Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

transmissionbt.com

Post reply on HN
Print view View original

41–50 of 146 posts

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#41

Post by toxik »

okket wrote: post #35

Simple file check if you are infected: if [ -f "/Applications/Transmission.app/Contents/Resources/License.rtf" ] || [ -f "/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf" ] || [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd" ] || [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id" ] || [ -f "$HOME/Library/LaunchAgents/com.apple.iCloud…

And to run it from the clipboard:

    pbpaste | sh -

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#43

Post by voltagex_ »

clappski wrote: post #8
deep_attention wrote: post #6

Are there any good alternatives to Transmission on OS X?

Deluge is pretty good, that's what I tend to go for.

I like Deluge, but I really wish its default API (protocol) wasn't so difficult to use. It's bencoded Python objects as far as I can tell. If you've never heard of bencoding, that's because it's only used by Deluge.

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#44

Post by tajen »

kalleboo wrote: post #28

So what happened with the codesigning? That's pretty much the only viable line of defense for the average user (nobody is going to be verifying SHA signatures, or the site is going to be compromised along with the download) Was the malware version also signed with an official Apple Developer ID? The same ID? Is a change of ID verified with the auto-updater? If there was a malicious Developer ID, has it been revoked b…

Interesting question. According to https://developer.apple.com/support/certificates/:

>> If your membership expires, users can still download, install, and run your Developer ID–signed applications. However, once your Developer ID certificate expires, you must be an Apple Developer Program member to get new Developer ID certificates to sign updates and new applications.

What I understand is that codesigning costs $99 a year, which open-source projects may want to skip, but this harms their credibility if their downloads are compromised.

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#45

Post by labster »

toxik wrote: post #41
okket wrote: post #35

Simple file check if you are infected: if [ -f "/Applications/Transmission.app/Contents/Resources/License.rtf" ] || [ -f "/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf" ] || [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd" ] || [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id" ] || [ -f "$HOME/Library/LaunchAgents/com.apple.iCloud…

And to run it from the clipboard: pbpaste | sh -

Why not this?

    curl https://gist.githubusercontent.com/kaizensoze/ca96d039b295db220951d42ca7c83d89/raw/ | bash

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#46

Post by GirlsCanCode »

Mahn wrote: post #14

More info on the malware: > The OSX/Keydnap backdoor is equipped with a mechanism to gather and exfiltrate passwords and keys stored in OS X’s keychain. The author simply took a proof-of-concept example available on Github called Keychaindump. It reads securityd’s memory and searches for the decryption key for the user’s keychain. This process is described in a paper by K. Lee and H. Koo. One of the reasons we think…

B..b..bbut! I thought Macs were _secure by design_ and didn't get infected! Did they lie?

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#47

Post by labster »

FatalLogic wrote: post #34
labster wrote: post #17

Earlier quoted context omitted.

I wait about a week, unless I've heard out of band talk about some terrible hack with a punny name and we all need to upgrade NAO!1! I suppose I should always look for a secondary source for release notes or such as soon as possible; I don't because I am a lazy human.

Yes, totally, if you want to make the best decision, then you have to keep up with the news. That's why I'm interested in other opinions about this, because there's a lot of datapoints you need to factor into a decision. It's not a simple decision. That's work, and we are lazy humans, you're right. But, I don't wait a whole week if the update is from an organization which I think I can trust not to totally botch an u…

It's more like a botched update from Microsoft, Apple, etc. will be noticed by lots of people within one or two days.

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#49

Post by okket »

labster wrote: post #45
toxik wrote: post #41

Earlier quoted context omitted.

And to run it from the clipboard: pbpaste | sh -

Why not this? curl https://gist.githubusercontent.com/kaizensoze/ca96d039b295db220951d42ca7c83d89/raw/ | bash

Your line downloads and executes the latest version of the gist, it could have changed from a file check to a virus installer by the author (unlikely, but I have to point it out). To be a bit more safe (while trusting that GitHub is not compromised) pin a known, verified version:

  curl https://gist.githubusercontent.com/kaizensoze/ca96d039b295db220951d42ca7c83d89/raw/a26e5a025ea21d3a0af536eeca49619272d0068f/quick-osx-keydnap-check | bash
(sorry for the overlong line)

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#50

Post by lucb1e »

okket wrote: post #29
Veen wrote: post #11

I like Transmission, but this is the second serious security problem they've had this year. Once you can forgive, but twice and it's time to look for a new BitTorrent client.

FYI: Transmission binaries are now hosted on GitHub, so it is very unlikely that anything like this can happen in the future without compromising developer machines.

Question is, how implausible do we think it is that a developer's computer gets compromised?
Post reply on HN