Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

transmissionbt.com

Post reply on HN
Print view View original

31–40 of 146 posts

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#31

Post by dragandj »

FatalLogic wrote: post #26
okket wrote: post #18

Earlier quoted context omitted.

Neither during this or the previous incidence the updates were compromised (they were checked by the installed binary). Only fresh downloads from the website.

I haven't read much about this, so perhaps I'm not understanding clearly, but if the downloaded binary from Transmission's "website server" was replaced, then how is that not a compromise? I genuinely feel for the developers, and I personally would not blame them if I was affected, but unless the data was intercepted enroute from their server, then I think they have to accept some degree of responsibility for the who…

Well, they do accept some kind of responsibility: it is spelled out clearly in the license what they accept, and you can choose whether you prefer the terms defined in GPL, or MIT (Transmission is dual-licensed).

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#33

Post by iopq »

taspeotis wrote: post #22
temp wrote: post #9

Earlier quoted context omitted.

Only if you want an interface filled with ads.

Pay for it then? Netflix scratches my entertainment itch now, but prior to it launching in Australia I almost went ahead and paid for uTorrent. It's a good, lightweight client. Software that works well deserves to be financially supported.

qBittorrent is just as good and free, why pay for something that's maybe a few MB smaller? Do you really not have gigabytes of RAM on your machine? If you don't, I suggest spending that money on RAM.

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#34

Post by FatalLogic »

labster wrote: post #17
FatalLogic wrote: post #10

I'm not a Transmission user, but this makes me wonder, as a sort of Ask HN question: How long do you wait before updating software? If you always update as soon as possible, then you risk getting hit by a compromise like this one, or you could suffer other unintentional bad effects of a botched update. But the longer you delay updating, the more you raise your risk of becoming a victim of a new vulnerability that's j…

I wait about a week, unless I've heard out of band talk about some terrible hack with a punny name and we all need to upgrade NAO!1! I suppose I should always look for a secondary source for release notes or such as soon as possible; I don't because I am a lazy human.

Yes, totally, if you want to make the best decision, then you have to keep up with the news. That's why I'm interested in other opinions about this, because there's a lot of datapoints you need to factor into a decision. It's not a simple decision. That's work, and we are lazy humans, you're right.

But, I don't wait a whole week if the update is from an organization which I think I can trust not to totally botch an update, because they're conscious of the enormous potential for costly legal liability. I'm thinking of organizations such as Microsoft, Apple, Nvidia, AMD, Google, as a few examples. I might wait 1 or 2 days in that case.

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#35

Post by okket »

Simple file check if you are infected:

  if [ -f "/Applications/Transmission.app/Contents/Resources/License.rtf" ] || 
     [ -f "/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf" ] || 
     [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd" ] || 
     [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id" ] || 
     [ -f "$HOME/Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist" ] || 
     [ -d "/Library/Application Support/com.apple.iCloud.sync.daemon/" ] || 
     [ -f "$HOME/Library/LaunchAgents/com.geticloud.icloud.photo.plist" ]; 
  then echo "OSX/Keydnap detected.";
  else echo "You're good.";
  fi
Source: https://gist.github.com/kaizensoze/ca96d039b295db220951d42ca...

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#37

Post by iopq »

rahimnathwani wrote: post #32
king_phil wrote: post #3

I would have thought that Mac users would be a good target in general because they might have better income than Windows users...

Maybe per person, but probably not in aggregate.

Android users have way more money in aggregate, but iPhone apps make more money. This is because iPhone users have a lot more disposable income, while Android users are cheap.

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#38

Post by yladiz »

Kinda sucks, and I haven't followed Transmission for a while, but them transitioning more to Github is a good thing -- I trust Github more than a self hosted solution, in general. It sucks they've been compromised twice in a year, but hopefully this will help mitigate some of that.

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#39

Post by fredoralive »

FatalLogic wrote: post #26
okket wrote: post #18

Earlier quoted context omitted.

Neither during this or the previous incidence the updates were compromised (they were checked by the installed binary). Only fresh downloads from the website.

I haven't read much about this, so perhaps I'm not understanding clearly, but if the downloaded binary from Transmission's "website server" was replaced, then how is that not a compromise? I genuinely feel for the developers, and I personally would not blame them if I was affected, but unless the data was intercepted enroute from their server, then I think they have to accept some degree of responsibility for the who…

It was compromised, but wouldn't affect updates as the internal updater checks signatures.

(IIRC the first compromised version (not sure about the second) also had broken / no Mac OS codesigning, though I'm not sure how many people turn off / bypass gatekeeper).

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#40

Post by type0 »

taspeotis wrote: post #22
temp wrote: post #9

Earlier quoted context omitted.

Only if you want an interface filled with ads.

Pay for it then? Netflix scratches my entertainment itch now, but prior to it launching in Australia I almost went ahead and paid for uTorrent. It's a good, lightweight client. Software that works well deserves to be financially supported.

> Pay for it then?

Why? qBittorrent does a better job and it's open source in case you need to modify it.

Post reply on HN