4 ms·

No, it wasn’t: “The two KeRanger infected Transmission installers were signed with a legitimate certificate issued by Apple. The developer ID in this certifica

by arm 11y ago

No, it wasn’t: “The two KeRanger infected Transmission installers were signed with a legitimate certificate issued by Apple. The developer ID in this certificate is “POLISAN BOYA SANAYI VE TICARET ANONIM SIRKETI (Z7276PX673)”, which was different from the developer ID used to sign previous versions of the Transmission installer. In the code signing information, we found that these installers were generated and signed on the morning of March 4.” From: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...

lottin 11y ago
> which was different from the developer ID used to sign previous versions of the Transmission installer and that didn't ring any alarm bells?
- arm 11y ago
  For the end user? No, it wouldn’t. As thesimon and jakobegger, respectively, said: “And according to the analysis, this is exactly what they did. They used a different cert to sign their malware. I have to admit that Windows' UAC is better in that regard, as it shows the signees name. But of course this is only useful if you know the "right" name.” “Yeah, I think this is a major issue on OS X. For the average user it is impossible to tell who signed an app, if it is sandboxed, and what permissions it has. Hell, using the codesign command to extract entitlements from all binaries in a package is hard even for advanced users... (There is third party tool named RB App Checker which does make these tasks a bit easier, though)” …in this comment thread: https://news.ycombinator.com/item?id=11234966 https://news.ycombinator.com/item?id=11234966
- ololoev 11y ago
  It did actually, but only for in-app updates [0]. [0]: https://forum.transmissionbt.com/viewtopic.php?f=4&t=17835 https://forum.transmissionbt.com/viewtopic.php?f=4&t=17835
- technomancy 11y ago
  It could cause a failure for updates but not fresh installs. Many people would uninstall and download it over again when running into that kind of error message.
oceliker 11y ago
What. That's interesting -- Polisan is a relatively well-known paint company in Turkey. I don't think they have a part in this -- maybe they did not store their private keys well enough?

by arm 11y ago

lottin 11y ago

> which was different from the developer ID used to sign previous versions of the Transmission installer and that didn't ring any alarm bells?

arm 11y ago
For the end user? No, it wouldn’t. As thesimon and jakobegger, respectively, said: “And according to the analysis, this is exactly what they did. They used a different cert to sign their malware. I have to admit that Windows' UAC is better in that regard, as it shows the signees name. But of course this is only useful if you know the "right" name.” “Yeah, I think this is a major issue on OS X. For the average user it is impossible to tell who signed an app, if it is sandboxed, and what permissions it has. Hell, using the codesign command to extract entitlements from all binaries in a package is hard even for advanced users... (There is third party tool named RB App Checker which does make these tasks a bit easier, though)” …in this comment thread: https://news.ycombinator.com/item?id=11234966 https://news.ycombinator.com/item?id=11234966
ololoev 11y ago
It did actually, but only for in-app updates [0]. [0]: https://forum.transmissionbt.com/viewtopic.php?f=4&t=17835 https://forum.transmissionbt.com/viewtopic.php?f=4&t=17835
technomancy 11y ago
It could cause a failure for updates but not fresh installs. Many people would uninstall and download it over again when running into that kind of error message.

oceliker 11y ago

What. That's interesting -- Polisan is a relatively well-known paint company in Turkey. I don't think they have a part in this -- maybe they did not store their private keys well enough?