I would have thought that Mac users would be a good target in general because they might have better income than Windows users...
Torrent users might be a good target for better than average internet connections for ddos?
Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
91–100 of 146 posts
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#92> Am I at risk? Instead of "Blah-blah, less than a day, go check yourself", they could grep the logs for IPs (and session cookies if they log that) of lucky winners and explicitly inform them, when they hit any page on their site. Then show generic version to everyone else. This takes all but 5 minutes to set up.
Nice idea with a major problem: If they did this, the absence of such a message could suggest that you were not affected, when in fact you could be (changed IP, cleared browser, etc).
False negatives are pretty bad in this case, better for users to check themselves.
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#93> Am I at risk? Instead of "Blah-blah, less than a day, go check yourself", they could grep the logs for IPs (and session cookies if they log that) of lucky winners and explicitly inform them, when they hit any page on their site. Then show generic version to everyone else. This takes all but 5 minutes to set up.
This is not a bad idea, maybe write to them and suggest that?
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#94Second time that this has happened to Transmission this year. Last time a ransomware got included. If you're a Transmission user then be very cautious when installing new versions.
Main reason that I only install stuff like this from my distro's repositories. Anyone know if this would have affected homebrew and such on OSX?
When this happens regularly like with Transmission, is there a guarantee the version in official repos is not affected? The only way to be sure would be code checks and I doubt they do that.
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#95More info on the malware: > The OSX/Keydnap backdoor is equipped with a mechanism to gather and exfiltrate passwords and keys stored in OS X’s keychain. The author simply took a proof-of-concept example available on Github called Keychaindump. It reads securityd’s memory and searches for the decryption key for the user’s keychain. This process is described in a paper by K. Lee and H. Koo. One of the reasons we think…
This is why applications should use app sandboxing on OS X. And Apple should provide an option to reject (by default) any application that is not signed + sandboxed, rather than: anything, signed, or app store.
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#96Earlier quoted context omitted.
And to run it from the clipboard: pbpaste | sh -
Why not this? curl https://gist.githubusercontent.com/kaizensoze/ca96d039b295db220951d42ca7c83d89/raw/ | bash
Yeah, let's download and blindly run stuff directly from the internet (that may have changed since we last saw it) without saving and trying to read what it does first.
If you can copy/paste the curl | bash, is it really more difficult to copy/paste the original snippet into a text editor[0], and from there, into bash?
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#97Simple file check if you are infected: if [ -f "/Applications/Transmission.app/Contents/Resources/License.rtf" ] || [ -f "/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf" ] || [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd" ] || [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id" ] || [ -f "$HOME/Library/LaunchAgents/com.apple.iCloud…
And to run it from the clipboard: pbpaste | sh -
Or just copy and paste the above?
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#98> Am I at risk? Instead of "Blah-blah, less than a day, go check yourself", they could grep the logs for IPs (and session cookies if they log that) of lucky winners and explicitly inform them, when they hit any page on their site. Then show generic version to everyone else. This takes all but 5 minutes to set up.
Nice idea with a major problem: If they did this, the absence of such a message could suggest that you were not affected, when in fact you could be (changed IP, cleared browser, etc). False negatives are pretty bad in this case, better for users to check themselves.
[deleted]
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#99They never responded with details of what they were doing to improve security after the last incident: https://forum.transmissionbt.com/viewtopic.php?f=1&t=17938 . The outside appearance is that they didn't address the problem seriously enough.
Yeah, I was thinking, didn't this happen before?
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#100Earlier quoted context omitted.
Main reason that I only install stuff like this from my distro's repositories. Anyone know if this would have affected homebrew and such on OSX?
Homebrew packages verify checksums, so very unlikely to be affected.
And where do the checksums come from?