Transmission BitTorrent app contained malware • Hacker News Board

Re: Transmission BitTorrent app contained malware

#41

Post by coldtea » Sun, Mar 06, 2016, 6:49 PM UTC

zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

>Though I think most people can't be bothered to verify the checksum on a file every time they download it.

This wouldn't help anyway. If the malicious party had access to alter the downloads (as they did here) they could just as well change the checksum shown on the page to.

>On the other hand, the Windows and OS X App Stores are awful.

Haven't used the Windows one, but what's "awful" about the OS X one? Quick, one click, installations, isolated, signed, easy updates.

Might be bad for the application developers somehow, but I don't see anything much bad about it from a user perspective -- except maybe the lack of trials. Then again I've been able to get a refund any time I bought an app that was subpar and written to Apple (that was 2 times).

Re: Transmission BitTorrent app contained malware

#42

Post by cesarb » Sun, Mar 06, 2016, 6:49 PM UTC

wlesieutre wrote: post #24

ikeboy wrote: post #11

Hm. https://trac.transmissionbt.com/wiki/Changes#version-2.91 lists the following under Mac changes for 2.90 >Allow downloading files from http servers (not https) on OS X 10.11+ Mac version affected in OP was 10.10, though. Maybe it had something to do with >Change Sparkle Update URL to use HTTPS instead of HTTP (addresses Sparkle vulnerability) ? Edit: it appears the infection was downloaded from a website, in whic…

>Allow downloading files from http servers (not https) on OS X 10.11+ This reads like they disabled Apple's "App Transport Security", which only allows HTTPS connections unless a program explicitly makes an exception. Introduced in iOS 9 and OS 10.11 (El Capitan). I bet the failing HTTP connections caused a bug in Transmission, and it was an easier fix to disable ATS than to transition whatever connection to HTTPS. h…

It's probably for "web seeds" or similar, where a torrent file's author specifies alternate URIs where the content can also be found. Transmission has no control over whether the torrent file's author specifies http or https, it has to allow both (and http is actually safe, since the downloaded file goes through the same piecewise checksum as if it were downloaded from a peer).

Re: Transmission BitTorrent app contained malware

#43

Post by franciscop » Sun, Mar 06, 2016, 6:50 PM UTC

justsaysmthng wrote: post #32

I've become increasingly paranoid lately, given that things like these happen and major bugs are uncovered in software that I use almost every day. It's good that the Transmission developer reacted quickly and made waves so that people can at least be aware that they might have been exposed.. But I wonder how many more applications from the hundreds that I have installed on my machines contain weird stuff - either in…

> "Open source software is especially vulnerable to this kind of stuff."

I am sorry, what? Why would open source contain more bugs/hacks than closed source specifically? It is more often in the news for few reasons, including that many projects are widely used. However it's against any PR from companies to have their security issues disclosed like they are in open source so they try to minimize the exposure. See [1]

[1] http://www.techrepublic.com/article/open-source-vs-proprieta...

Re: Transmission BitTorrent app contained malware

#44

Post by regularfry » Sun, Mar 06, 2016, 6:50 PM UTC

r0muald wrote: post #19

mhurron wrote: post #13

Earlier quoted context omitted.

> Linux package managers are looking like one of the only straightforward ways to distribute applications securely. Linux distributions package what is released upstream. If upstream is compromised, so is the Linux package.

No, Linux distributions offer packages and operating systems that are the result of painstaking work in which all upstream code is reviewed, patched for any inconsistency, and often blocked from going into public archives until known bugs are fixed.

That's... optimistic.

Re: Transmission BitTorrent app contained malware

#45

Post by maxerickson » Sun, Mar 06, 2016, 6:50 PM UTC

resoluteteeth wrote: post #14

zymhan wrote: post #2

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware in…

I really sort of expect a signing-keys-on-download-server announcement any time now.

Re: Transmission BitTorrent app contained malware

#46

Post by msh » Sun, Mar 06, 2016, 6:51 PM UTC

sd8f9iu wrote: post #26

resoluteteeth wrote: post #14

Earlier quoted context omitted.

> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware in…

I thought only apps signed by "identified developers" are run by default on Macs with Gatekeeper now. Shouldn't code-signing have prevented this? Unless they inserted the malware before the signing process.

Hold down control, right click and choose run. Then once will run unsigned binaries (after a warning).

Re: Transmission BitTorrent app contained malware

#47

Post by coldtea » Sun, Mar 06, 2016, 6:52 PM UTC

sd8f9iu wrote: post #26

resoluteteeth wrote: post #14

Earlier quoted context omitted.

> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware in…

I thought only apps signed by "identified developers" are run by default on Macs with Gatekeeper now. Shouldn't code-signing have prevented this? Unless they inserted the malware before the signing process.

>I thought only apps signed by "identified developers" are run by default on Macs with Gatekeeper now. Shouldn't code-signing have prevented this?

"By default". Most developers don't bother to register, and lots of people change the default (and after that, they can right click to open the app and bypass the warning).

Re: Transmission BitTorrent app contained malware

#48

Post by microtonal » Sun, Mar 06, 2016, 6:52 PM UTC

justsaysmthng wrote: post #32

I've become increasingly paranoid lately, given that things like these happen and major bugs are uncovered in software that I use almost every day. It's good that the Transmission developer reacted quickly and made waves so that people can at least be aware that they might have been exposed.. But I wonder how many more applications from the hundreds that I have installed on my machines contain weird stuff - either in…

If a hacker gets access to a server holding the binaries for an open source app (which most people download), the hacker can just compile the program from sources and add his own code in there and place the installer online.

Code signing is used to prevent this. So, either the attacker has an Apple developer account (and is hopefully traceable through their credit card information), the Transmission project was sloppy with their signing key, or the machine of the developer with the signing key was compromised.

People have been ranting negatively about the Mac App store. But this is exactly why we need sandboxed applications by default (which is what the Mac App Store enforces). A sandboxed application cannot take your data hostage.

(Yes, I understand that App Store distribution is probably not possible for a Bittorrent Client.)

Re: Transmission BitTorrent app contained malware

#49

Post by wlesieutre » Sun, Mar 06, 2016, 6:52 PM UTC

the_mitsuhiko wrote: post #35

wlesieutre wrote: post #24

Earlier quoted context omitted.

>Allow downloading files from http servers (not https) on OS X 10.11+ This reads like they disabled Apple's "App Transport Security", which only allows HTTPS connections unless a program explicitly makes an exception. Introduced in iOS 9 and OS 10.11 (El Capitan). I bet the failing HTTP connections caused a bug in Transmission, and it was an easier fix to disable ATS than to transition whatever connection to HTTPS. h…

> and it was an easier fix to disable ATS than to transition whatever connection to HTTPS. Pretty sure this is for arbitrary downloads. Unless you want to prevent transmission to download from http based sources out of principle it makes no sense to do anything other than opting out of this behavior.

Right, being a web connected app based on a distributed community of other clients, it's very possible that the encryption isn't possible to implement on their end. IIRC it's only blocking HTTP connections, so the torrent transfers themselves aren't affected (unless it's masking that as HTTP traffic to avoid easy inspection?), but there may be other things that require HTTP. Connections to trackers maybe?

On the other hand, El Capitan came out last September. If this just changed in 2.9.0, the restricted HTTP connections can't have been that big of a problem.

Re: Transmission BitTorrent app contained malware

#50

Post by SwellJoe » Sun, Mar 06, 2016, 6:53 PM UTC

justsaysmthng wrote: post #32

I've become increasingly paranoid lately, given that things like these happen and major bugs are uncovered in software that I use almost every day. It's good that the Transmission developer reacted quickly and made waves so that people can at least be aware that they might have been exposed.. But I wonder how many more applications from the hundreds that I have installed on my machines contain weird stuff - either in…

"Open source software is especially vulnerable to this kind of stuff."

I'm not sure I follow on this front. Proprietary software could be compromised (whether intentionally by the vendor or unintentionally by some outsider working on the software) effectively forever with no one noticing. At least with OSS, the number of eyes on the source makes it less likely that an exploit will exist for long (though the definition of "long" could vary wildly dependent on popularity and the skill level of the software's normal users).

"Given that many big governments are now involved in the information wars, this scenario is quite likely."

Again, this one seems to point more to proprietary software then OSS. A government only needs to compromise a single company to make an exploit happen in commercial software. OSS exploits can be caught by the Linux distribution vendors that package the software, the users, the developers themselves (who are often working at different companies and in different nations), etc.

So, it may seem easier to compromise an OSS project, by attacking the distribution server and uploading a compromised binary built from source with patches...but, there are many good ways to guard against that (though any single mitigation, like signing with developer keys, can be compromised, the more eyes the less likely it is to succeed for long). But, if a government compromises a company, or someone within that company, all bets are off, and the problem literally may never be found.