Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

transmissionbt.com

Post reply on HN
Print view View original

81–90 of 146 posts

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#82

Post by SyneRyder »

intoverflow2 wrote: post #76
taspeotis wrote: post #22

Earlier quoted context omitted.

Pay for it then? Netflix scratches my entertainment itch now, but prior to it launching in Australia I almost went ahead and paid for uTorrent. It's a good, lightweight client. Software that works well deserves to be financially supported.

Some peoples tastes are broader than the mainstream American TV on offer by Netflix

The parent comment was suggesting paying for uTorrent to remove the ads, not paying for Netflix. (Although paying for subscriptions to overseas services might also be an option.)

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#83

Post by hannob »

commenter23 wrote: post #13
deep_attention wrote: post #6

Are there any good alternatives to Transmission on OS X?

qbittorrent? http://www.qbittorrent.org/download.php

No HTTPS?

(Given that the original post was about compromised downloads this is a bit ironic)

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#84

Post by foepys »

tajen wrote: post #72
andreasley wrote: post #63

Earlier quoted context omitted.

According to this article [1], the compromised app was indeed signed – but with a different Developer ID than usual. Anyone with a credit card can sign up for Apple's developer program and start signing apps. [1] http://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-...

So Apple/the bank/a warrant can return his name?

The credit card was most likely stolen. You can buy them in bulk from some websites.

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#86

Post by amykhar »

davej wrote: post #5

Second time that this has happened to Transmission this year. Last time a ransomware got included. If you're a Transmission user then be very cautious when installing new versions.

Conspiracy theorist in me wonders if this isn't an attack by somebody hired by an anti-piracy group.

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#87

Post by Mtinie »

SyneRyder wrote: post #79
tajen wrote: post #44

Earlier quoted context omitted.

Interesting question. According to https://developer.apple.com/support/certificates/ : >> If your membership expires, users can still download, install, and run your Developer ID–signed applications. However, once your Developer ID certificate expires, you must be an Apple Developer Program member to get new Developer ID certificates to sign updates and new applications. What I understand is that codesigning costs $9…

I really thought Apple had added a free option (maybe even specifically for open source projects?), but I can't find it anywhere. Can anyone else find that info, or am I misremembering?

I believe you are misremembering the details. There is a free account option, but code signing isn't available.

https://developer.apple.com/support/compare-memberships/

What's not clear to me, however, is if the educational option allows for free developer-level memberships.

Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A

#88

Post by minhoryang »

cormacrelf wrote: post #64
jquast wrote: post #27

Earlier quoted context omitted.

Homebrew packages verify checksums, so very unlikely to be affected.

Probably a good idea to turn off auto-update from Transmission's preferences and only use brew update && brew cask install --force transmission to update. Even though they're also meant to be checksummed, I can't know whether an attacker also compromised the checksum mechanism.

Do we need to --force just for updating?
Post reply on HN