5 ms·
The fact that the binary was infected, I can somewhat understand. However, the way communication happened/is happening on this issue is very disconcerning and b
by pilif 11y ago
The fact that the binary was infected, I can somewhat understand. However, the way communication happened/is happening on this issue is very disconcerning and basically makes it impossible to know whether it's safe to currently download 2.92 from their site.
Questions like
- how did the compromised binary get there? Was the source code hijacked or was the binary altered after it had been built?
- Were the SHA256 hashes on the site also compromised (btw: Having hashes on the site is good enough for making sure you're not installing a corrupted binary. It doesn't do anything against intentional alterations of the binary though. These hashes need to be stored on an external site)?
- How did the compromise happen?
- what steps were taken to ensure that the same compromise doesn't happen to new binaries posted?
- Did the attacker leave any foothold on the compromised system(s)?
- How were such footholds removed?
All questions that need to be answered before it's safe to upgrade transmission either from the website or with the AutoUpdate feature. A red warning telling me that one binary was infected and that I have to download another binary isn't good enough.
I know the transmission people are volunteer developers and no PR people and I can totally accept that, but there's some things that just need to be made clear before we can safely update to later versions (and thankfully, 2.8 keeps running just fine)
- gwbas1c 11y agoIt will probably take time to get all of the answers, but in this case, automatic updates are safe. Although I'm not a Transmission developer, I develop software that uses the same automatic update mechanism. It appears that the hacker did not update the MD5 present in the automatic update mechanism. (Sparkle) Thus, when the automatic update mechanism downloaded the hacked version of Transmission, it reported it as a corrupted download. You can see the comment here: https://forum.transmissionbt.com/viewtopic.php?f=4&t=17834#p73036 https://forum.transmissionbt.com/viewtopic.php?f=4&t=17834#p...
- pilif 11y ago> It appears that the hacker did not update the MD5 present in the automatic update mechanism. (Sparkle) Thus, when the automatic update mechanism downloaded the hacked version of Transmission, it reported it as a corrupted download yeah. But not knowing how the attacker got access, we have no idea whether they have changed the current 2.92 binary again, this time remembering to update the hash in the appcast or whether this time around the binary is actually pristine. The fact that the site was never down between this happening and the red warning text appearing makes me suspect that only a hasty cleanup was performed and that the actual security flaw might still exist.
- zZorgz 11y agoAn attacker would need the private key to update the signature in the app cast. It's possible the devs store their private key on the server, although that would be silly. Although that doesn't discount the recent MITM vulnerability Sparkle had and if transmission is still using an old version of the framework.