7 ms·

VirusTotal has some more info, including the files it writes: https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc1c5f5a42722e8ee1554cba8074bbae4a5f6db

by moyix 11y ago

VirusTotal has some more info, including the files it writes: https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc1c5f5a42722e8ee1554cba8074bbae4a5f6dbe1/analysis/ https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc... (Look under the "Behavioural information" tab) Written Files and Created Processes are interesting: [Transmission] /Users/user1/Library/kernel_service (successful) [unknown] /Users/user1/Library/.kernel_pid (successful) [unknown] /Users/user1/Library/Saved Application State/org.m0k.transmission.savedState/window_1.data (successful) [Transmission] /Users/user1/Library/Saved Application State/org.m0k.transmission.savedState/data.data (successful) [Transmission] /Users/user1/Library/Saved Application State/org.m0k.transmission.savedState/windows.plist (successful) [kernel_service] /Users/user1/Library/.kernel_time (successful) Created processes /Volumes/Transmission/Transmission.app/Contents/MacOS/Transmission (successful) /Users/user1/Library/kernel_service (successful) kernel_service (successful) Edited to add: If anyone has a copy of the DMG, sha1 5f8ae46ae82e346000f366c3eabdafbec76e99e9, please link me a copy via email (brendandg@nyu.edu) or twitter DM (@moyix).

0x0 11y ago
Maybe take a look around https://build.transmissionbt.com/ https://build.transmissionbt.com/ - but then again maybe the svn repo wasn't compromised? I tried a "svn diff svn://svn.transmissionbt.com/Transmission/tags/2.90 svn://svn.transmissionbt.com/Transmission/tags/2.91" and didn't see anything suspicious on a fast scroll-through
- yeukhon 11y ago
  Side topic: probably not a good idea to expose Jenkins externally, especially if you don't keep Jenkins up-to-date all the time (for transmission bt it is up-to-date right now). This Jenkins probably contain the key to the svn server, so if someone finds a hole...
  - ycmbntrthrwaway 11y ago
    > Jenkins probably contain the key to the svn server Why should it? For open-source software build-server can even be ran by a third party.
    - yeukhon 11y ago
      I am not following your comment here. Most Jenkins setup use global credentials or use the server-side config file like .ssh/config, .gitconfig link.
      - conradev 11y ago
        But ideally there are no credentials because Jenkins doesn't need to push code to the repo (and can clone the pubically available code).
        Matt3o12_ 11y ago
        But it might need to push new (binary) updates if the master/deploy branches gets updated or a commit contains a specific tag. As far as I know, only the binary was updated. I'd be interested to hear, though, how it got compromised after all.
        conradev 11y ago
        Yeah, that makes sense. Build servers are one of the weakest links in distributing software. That's why this exists and I'm glad it's making progress: https://reproducible-builds.org https://reproducible-builds.org And even if you sign updates, the key management for doing that is usually centralized, which can be bad: http://arstechnica.com/security/2016/02/most-software-already-has-a-golden-key-backdoor-its-called-auto-update/ http://arstechnica.com/security/2016/02/most-software-alread...
        Matt3o12_ 11y ago
        I do not think it was the build server, though. According to this analysis[1], the developer used a different key to sign the build (all Mac apps need to be signed or the default behavior is to reject that App. You can permanently disable this behavior in settings, or just for on app by holding control while opening the App, which a lot users who use transmission probably do because not all legitimate Apps are signed). Anyways, since the app was signed by a third party's certificate (which was approved by Apple), chances are only the website was compromised. If the build server had been compromised, the attack would have had access to the developer's certificate and they would most likely have used that. [1]: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
  - 27182818284 11y ago
    >Side topic: probably not a good idea to expose Jenkins externally Jenkins (and CI in general) can be a very weak point. This was posted on Hacker News a while back https://github.com/samratashok/ContinuousIntrusion https://github.com/samratashok/ContinuousIntrusion
    - yeukhon 11y ago
      Very useful demonstration. thanks for sharing.
  - riffic 11y ago
    Transmission, as an open source project, should probably evaluate another CI service such as Travis rather than run their own Jenkins services.
noondip 11y ago
Here's an analysis of the malware - http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
- moyix 11y ago
  Nice. That matches what I'm seeing.
- Sammi 11y ago
  Copy/pasting the helpful parts of that article: How to Protect Yourself Users who have directly downloaded Transmission installer from official website after 11:00am PST, March 4, 2016 and before 7:00pm PST, March 5, 2016, may be been infected by KeRanger. If the Transmission installer was downloaded earlier or downloaded from any third party websites, we also suggest users perform the following security checks. Users of older versions of Transmission do not appear to be affected as of now. We suggest users take the following steps to identify and remove KeRanger holds their files for ransom: 1. Using either Terminal or Finder, check whether /Applications/Transmission.app/Contents/Resources/ General.rtf or /Volumes/Transmission/Transmission.app/Contents/Resources/ General.rtf exist. If any of these exist, the Transmission application is infected and we suggest deleting this version of Transmission. 2. Using “Activity Monitor” preinstalled in OS X, check whether any process named “kernel_service” is running. If so, double check the process, choose the “Open Files and Ports” and check whether there is a file name like “/Users/<username>/Library/kernel_service” (Figure 12). If so, the process is KeRanger’s main process. We suggest terminating it with “Quit -> Force Quit”. 3. After these steps, we also recommend users check whether the files “.kernel_pid”, “.kernel_time”, “.kernel_complete” or “kernel_service” existing in ~/Library directory. If so, you should delete them.
  - why-el 11y ago
    You have a typo: "Applicaions". Usually not a problem but in this case it will say "No file/folder found" when it's just a typo.
charonn0 11y ago
One of the researchers posted links to both malicious dmgs. [1]: https://twitter.com/claud_xiao/status/706563279355645953 https://twitter.com/claud_xiao/status/706563279355645953

by moyix 11y ago

0x0 11y ago

Maybe take a look around https://build.transmissionbt.com/ https://build.transmissionbt.com/ - but then again maybe the svn repo wasn't compromised? I tried a "svn diff svn://svn.transmissionbt.com/Transmission/tags/2.90 svn://svn.transmissionbt.com/Transmission/tags/2.91" and didn't see anything suspicious on a fast scroll-through

yeukhon 11y ago
Side topic: probably not a good idea to expose Jenkins externally, especially if you don't keep Jenkins up-to-date all the time (for transmission bt it is up-to-date right now). This Jenkins probably contain the key to the svn server, so if someone finds a hole...
- ycmbntrthrwaway 11y ago
  > Jenkins probably contain the key to the svn server Why should it? For open-source software build-server can even be ran by a third party.
  - yeukhon 11y ago
    I am not following your comment here. Most Jenkins setup use global credentials or use the server-side config file like .ssh/config, .gitconfig link.
    - conradev 11y ago
      But ideally there are no credentials because Jenkins doesn't need to push code to the repo (and can clone the pubically available code).
      - Matt3o12_ 11y ago
        But it might need to push new (binary) updates if the master/deploy branches gets updated or a commit contains a specific tag. As far as I know, only the binary was updated. I'd be interested to hear, though, how it got compromised after all.
        conradev 11y ago
        Yeah, that makes sense. Build servers are one of the weakest links in distributing software. That's why this exists and I'm glad it's making progress: https://reproducible-builds.org https://reproducible-builds.org And even if you sign updates, the key management for doing that is usually centralized, which can be bad: http://arstechnica.com/security/2016/02/most-software-already-has-a-golden-key-backdoor-its-called-auto-update/ http://arstechnica.com/security/2016/02/most-software-alread...
        Matt3o12_ 11y ago
        I do not think it was the build server, though. According to this analysis[1], the developer used a different key to sign the build (all Mac apps need to be signed or the default behavior is to reject that App. You can permanently disable this behavior in settings, or just for on app by holding control while opening the App, which a lot users who use transmission probably do because not all legitimate Apps are signed). Anyways, since the app was signed by a third party's certificate (which was approved by Apple), chances are only the website was compromised. If the build server had been compromised, the attack would have had access to the developer's certificate and they would most likely have used that. [1]: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
- 27182818284 11y ago
  >Side topic: probably not a good idea to expose Jenkins externally Jenkins (and CI in general) can be a very weak point. This was posted on Hacker News a while back https://github.com/samratashok/ContinuousIntrusion https://github.com/samratashok/ContinuousIntrusion
  - yeukhon 11y ago
    Very useful demonstration. thanks for sharing.
- riffic 11y ago
  Transmission, as an open source project, should probably evaluate another CI service such as Travis rather than run their own Jenkins services.

noondip 11y ago

Here's an analysis of the malware - http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...

moyix 11y ago
Nice. That matches what I'm seeing.
Sammi 11y ago
Copy/pasting the helpful parts of that article: How to Protect Yourself Users who have directly downloaded Transmission installer from official website after 11:00am PST, March 4, 2016 and before 7:00pm PST, March 5, 2016, may be been infected by KeRanger. If the Transmission installer was downloaded earlier or downloaded from any third party websites, we also suggest users perform the following security checks. Users of older versions of Transmission do not appear to be affected as of now. We suggest users take the following steps to identify and remove KeRanger holds their files for ransom: 1. Using either Terminal or Finder, check whether /Applications/Transmission.app/Contents/Resources/ General.rtf or /Volumes/Transmission/Transmission.app/Contents/Resources/ General.rtf exist. If any of these exist, the Transmission application is infected and we suggest deleting this version of Transmission. 2. Using “Activity Monitor” preinstalled in OS X, check whether any process named “kernel_service” is running. If so, double check the process, choose the “Open Files and Ports” and check whether there is a file name like “/Users/<username>/Library/kernel_service” (Figure 12). If so, the process is KeRanger’s main process. We suggest terminating it with “Quit -> Force Quit”. 3. After these steps, we also recommend users check whether the files “.kernel_pid”, “.kernel_time”, “.kernel_complete” or “kernel_service” existing in ~/Library directory. If so, you should delete them.
- why-el 11y ago
  You have a typo: "Applicaions". Usually not a problem but in this case it will say "No file/folder found" when it's just a typo.

charonn0 11y ago

One of the researchers posted links to both malicious dmgs. [1]: https://twitter.com/claud_xiao/status/706563279355645953 https://twitter.com/claud_xiao/status/706563279355645953