Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

181–190 of 355 posts

Re: Transmission BitTorrent app contained malware

#181

Post by diebir »

NN88 wrote: post #155
diebir wrote: post #152

This is a good illustration of why you should not install apps as administrator. Specifically, you should not install Mac OS packages, which allow for arbitrary pre- and post- install scripts to be executed as root. Same is true for Windows and Linux. There are privilege escalation bugs in any OS, but it is usually not a given. Throw the application into ~/Applications as a Mac bundle, worst that will happen is your…

so how do I get around this if most apps I want require this?

1. Petition vendors to stop distributing .pkg's

2. Most packages can be extracted with pkgutil and then just copied into ~/Applications.

It is infrequent that somebody needs to modify your OS and if they do, then they better explain why.

Re: Transmission BitTorrent app contained malware

#182

Post by Razengan »

julie1 wrote: post #31

The strength of a chain is the strength of its weakest link, and the more "apps" are provided as the system the longer and more vulnerable is the chain. When it comes to checksums with have the chicken egg problem plus the collision attack of md5. MD5 has been the standard for too long (and is deprecated since 10 years for crypto checksum). And for next generation of softwares to install that don't do modern checksum…

> There is a tyranny of computer engineers regarding what is safe for people having a life not concerned about geeky technology that is a tad annoying.

You know you can make that complaint about any tool or technology, right?

"Gosh why do I have to follow all these rules and observe traffic lights to drive a car?" (something that actually intimidates me, in fact, because I've never driven a car.)

"Why do I have to worry about cutting or burning myself or someone else while trying to cook a meal?"

"Why are all these procedures and protocols, like schools and banks and taxes, required to function at all in contemporary society?"

Until computers advance to the point of being artificially intelligent familiars that can figure out exactly what we want from a simple vocal command and do something even better, we're gonna have to put in a little effort from our end to make them work the way we want them to.

Re: Transmission BitTorrent app contained malware

#184

Post by arm »

jakobegger wrote: post #127
thesimon wrote: post #112

Earlier quoted context omitted.

And according to the analysis [0], this is exactly what they did. They used a different cert to sign their malware. I have to admit that Windows' UAC is better in that regard, as it shows the signees name. But of course this is only useful if you know the "right" name. [0] http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...

Yeah, I think this is a major issue on OS X. For the average user it is impossible to tell who signed an app, if it is sandboxed, and what permissions it has. Hell, using the codesign command to extract entitlements from all binaries in a package is hard even for advanced users... (There is third party tool named RB App Checker which does make these tasks a bit easier, though)

Well, I guess that’s at least one advantage for apps that use Installer.app¹ to install; Installer.app makes it really easy to see the certificate².

――――――

¹ — https://en.wikipedia.org/wiki/Installer_(OS_X)

² — http://f.cl.ly/items/1s1E3n19273M1l3i3S2X/developer_id_insta...

Re: Transmission BitTorrent app contained malware

#186

Post by tedks »

jdc wrote: post #144
TazeTSchnitzel wrote: post #121

Earlier quoted context omitted.

HIV is not a threat crafted by an active adversary, it's a product of evolution.

I think the point is that viruses can exploit properties of their hosts regardless of how they came to do so.

But humans and viruses aren't competing in the same game. A better metaphor for the adversary in that situation is the person you're having sex with poking a hole in your condom.

Re: Transmission BitTorrent app contained malware

#187

Post by fefifofu »

jariz wrote: post #134
svetly0 wrote: post #125

Transmission put up a new version - 2.92 that supposedly checks for and removes the malware.

Threw away Transmission as soon as I read this (even though I was running a old version), my trust is pretty much gone now, never installing it again. Shame because it really was a nice app.

I don't even trust websites and emails, so not sure why you would trust a bittorrent client. I still use these tools, but with some some caution. Your level of caution is up to you. Other posters suggested things such as verifying checksum and virtual machines.

Re: Transmission BitTorrent app contained malware

#188

Post by cesarb »

justsaysmthng wrote: post #173
franciscop wrote: post #43

Earlier quoted context omitted.

> "Open source software is especially vulnerable to this kind of stuff." I am sorry, what? Why would open source contain more bugs/hacks than closed source specifically? It is more often in the news for few reasons, including that many projects are widely used. However it's against any PR from companies to have their security issues disclosed like they are in open source so they try to minimize the exposure. See [1]…

The risk is not in the software itself, but in the server which hosts the installers. A hacker could just build the software from sources (adding his backdoor) and replace the original installers with his own, if the server is not properly secured.

The risk is exactly the same with proprietary software. A hacker can unpack the installer and create a new one with his changes. Or, as they often do, create a wrapper which installs their malware and then calls into the original unmodified installer.

Re: Transmission BitTorrent app contained malware

#189

Post by snom380 »

justsaysmthng wrote: post #172
SwellJoe wrote: post #50

Earlier quoted context omitted.

"Open source software is especially vulnerable to this kind of stuff." I'm not sure I follow on this front. Proprietary software could be compromised (whether intentionally by the vendor or unintentionally by some outsider working on the software) effectively forever with no one noticing. At least with OSS, the number of eyes on the source makes it less likely that an exploit will exist for long (though the definitio…

I was thinking more about the users on Macs and Windows who use open source software.. The risk is not in the sources, but in the server which hosts the installers. A hacker could just build the software from sources (adding his backdoor) and replace the original installers with his own.

..and the same is true for closed source software. Replacing installers and patching binaries isn't difficult.
Post reply on HN