Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

31–40 of 355 posts

Re: Transmission BitTorrent app contained malware

#31

Post by julie1 »

The strength of a chain is the strength of its weakest link, and the more "apps" are provided as the system the longer and more vulnerable is the chain.

When it comes to checksums with have the chicken egg problem plus the collision attack of md5.

MD5 has been the standard for too long (and is deprecated since 10 years for crypto checksum). And for next generation of softwares to install that don't do modern checksum how can they trust the download of the package required to check for whatever the new format? Plus the new format is less likely to be checked without errors. A off by one character could easily be discarded in checking given the number of packages that are now required to be installed and the human limitation in focus.

Human are the limiting factors, and security is modeling the user in a kind of grotesque caricature of a robot that can check thousands of informations perfectly and remember 20 characters passwords for tens of appliances.

There is a tyranny of computer engineers regarding what is safe for people having a life not concerned about geeky technology that is a tad annoying.

People have the right to be human and to fail is human. The burden put on human to make the system safe in order to avoid costly for the bosses human interactions is way to high.

And since computer security always blame failure on human behaviour I begin to positively dislike it.

Re: Transmission BitTorrent app contained malware

#32

Post by justsaysmthng »

I've become increasingly paranoid lately, given that things like these happen and major bugs are uncovered in software that I use almost every day.

It's good that the Transmission developer reacted quickly and made waves so that people can at least be aware that they might have been exposed..

But I wonder how many more applications from the hundreds that I have installed on my machines contain weird stuff - either intentional (for money) or unintentionally (result of a hack).

Open source software is especially vulnerable to this kind of stuff.

If a hacker gets access to a server holding the binaries for an open source app (which most people download), the hacker can just compile the program from sources and add his own code in there and place the installer online.

Given that many big governments are now involved in the information wars, this scenario is quite likely.

Re: Transmission BitTorrent app contained malware

#34

Post by make3 »

rMBP wrote: post #30

I'm on 2.90 and can't find any weird processes running. I'll hold off on 2.91 until they've explained what happened.

that feels like a pretty week standard for knowing if your machine is infected. I will look for a virus scanner myself, and seriously think about reinstalling if it finds anything

Re: Transmission BitTorrent app contained malware

#35

Post by the_mitsuhiko »

wlesieutre wrote: post #24
ikeboy wrote: post #11

Hm. https://trac.transmissionbt.com/wiki/Changes#version-2.91 lists the following under Mac changes for 2.90 >Allow downloading files from http servers (not https) on OS X 10.11+ Mac version affected in OP was 10.10, though. Maybe it had something to do with >Change Sparkle Update URL to use HTTPS instead of HTTP (addresses Sparkle vulnerability) ? Edit: it appears the infection was downloaded from a website, in whic…

>Allow downloading files from http servers (not https) on OS X 10.11+ This reads like they disabled Apple's "App Transport Security", which only allows HTTPS connections unless a program explicitly makes an exception. Introduced in iOS 9 and OS 10.11 (El Capitan). I bet the failing HTTP connections caused a bug in Transmission, and it was an easier fix to disable ATS than to transition whatever connection to HTTPS. h…

> and it was an easier fix to disable ATS than to transition whatever connection to HTTPS.

Pretty sure this is for arbitrary downloads. Unless you want to prevent transmission to download from http based sources out of principle it makes no sense to do anything other than opting out of this behavior.

Re: Transmission BitTorrent app contained malware

#36

Post by [deleted] »

wlesieutre wrote: post #24
ikeboy wrote: post #11

Hm. https://trac.transmissionbt.com/wiki/Changes#version-2.91 lists the following under Mac changes for 2.90 >Allow downloading files from http servers (not https) on OS X 10.11+ Mac version affected in OP was 10.10, though. Maybe it had something to do with >Change Sparkle Update URL to use HTTPS instead of HTTP (addresses Sparkle vulnerability) ? Edit: it appears the infection was downloaded from a website, in whic…

>Allow downloading files from http servers (not https) on OS X 10.11+ This reads like they disabled Apple's "App Transport Security", which only allows HTTPS connections unless a program explicitly makes an exception. Introduced in iOS 9 and OS 10.11 (El Capitan). I bet the failing HTTP connections caused a bug in Transmission, and it was an easier fix to disable ATS than to transition whatever connection to HTTPS. h…

[deleted]

Re: Transmission BitTorrent app contained malware

#37

Post by sandstrom »

CNBC isn't a website I'd expect to read anything tech-related on, but there are actually a few details in this article:

http://www.cnbc.com/2016/03/06/reuters-america-apple-users-t...

- It's Ransomware.

- Seems to be a 3 day grace-period (chance to remove it, possibly).

- The Transmission developer certificate [Gatekeeper] has been revoked.

Re: Transmission BitTorrent app contained malware

#38

Post by kpcyrd »

justsaysmthng wrote: post #32

I've become increasingly paranoid lately, given that things like these happen and major bugs are uncovered in software that I use almost every day. It's good that the Transmission developer reacted quickly and made waves so that people can at least be aware that they might have been exposed.. But I wonder how many more applications from the hundreds that I have installed on my machines contain weird stuff - either in…

It's trivial to do this with closed source applications as well.

Re: Transmission BitTorrent app contained malware

#39

Post by sandstrom »

wlesieutre wrote: post #20
mmgutz wrote: post #16

Does installing 2.9.1 remove it completely or just from the Transmission app? I'm concerned the malware is still there.

Additionally, what does the malware do? "OSX.KeRanger.A" appears to be a name that Apple assigned it in their malware definitions, but Google doesn't know anything except the pages about Transmission. I'm curious what sort of malware we're looking at. Botnet? General remote access/control? Harvesting keychains?

According to this article it's ransomware.

http://www.cnbc.com/2016/03/06/reuters-america-apple-users-t...

Re: Transmission BitTorrent app contained malware

#40

Post by moyix »

VirusTotal has some more info, including the files it writes:

https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc...

(Look under the "Behavioural information" tab)

Written Files and Created Processes are interesting:

[Transmission] /Users/user1/Library/kernel_service (successful)

[unknown] /Users/user1/Library/.kernel_pid (successful)

[unknown] /Users/user1/Library/Saved Application State/org.m0k.transmission.savedState/window_1.data (successful)

[Transmission] /Users/user1/Library/Saved Application State/org.m0k.transmission.savedState/data.data (successful)

[Transmission] /Users/user1/Library/Saved Application State/org.m0k.transmission.savedState/windows.plist (successful)

[kernel_service] /Users/user1/Library/.kernel_time (successful)

Created processes

/Volumes/Transmission/Transmission.app/Contents/MacOS/Transmission (successful)

/Users/user1/Library/kernel_service (successful)

kernel_service (successful)

Edited to add: If anyone has a copy of the DMG, sha1 5f8ae46ae82e346000f366c3eabdafbec76e99e9, please link me a copy via email (brendandg@nyu.edu) or twitter DM (@moyix).

Post reply on HN