4 ms·
So, either the attacker has an Apple developer account (and is hopefully traceable through their credit card information), the Transmission project was sloppy w
by danieldk 11y ago
So, either the attacker has an Apple developer account (and is hopefully traceable through their credit card information), the Transmission project was sloppy with their signing key, or the machine of the developer with the signing key was compromised.
Sorry, I forgot another possibility: some other developer's key was compromised.
- arm 11y agoOr, as is the case here, the malicious party was simply issued a key by Apple (for apps that are downloaded from places other than the Mac App Store, developers can get a unique Developer ID from Apple (for free) and use it to digitally sign their apps, the purpose being that Apple can revoke it after the fact if it turns out to be malware): “The two KeRanger infected Transmission installers were signed with a legitimate certificate issued by Apple. The developer ID in this certificate is “POLISAN BOYA SANAYI VE TICARET ANONIM SIRKETI (Z7276PX673)”, which was different from the developer ID used to sign previous versions of the Transmission installer. In the code signing information, we found that these installers were generated and signed on the morning of March 4.” From: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
- danieldk 11y agoInteresting. It seems that this is actually a legitimate company: http://www.bloomberg.com/research/stocks/private/snapshot.asp?privcapid=47015181 http://www.bloomberg.com/research/stocks/private/snapshot.as... So, it could be that the malicious part was not issued a key, but stole the key from this company.