111–120 of 146 posts
They never responded with details of what they were doing to improve security after the last incident: https://forum.transmissionbt.com/viewtopic.php?f=1&t=17938 . The outside appearance is that they didn't address the problem seriously enough.
Yeah, I was thinking, didn't this happen before?
They never responded with details of what they were doing to improve security after the last incident: https://forum.transmissionbt.com/viewtopic.php?f=1&t=17938 . The outside appearance is that they didn't address the problem seriously enough.
Earlier quoted context omitted.
Your line downloads and executes the latest version of the gist, it could have changed from a file check to a virus installer by the author (unlikely, but I have to point it out). To be a bit more safe (while trusting that GitHub is not compromised) pin a known, verified version: curl https://gist.githubusercontent.com/kaizensoze/ca96d039b295db220951d42ca7c83d89/raw/a26e5a025ea21d3a0af536eeca49619272d0068f/quick-osx-…
this pattern is just as dangerous (maybe less for github if you trust them) because you can detect curl and deliver malicious code: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
As a general pattern, please do not do this. In this specific case I think most people trust the service (GitHub) and their DNS recursor + SSL library. Attacking these is not on the level of "random drive-by phishing", more like "targeted high value state sponsored".
To avoid this discussion I did not include the curl version in my original posting.
Earlier quoted context omitted.
Yes. And updates are checked within the Transmission app.
Looks like it was signed by a different developer: https://news.ycombinator.com/item?id=12403906 In comparison to Windows, macOS doesn't really seem to show the developer in the normal user flow.
――――――
¹ — https://en.wikipedia.org/wiki/Installer_(OS_X)
² — http://f.cl.ly/items/1s1E3n19273M1l3i3S2X/developer_id_insta...
Earlier quoted context omitted.
Main reason that I only install stuff like this from my distro's repositories. Anyone know if this would have affected homebrew and such on OSX?
When this happens regularly like with Transmission, is there a guarantee the version in official repos is not affected? The only way to be sure would be code checks and I doubt they do that.
Earlier quoted context omitted.
When this happens regularly like with Transmission, is there a guarantee the version in official repos is not affected? The only way to be sure would be code checks and I doubt they do that.
That is why packages can be so slow to filter through from upstream.
Earlier quoted context omitted.
I really thought Apple had added a free option (maybe even specifically for open source projects?), but I can't find it anywhere. Can anyone else find that info, or am I misremembering?
I believe you are misremembering the details. There is a free account option, but code signing isn't available. https://developer.apple.com/support/compare-memberships/ What's not clear to me, however, is if the educational option allows for free developer-level memberships.
It looks like Educational memberships are Sign-In With Apple ID only, which doesn't provide a Developer ID (which is required for code signing, as far as I can tell).
More info on the malware: > The OSX/Keydnap backdoor is equipped with a mechanism to gather and exfiltrate passwords and keys stored in OS X’s keychain. The author simply took a proof-of-concept example available on Github called Keychaindump. It reads securityd’s memory and searches for the decryption key for the user’s keychain. This process is described in a paper by K. Lee and H. Koo. One of the reasons we think…
According to the article, the title is wrong "The infected file was available for download somewhere between a few hours and less than a day."
More info on the malware: > The OSX/Keydnap backdoor is equipped with a mechanism to gather and exfiltrate passwords and keys stored in OS X’s keychain. The author simply took a proof-of-concept example available on Github called Keychaindump. It reads securityd’s memory and searches for the decryption key for the user’s keychain. This process is described in a paper by K. Lee and H. Koo. One of the reasons we think…
Wow. I'm the author of keychaindump. Didn't expect to become a malware co-author.
