Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

transmissionbt.com

Post reply on HN
Print view View original

141–146 of 146 posts

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#141

Post by dantiberian »

koolba wrote: post #103
andreasley wrote: post #63

Earlier quoted context omitted.

According to this article [1], the compromised app was indeed signed – but with a different Developer ID than usual. Anyone with a credit card can sign up for Apple's developer program and start signing apps. [1] http://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-...

> According to this article [1], the compromised app was indeed signed – but with a different Developer ID than usual. That's the terrible part about all of this. Having signed applications without any verification of the signer is pointless. A simplistic, yet more secure approach, would be to have domain validated keys that could be used to sign applications. Browsers could then verify that the application downloade…

It's not completely pointless, as it allows Apple to (silently and quickly) release updates which distrust that Developer ID, however a stronger protection would be to pin apps to a particular Developer ID.

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#142

Post by [deleted] »

JadeNB wrote: post #134
ultramancool wrote: post #129

Earlier quoted context omitted.

Yeah, I keep stuff like that disabled for this reason, and because random sites like to add urls when you copy text. Just set dom.event.clipboardevents.enabled = false. Some shells also handle the paste and try to detect anything funny going on or at least let you review before you execute.

> Just set dom.event.clipboardevents.enabled = false. Your parent's link's trickery is to do not with JavaScript (it just uses raw HTML), so this would not mitigate that attack: git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.k…

[deleted]

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#143

Post by ultramancool »

JadeNB wrote: post #134
ultramancool wrote: post #129

Earlier quoted context omitted.

Yeah, I keep stuff like that disabled for this reason, and because random sites like to add urls when you copy text. Just set dom.event.clipboardevents.enabled = false. Some shells also handle the paste and try to detect anything funny going on or at least let you review before you execute.

> Just set dom.event.clipboardevents.enabled = false. Your parent's link's trickery is to do not with JavaScript (it just uses raw HTML), so this would not mitigate that attack: git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.k…

You missed a key point:

> unless your terminal emulator filters out the bracketed paste characters when pasting!

Any sane terminal should already be doing that, if not there's not really any point in offering bracketed paste in the first place as any input could break out of it.

Of course, this should really be on the browser for not delivering the proper text that the user selected to the clipboard.

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#144

Post by JadeNB »

ultramancool wrote: post #143
JadeNB wrote: post #134

Earlier quoted context omitted.

> Just set dom.event.clipboardevents.enabled = false. Your parent's link's trickery is to do not with JavaScript (it just uses raw HTML), so this would not mitigate that attack: git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.k…

You missed a key point: > unless your terminal emulator filters out the bracketed paste characters when pasting! Any sane terminal should already be doing that, if not there's not really any point in offering bracketed paste in the first place as any input could break out of it. Of course, this should really be on the browser for not delivering the proper text that the user selected to the clipboard.

> Any sane terminal should already be doing that, if not there's not really any point in offering bracketed paste in the first place as any input could break out of it.

I wanted to test whether the Mac OS Terminal.app does that, but can't even figure out how to turn on bracketed paste mode in the first place. (All a Google search turns up is an SO result assuring me that Terminal.app supports BPM. I can't find it anywhere in the settings.)

> Of course, this should really be on the browser for not delivering the proper text that the user selected to the clipboard.

On the other hand, it's hard to give an argument for how the browser should know that the user didn't mean to select the extra portion of the text. I know that I am always resistant to solutions where my software insists that it knows better than I do. Maybe a prompt if the selection includes invisible text? (I guess the browser can tell whether some of the text being selected is out of the view window.)

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#146

Post by jrochkind1 »

jquast wrote: post #131
jrochkind1 wrote: post #100

Earlier quoted context omitted.

And where do the checksums come from?

Changes made by GitHub pull requests. I'm sure an anonymous contributor who submits only a checksum change, without version bump, would most certainly fail review.

I don't believe that's true.

I'm googling to try to find how Homebrew uses checksums and where it gets them. But not everything homebrew installs comes from GitHub, so I don't see how checksums for all of it could come from 'Changes made by GitHub pull requests'.

And it looks like homebrew checksums both source packages and pre-compiled binaries. There's no way an upstream dependency would be providing their own checksum for a homebrew compiled binary. Homebrew also switched from using MD5 to using SHA1 recently (https://github.com/Homebrew/brew/blob/master/share/doc/homeb...), obviously all of their dependencies didn't switch in unison too, which suggests the checksums do not come from the dependencies themselves.

Looking for more info about this, having trouble finding it. To have confidence in homebrew's checksum system, one needs to know how it works and where they come from, but having trouble finding it.

Or did you mean the checksum is made in a PR to homebrew's own repo? Right, but the question is still where it comes from. If it was generated from bad source obtained from upstream, it will of course be bad. It's just verifying that the package as installed matches what homebrew maintainers meant to install; but that's no guarantee that what homebrew maintainers meant to install wasn't bad in the first place. Since transmission was distribution bad packages itself due to a hack, I'm not following how homebrew providing a checksum means that it can't re-distribute bad packages from upstream. It does mean that homebrew itself is harder to hack than transmission, but doesn't necessarily help when transmission is hacked.

Post reply on HN