Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

221–230 of 355 posts

Re: Transmission BitTorrent app contained malware

#221

Post by owaislone »

ikeboy wrote: post #115
nmjohn wrote: post #113

Earlier quoted context omitted.

Quote from a google engineer in 2010 (it's only gotten cheaper in the last 6 years w/ advances in CPU tech) regarding SSL overhead: > On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help…

None of affects the point they're making, which is that they can't find SSL mirrors that aren't more expensive. If you find one, let them know and I'm sure they'll be happy to switch over.

It is 2016. SSL is not slow anymore. Only case it could be deemed slow would be on a webpage where the browser has to download a ton of small files likes images. Each image would require a new connection and each connection would require full SSL handshake. Even then the fix is not to not use SSL but to bundle all the images/files into 1.

Re: Transmission BitTorrent app contained malware

#222

Post by [deleted] »

ikeboy wrote: post #115
nmjohn wrote: post #113

Earlier quoted context omitted.

Quote from a google engineer in 2010 (it's only gotten cheaper in the last 6 years w/ advances in CPU tech) regarding SSL overhead: > On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help…

None of affects the point they're making, which is that they can't find SSL mirrors that aren't more expensive. If you find one, let them know and I'm sure they'll be happy to switch over.

[deleted]

Re: Transmission BitTorrent app contained malware

#223

Post by daveguy »

orionblastar wrote: post #196
Aleman360 wrote: post #177

Earlier quoted context omitted.

This is exactly why sandboxed apps (e.g., iOS/UWP/etc.) are a good thing.

For Windows there is SandboxIE: http://www.sandboxie.com/index.php?DownloadSandboxie It should be able to sandbox Windows Apps, except for Metro/Modern UI Apps and Microsoft Edge. Too many programs are having a backdoor or Trojan in them now. It is a good idea to run any app that accesses the Internet in a sandbox first to see what it does.

Also cameyo to make your own:

http://www.cameyo.com

And they have prepackaged sandboxed apps:

https://online.cameyo.com/public

Re: Transmission BitTorrent app contained malware

#224

Post by Matt3o12_ »

conradev wrote: post #217
Matt3o12_ wrote: post #207

Earlier quoted context omitted.

But it might need to push new (binary) updates if the master/deploy branches gets updated or a commit contains a specific tag. As far as I know, only the binary was updated. I'd be interested to hear, though, how it got compromised after all.

Yeah, that makes sense. Build servers are one of the weakest links in distributing software. That's why this exists and I'm glad it's making progress: https://reproducible-builds.org And even if you sign updates, the key management for doing that is usually centralized, which can be bad: http://arstechnica.com/security/2016/02/most-software-alread...

I do not think it was the build server, though. According to this analysis[1], the developer used a different key to sign the build (all Mac apps need to be signed or the default behavior is to reject that App. You can permanently disable this behavior in settings, or just for on app by holding control while opening the App, which a lot users who use transmission probably do because not all legitimate Apps are signed). Anyways, since the app was signed by a third party's certificate (which was approved by Apple), chances are only the website was compromised. If the build server had been compromised, the attack would have had access to the developer's certificate and they would most likely have used that.

[1]: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...

Re: Transmission BitTorrent app contained malware

#225

Post by ricardobeat »

diebir wrote: post #179
0x0 wrote: post #168

Earlier quoted context omitted.

I think it's a poor illustration. You could install and run this app as a regular user (and never escalate to administrator) and the app's bundled malware would still absolutely destroy anything of value on your computer. It's the stuff inside $HOME (and $HOME/Documents) that's valuable. Not system binaries in {/bin,/sbin,/Applications} that can be re-downloaded in a second. The problem is that any non-sandboxed app…

First, obviously you can make an account for running the untrusted software, like Bittorrent clients (which are known to carry malware frequently). Second, most malware requires and counts on having admin privileges on target machine. The task of auditing, cleaning and finding out that malware is present is significantly easier if malware is limited to a non-privileged account. With malware running as a non-privilege…

His comment went right past you. What you care about the most on your computer is your personal data, and all of it sits under $HOME. Any script running as $USER can steal sensitive data, wipe out personal and work files, maybe even cloud storage services. None of that requires admin rights.

The only solution is sandboxing everything.

Re: Transmission BitTorrent app contained malware

#226

Post by owaislone »

r0muald wrote: post #19
mhurron wrote: post #13

Earlier quoted context omitted.

> Linux package managers are looking like one of the only straightforward ways to distribute applications securely. Linux distributions package what is released upstream. If upstream is compromised, so is the Linux package.

No, Linux distributions offer packages and operating systems that are the result of painstaking work in which all upstream code is reviewed, patched for any inconsistency, and often blocked from going into public archives until known bugs are fixed.

Actually, most have scripts that pull the upstream source and build new binaries without any manual intervention. It is the responsibility of the package maintainer to review every change in code.

Re: Transmission BitTorrent app contained malware

#227

Post by kazazes »

Philipp__ wrote: post #220

Oh dear god. Used 2.90 past week, when I saw the news I updated immediately, checked for all the files, found nothing. I hope my MacBook will stay fine tomorrow. I got it backed up on Time Machine anyway. Where do we go from here, since I lost the trust, what are the alternatives? And from now one, I'll go with Brew Cask for everything possible. F * GUI /s

Would brew cask have helped you here? It doesn't build from source, it just downloads a precompiled binary.

Re: Transmission BitTorrent app contained malware

#228

Post by mort96 »

uxp wrote: post #205
tedks wrote: post #186

Earlier quoted context omitted.

But humans and viruses aren't competing in the same game. A better metaphor for the adversary in that situation is the person you're having sex with poking a hole in your condom.

These metaphors are hard to follow. Does anyone have a car analogy to phrase this better? Seems like that's all we're missing in this thread.

It's like not putting a condom on your car. Sure, HIV might stick a hole in it, but I'd still use one.

Re: Transmission BitTorrent app contained malware

#229

Post by Angostura »

zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

In what respect is the OS X AppStore awful?

Re: Transmission BitTorrent app contained malware

#230

Post by mirimir »

Crito wrote: post #130
MichaelGG wrote: post #103

It's not. Condoms aren't used against a hostile opponent. If your partner is intent on exposing you, a condom won't provide any protection.

Running software in VMs to stay safe is not a new idea. So is it effective in this case? Just because attackers can break out of VMs, doesn't mean that they always do. I wager most malware out there isn't set up to do that. Locking your car door won't keep a dedicated attacker out of your car. Simple ceramic shards from a sparkplug will get them through the window with barely any effort at all. Nevertheless, locking…

As far as I know, malware generally won't run in VMs. Because its enemies use VMs to study it. The side benefit is that VM breakout is rare. Except from the NSA ;)
Post reply on HN