5 ms·

Do the developers have an explanation anywhere as to how this happened? The homepage ( https://transmissionbt.com/ https://transmissionbt.com/ ) has a big red w

by oxguy3 11y ago

Do the developers have an explanation anywhere as to how this happened? The homepage ( https://transmissionbt.com/ https://transmissionbt.com/ ) has a big red warning to upgrade to 2.91, but I can't find any info about how someone went about putting malware in the download.

carlosrg 11y ago
Yep, this deserves a more detailed explanation (or maybe they still don't know what happened). I updated from the previous version to 2.90 through the app built-in update, and I don't seem to have any "kernel_service" process running. Can someone that has that process in their system tell us where they downloaded the program?
- nkulig 11y ago
  I also did not have that process running in the background. I just updated through the app to 2.91 and it's still not there. So, I am also curious where they got Transmission from.
- s_kilk 11y ago
  > I updated from the previous version to 2.90 through the app built-in update... Same, and I also don't see any `kernel_service` process running. Fingers crossed for the in-app update not being affected by the hack.
  - DavideNL 11y ago
    I'd definitely run a virus scan to be sure... If you don't have one just install a Trial version and remove it again after a week.
    - s_kilk 11y ago
      Noted: I've gone with BitDefender from the Map App Store. Will report back results. EDIT: welp, BitDefender found nothing, all clear.
      - noondip 11y ago
        The same BitDefender which was hacked a few months ago? http://securityaffairs.co/wordpress/39028/cyber-crime/bitdefender-hacked.html http://securityaffairs.co/wordpress/39028/cyber-crime/bitdef...
      - s_kilk 11y ago
        (reply to noondip): if anyones got a better suggestion I'd love to hear it :)
        arm 11y ago
        Back when Apple still made Mac OS X Server as a separate operating system, they included ClamAV¹ to scan for malware in mail. They don’t include it anymore, but ClamXav² (been around since 2004³) is a nice GUI for ClamAV that I’ve been using for a while now. ―――――― ¹ — https://en.wikipedia.org/wiki/Clam_AntiVirus#Mac_OS_X https://en.wikipedia.org/wiki/Clam_AntiVirus#Mac_OS_X ² — http://clamxav.com/index.html http://clamxav.com/index.html ³ — http://clamxav.com/birthday.html http://clamxav.com/birthday.html
        uxp 11y ago
        I run a private mail server and swear by ClamAV to help reduce noise and pollution that accumulates and spreads through my server, but I don't think I've ever had any luck with it being a good front line defense against up-and-coming malware, whether it targets Windows or Mac. I don't think I would recommend it as a primary malware scanner for a Mac, or Windows.
      - elithrar 11y ago
        Avira is what we use (at a very security-conscious org), and it's been unobtrusive.
      - pjl 11y ago
        Maybe give Malwarebytes Anti-Malware for Mac [1] a try? I've used their Windows products for a while now. [1] https://www.malwarebytes.org/antimalware/mac/ https://www.malwarebytes.org/antimalware/mac/
- deleted 11y ago
  [deleted]
- medell 11y ago
  Agreed. I don't have the process running either. Screenshot of Transmission 2.90 red warning to update to 2.91. http://imgur.com/aQdHJ3b http://imgur.com/aQdHJ3b
- nachtigall 11y ago
  http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
astrodust 11y ago
If you release commercial or popular open-source software, it's probably a super-bad idea to keep your signing key on a notebook computer you use outside of the office. Have a trusted machine kept in a secure location to sign it for you if that's practical. I bet someone's key leaked out here.

by oxguy3 11y ago

carlosrg 11y ago

Yep, this deserves a more detailed explanation (or maybe they still don't know what happened). I updated from the previous version to 2.90 through the app built-in update, and I don't seem to have any "kernel_service" process running. Can someone that has that process in their system tell us where they downloaded the program?

nkulig 11y ago
I also did not have that process running in the background. I just updated through the app to 2.91 and it's still not there. So, I am also curious where they got Transmission from.
s_kilk 11y ago
> I updated from the previous version to 2.90 through the app built-in update... Same, and I also don't see any `kernel_service` process running. Fingers crossed for the in-app update not being affected by the hack.
- DavideNL 11y ago
  I'd definitely run a virus scan to be sure... If you don't have one just install a Trial version and remove it again after a week.
  - s_kilk 11y ago
    Noted: I've gone with BitDefender from the Map App Store. Will report back results. EDIT: welp, BitDefender found nothing, all clear.
    - noondip 11y ago
      The same BitDefender which was hacked a few months ago? http://securityaffairs.co/wordpress/39028/cyber-crime/bitdefender-hacked.html http://securityaffairs.co/wordpress/39028/cyber-crime/bitdef...
    - s_kilk 11y ago
      (reply to noondip): if anyones got a better suggestion I'd love to hear it :)
      - arm 11y ago
        Back when Apple still made Mac OS X Server as a separate operating system, they included ClamAV¹ to scan for malware in mail. They don’t include it anymore, but ClamXav² (been around since 2004³) is a nice GUI for ClamAV that I’ve been using for a while now. ―――――― ¹ — https://en.wikipedia.org/wiki/Clam_AntiVirus#Mac_OS_X https://en.wikipedia.org/wiki/Clam_AntiVirus#Mac_OS_X ² — http://clamxav.com/index.html http://clamxav.com/index.html ³ — http://clamxav.com/birthday.html http://clamxav.com/birthday.html
        uxp 11y ago
        I run a private mail server and swear by ClamAV to help reduce noise and pollution that accumulates and spreads through my server, but I don't think I've ever had any luck with it being a good front line defense against up-and-coming malware, whether it targets Windows or Mac. I don't think I would recommend it as a primary malware scanner for a Mac, or Windows.
    - elithrar 11y ago
      Avira is what we use (at a very security-conscious org), and it's been unobtrusive.
    - pjl 11y ago
      Maybe give Malwarebytes Anti-Malware for Mac [1] a try? I've used their Windows products for a while now. [1] https://www.malwarebytes.org/antimalware/mac/ https://www.malwarebytes.org/antimalware/mac/
deleted 11y ago
[deleted]
medell 11y ago
Agreed. I don't have the process running either. Screenshot of Transmission 2.90 red warning to update to 2.91. http://imgur.com/aQdHJ3b http://imgur.com/aQdHJ3b
nachtigall 11y ago
http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...

astrodust 11y ago

If you release commercial or popular open-source software, it's probably a super-bad idea to keep your signing key on a notebook computer you use outside of the office. Have a trusted machine kept in a secure location to sign it for you if that's practical. I bet someone's key leaked out here.