Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

231–240 of 355 posts

Re: Transmission BitTorrent app contained malware

#231

Post by cooper12 »

justsaysmthng wrote: post #32

I've become increasingly paranoid lately, given that things like these happen and major bugs are uncovered in software that I use almost every day. It's good that the Transmission developer reacted quickly and made waves so that people can at least be aware that they might have been exposed.. But I wonder how many more applications from the hundreds that I have installed on my machines contain weird stuff - either in…

Reproducible builds might be a possible solution to this (as long as we can verify the integrity of the checksum): https://wiki.debian.org/ReproducibleBuilds

Re: Transmission BitTorrent app contained malware

#232

Post by TheCoreh »

Angostura wrote: post #229
zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

In what respect is the OS X AppStore awful?

- The APIs exposed to Mac App Store apps are more limited (because the OS X sandbox is not completely comprehensive in what it provides). This limits the types of apps that can be sold on the store.

- There's no means of providing paid upgrades. E.g. for a major version bump, which a lot of developers rely on to keep their business afloat.

- The store interface and navigation are also much slower than the iOS counterpart.

- Recently some certificate issues rendered users unable to open their apps.

- Not 100% sure on this one: You can't download older app versions if your OS is no longer supported.

Re: Transmission BitTorrent app contained malware

#234

Post by voltagex_ »

orionblastar wrote: post #196
Aleman360 wrote: post #177

Earlier quoted context omitted.

This is exactly why sandboxed apps (e.g., iOS/UWP/etc.) are a good thing.

For Windows there is SandboxIE: http://www.sandboxie.com/index.php?DownloadSandboxie It should be able to sandbox Windows Apps, except for Metro/Modern UI Apps and Microsoft Edge. Too many programs are having a backdoor or Trojan in them now. It is a good idea to run any app that accesses the Internet in a sandbox first to see what it does.

I have no problem paying for apps but for people who have paid for SandboxIE, do you think you've got your money's worth out of it?

Re: Transmission BitTorrent app contained malware

#235

Post by voltagex_ »

tomlong wrote: post #233

Posted by one of the researchers that discovered the malware... "#Transmission just pushed 2.92 update that includes code to > detect and to remove the #KeRanger ransomware. Update it before Monday 11:00am." https://twitter.com/claud_xiao/status/706579264036950016

I'm not sure how I feel about that. How long will that code live in Transmission? It's not really Transmission's job to remove malware.

Re: Transmission BitTorrent app contained malware

#236

Post by ctrlalt_g »

uxp wrote: post #205
tedks wrote: post #186

Earlier quoted context omitted.

But humans and viruses aren't competing in the same game. A better metaphor for the adversary in that situation is the person you're having sex with poking a hole in your condom.

These metaphors are hard to follow. Does anyone have a car analogy to phrase this better? Seems like that's all we're missing in this thread.

If you're worried about contracting STD's, don't have sex with a dirty prostitute, not even if you're wearing a condom, nor if you're sitting inside of a car.

Re: Transmission BitTorrent app contained malware

#237

Post by dave2000 »

touristtam wrote: post #193
dave2000 wrote: post #75

All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it. When you can't (be b…

Wouldn't have a container for this be good enough ?

I have no idea;I've never used a container. Is it easier than downloading an ISO, selecting how much ram/disk/cpu to give it and installing it?

Re: Transmission BitTorrent app contained malware

#238

Post by voltagex_ »

iam-TJ wrote: post #80
resoluteteeth wrote: post #14

Earlier quoted context omitted.

> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware in…

In Debian and Ubuntu at least, all published files containing binary executable files (ISOs, .deb packages, etc.) are hashed and the hash signed by a well-known system pre-installed PGP key. Given trust in the protection of the private key used to sign the hash list file the integrity of the executable content can be proved (assuming useful SHA1 collision creation is prohibitively expensive). Coincidentally I was wri…

Shouldn't you be using HTTPS for all downloads and grabbing the sha1s and image from different mirrors?

Re: Transmission BitTorrent app contained malware

#239

Post by maknz »

Checked my install of 2.9.0 from auto-update, it's clean (none of the suspect files are in Contents/Resources). According to a post on the Transmission forums, when a person was (probably) delivered an infected binary, there was a checksum failure as you'd expect. So it seems as though you won't be infected if you used the auto-updater.

Re: Transmission BitTorrent app contained malware

#240

Post by nowprovision »

voltagex_ wrote: post #238
iam-TJ wrote: post #80

Earlier quoted context omitted.

In Debian and Ubuntu at least, all published files containing binary executable files (ISOs, .deb packages, etc.) are hashed and the hash signed by a well-known system pre-installed PGP key. Given trust in the protection of the private key used to sign the hash list file the integrity of the executable content can be proved (assuming useful SHA1 collision creation is prohibitively expensive). Coincidentally I was wri…

Shouldn't you be using HTTPS for all downloads and grabbing the sha1s and image from different mirrors?

Great idea.
Post reply on HN