number of cases of installers from trusted developers being infected lately. (For example Transmission being infected twice...) On our side (developers) we need to be careful with this idea that "we will know" when something is wrong and be more careful when deploying software. It would also be nice if some form of tool could be used to test a binary to make sure it only contains what it should conta…

>Transmission being infected twice Could you please elaborate? I only recall one instance of compromised Transmission installer.

https://www.reddit.com/r/torrents/comments/50dm8e/transmissi...

Re: Malware identified in CCleaner 5.33

#18

Post by corv »

westoque wrote: post #11
princekolt wrote: post #10

There has been a number of cases of installers from trusted developers being infected lately. (For example Transmission being infected twice...) On our side (developers) we need to be careful with this idea that "we will know" when something is wrong and be more careful when deploying software. It would also be nice if some form of tool could be used to test a binary to make sure it only contains what it should conta…

Binary analysis for each software you install might be too cumbersome for most developers. I suggest you use something like "Little Snitch" for mac which warns you when software makes inside/outside connections. It might not be the best, but it's definitely something that works to mitigate some hacks.

I like to compliment Little Snitch with XFence (formerly known as Little Flocker).

You can think of it as a firewall for your filesystem and devices.

Re: Malware identified in CCleaner 5.33

#19

Post by [deleted] »

princekolt wrote: post #10

There has been a number of cases of installers from trusted developers being infected lately. (For example Transmission being infected twice...) On our side (developers) we need to be careful with this idea that "we will know" when something is wrong and be more careful when deploying software. It would also be nice if some form of tool could be used to test a binary to make sure it only contains what it should conta…

[deleted]

Re: Malware identified in CCleaner 5.33

#20

Post by contravariant »

princekolt wrote: post #10

There has been a number of cases of installers from trusted developers being infected lately. (For example Transmission being infected twice...) On our side (developers) we need to be careful with this idea that "we will know" when something is wrong and be more careful when deploying software. It would also be nice if some form of tool could be used to test a binary to make sure it only contains what it should conta…

I'm not sure how exactly these infections work, but one method would be to infect the developers' PCs. In which case you essentially can't trust anything. You'd need some kind of byzantine fault tolerance (mandatory multi-person code review?) to be sure nothing like this ever happens

What makes this scary is that, as far as I know, pretty much no software has that kind of security, and there are several pieces of widely used software that always update automatically (sometimes for good reason, sometimes not so much).

Post reply on HN