16 ms·

Recent version of Handbrake download infected with malware

383 points by zalmoxes 9y ago

ricardobeat 9y ago
A working link: https://forum.handbrake.fr/viewtopic.php?f=33&t=36364 https://forum.handbrake.fr/viewtopic.php?f=33&t=36364
- fnj 9y ago
  Nice try but not working.
- zalmoxes 9y ago
  In case the site goes down: http://imgur.com/a/I6gpB http://imgur.com/a/I6gpB
asmosoinio 9y ago
" Further Actions Required Based on the information we have, you must also change all the passwords that may reside in your OSX KeyChain or any browser password stores." That sounds like a very large exercise...
- tjoff 9y ago
  One very good reason to not rely on password managers... That is not to say that there are many good reason to do so, but the password manager do become a very coveted target. edit: Maybe I phrased that badly. It is a risk associated with password managers that everyone that are using one should be aware of.
  - mikeash 9y ago
    What's the alternative? Using different passwords for every account is not practical without some way to store them, and using the same password makes you even more vulnerable. We could write them all down in a big book or something, but that leaves us vulnerable to physical theft and loss.
    - Navarr 9y ago
      Certificates, maybe? You'd need a way to change your certificate though (and keep it to the same account). Some system through DNS? I think I'm just slowly reinventing OpenID
      - rocky1138 9y ago
        Client side certificates are a thing but hardly anyone uses them because they are unwieldy.
    - arjie 9y ago
      Theorycrafting without a real idea here but how about a physical device with private keys and challenge-response authentication from a site. To login you have to press a button to sign a specific message as a specific person. Then they can't silently gain access to your account persistently. They can gain access until you logout but then they have to wait for you to login again. Or they can change the key but then you'd notice that you can't login.
      - andrewaylett 9y ago
        That sounds like this: https://en.wikipedia.org/wiki/Universal_2nd_Factor https://en.wikipedia.org/wiki/Universal_2nd_Factor
    - rocqua 9y ago
      To protect against password compromise in general, use 2 factor auth. For this to really work, you need a way to detect compromise of the password. This way the 2nd factor holds you over until you've managed to rotate all important enough passwords. Alternatively, separate trusted hardware with an interactive (i.e. challenge-response) protocol. Something like a TPM or yubikey.
    - xoa 9y ago
      You now have 3 responses as of my comment and they're all worthless because they completely miss the point of Password Managers. PMs are not elegant, they are not ideal, their limits are very well known. They exist purely as a hack around the objective real world reality that authentication in general in the modern world completely sucks and depends on passwords. And that that reality is something we've got to live with and deal with for the foreseeable future. Yes, we shouldn't have passwords for authentication at all, ever, period, and shouldn't have had them for at least a decade now. All the tech has long existed to switch to hardware backed public key cryptographic auth, and even to do so in a way that is far more user friendly then endless passwords and more secure at the same time, a sort of win-win that is quite unusual. We should all have HSMs (be it in the form of tokens, cards, compliant hardware in phones, or whatever) holding our private keys, and websites should only have our public certs. Entire classes of issues (like everything associated with password databases) would be perfectly and completely eliminated forever. There would be no dependence on any 3rd party services. Users would only need to remember at most a couple of PINs and that's it. Back here on Earth though I can count every single site I've used in my life that had certificate based authentication and still have plenty of fingers left. Maybe U2F will make a bit more of a dent, but for a long time to come passwords will be the core of a lot of people's most critical personal security (like most of their money) and online identities. To have any value passwords need to be unique, and need to be fully random, and also have to deal with layers of extra crap that have been piled on top like password policies, arbitrary allowed characters (universal UTF? hahahaha), arbitrary minimum/maximum lengths, "security" questions (which should of course just be random strings lest they undermine the point of having a password but probably have their own special character restrictions), etc. Humans cannot remember all this garbage for more then a handful of sites. Password Managers are a practical solution to this mess of the "worst one except for all the other ones" variety. They effectively replicate (badly, but that's not their fault) some of what an actual decent key system would offer by default. They make attack scaling harder. In short they're the best match to the most typical threat models most people face. Any good efforts to replace passwords period with keys is to be applauded, and if successful would eventually (years down the line) make password managers obsolete by making passwords themselves obsolete. But in the mean time password managers matter and people talking down at them due to issues that don't actually match general threat models are doing a terrible disservice to the public.
  - mixedCase 9y ago
    > One very good reason to not rely on password managers... Or for desktop security. Pretty sure Wayland's current security model prevents this as long as the password manager has a well-designed API.
  - zalmoxes 9y ago
    No it's not. In this case 1Password wouldn't be compromised, since having access to the system doesn't mean you can decrypt the passwords. With OS X keychain(and browser) unfortunately, if your system is compromised, you can decrypt the password store.
    - symlinkk 9y ago
      If your system is compromised you're fucked, it's game over, they could install a key logger that records your 1Password master password or just replace the 1Password binary with an infected one.
  - kazazes 9y ago
    Password managers aren't implicated in the compromise of the OS X keychain or your browser... this is FUD. Your browser's native store is probably unencrypted [1], and the OS X keychain password can be snatched with a clone of the native password prompt. Neither is true for any respected password manager. They keep you safe. [1] https://news.ycombinator.com/item?id=10884000 https://news.ycombinator.com/item?id=10884000
    - tjoff 9y ago
      The OS X keychain is a password manager, right? Just as your browser. Your browsers native store is probably encrypted, see your own source. How would a respected password manager guard against an infected machine? Take keepass as an example, they state: The actual problem here is running specialized spyware (as the same user and with the same rights, like KeeFarce assumes). If you are doing this, everything is over. An application cannot protect itself in such a case; all modern PC operating systems (Windows, Linux, ...) http://keepass.info/help/kb/sec_issues.html#keefarce http://keepass.info/help/kb/sec_issues.html#keefarce Also, at the bottom of the page: Neither KeePass nor any other password manager can magically run securely in a spyware-infected, insecure environment. Users still are responsible for the security of their PC.
- Tinyyy 9y ago
  Handbrake doesn’t run with admin/ root privileges, how could it access the Keychain?
  - objclxt 9y ago
    Because the malware presented a fake authentication prompt under the pretense of "installing additional codecs" which allows it to escalate privilege.
- Angostura 9y ago
  About 200 passwords in my case. Looking forward to going into work tomorrow and discussing whether I'm infected.
  - deleted 9y ago
    [deleted]
nnutter 9y ago
Didn't this also happen somewhat recently? How can this be prevented? The window could be reduced by actively monitoring mirrors? Could BitTorrent help mitigate this because the torrent file validates data and isn't under the control of the parties?
- zalmoxes 9y ago
  This could have been prevented by hosting downloads on a reputable site(Github), instead of developer's own PHP backend. Software like https://github.com/google/santa https://github.com/google/santa can help, especially if you're doing IT in a large enterprise. The feed used by the software's autoupdate framework(sparkle) was signed, so that would've prevented bad downloads through autoupdate.
  - 21 9y ago
    Hosting on GitHub solves one problem, but creates another. Chrome for example has a sort of a bloom filter which is used to check all downloaded executables. This will raise a nasty warning if the thing you downloaded is not a "popular" download. For obvious reason, this check is disabled for a bunch of sites, like github, sf, ... I know for a fact that some malware authors host their stuff on GitHub exactly to bypass this Chrome check.
    - gaadd33 9y ago
      Do you have any more info about this? I've downloaded random executables from a lot of unpopular (and in some cases, newly created by me) sites and never seen anything pop up in chrome warning me not to download it.
      - 21 9y ago
        Information is scarce on this (a little bit of security through obscurity). Here is theirs blog post introducing the feature in 2012: https://chrome.googleblog.com/2012/02/faster-browsing-safer-downloading.html https://chrome.googleblog.com/2012/02/faster-browsing-safer-... > Chrome also does checks on executable files (like ".exe" and ".msi" files). If the executable doesn't match a whitelist, Chrome checks with Google for more information, such as whether the website you're accessing hosts a high number of malicious downloads. At the time I looked at the implementation in the Chrome source code, but I remember that it took me a while to locate it.
rasmi 9y ago
Something similar has happened with Transmission's download DMGs being replaced on their servers [1] (twice! [2]) in recent memory. [1] https://news.ycombinator.com/item?id=11234589 https://news.ycombinator.com/item?id=11234589 [2] https://news.ycombinator.com/item?id=12403768 https://news.ycombinator.com/item?id=12403768
- tehabe 9y ago
  The original developer of Transmission and Handbrake are the same IIRC. I hope this is just a coincidence.
  - tyingq 9y ago
    Coincidence seems unlikely, doesn't it? Same compromised admin level password, or same vector/hole in 2 places seems likely to me.
    - dmix 9y ago
      Could be the same hacker just continuing to prod his lazy security practices. Or exploiting existing knowledge of his systems to bypass new layers. Or he exposed himself on criminal hacking forums as an easy mark. But this is purely baseless conjecture.
- closeparen 9y ago
  Were the posted checksums also replaced?
  - galad87 9y ago
    No, the website was not compromised.
plg 9y ago
I don't understand how I'm supposed to verify the checksum if I've already installed (and run) the HandBrake.app ... and long since deleted the .dmg installer file ????
- luhn 9y ago
  You aren't. They describe how to check your system for the Trojan if you've already run the installer.
  - plg 9y ago
    well aren't I the idiot
    - atmosx 9y ago
      No worries, happens to most of us ;-)
thinknot 9y ago
Using an ftp server is just asking for trouble. Get an S3 bucket.
atmosx 9y ago
I can't believe this. I literally downloaded handbrake like 45 minutes ago! Luckily I got the proper version, but boy oh boy, it was a close call. I think I'll reinstall claXmav on all my macs.
- theGimp 9y ago
  The real problem is that you're trusting binaries you find on disparate websites. If you want to avoid these sorts of compromises, use a package manager or check the hash of the downloaded file against one that you trust.
  - zalmoxes 9y ago
    Which package manager? :P
    - petepete 9y ago
      What OS are you using?
      - sotojuan 9y ago
        Just to let people know, Handbrake is on Homebrew Cask in macOS.
        sondr3 9y ago
        Sadly Homebrew is terrible for this, the developer guide for how to get the hash for the files you're downloading is literally to just test run the download with an empty hash in the brew file, and it will calculate the hash from the file on the website. In this case Homebrew would not help, as galad87 mentions here https://news.ycombinator.com/reply?id=14282116&goto=item%3Fid%3D14281998%2314282116 https://news.ycombinator.com/reply?id=14282116&goto=item%3Fi....
        oefrha 9y ago
noobermin 9y ago
Usually package managers on linux distros, to use an example for comparison, tend to check checksums of downloads for security purposes during any installation. For MacOS users, I guess I understand they want to use software not blessed by Apple, then isn't homebrew or whatever supposed to do the same thing?
- mikeash 9y ago
  Most Mac users don't use anything like Homebrew. Typically you just download the software as a .zip file or equivalent, unpack it, and run it. Apple does support code signatures for apps downloaded this way through their Developer ID program, but you have to pay $99/year to be a member of their developer program in order to do so. In theory, you could still sign downloads using a code signing certificate you got elsewhere, but system wouldn't check it for you, and few people would bother to do it manually.
  - zalmoxes 9y ago
    If you have Gatekeeper enabled(which it is by default), the system prevents the user from running random unsigned apps.
    - mikeash 9y ago
      You can't turn Gatekeeper off anymore, at least not without using the command line. You can bypass it on an app-by-app basis by just right-clicking an app and selecting "Open" there, which is what you'd have to do if you're downloading apps like Handbrake.
  - noobermin 9y ago
    >In theory, you could still sign downloads using a code signing certificate you got elsewhere, but system wouldn't check it for you, and few people would bother to do it manually. Hence, we have occurrences like the OP. The point is checking checksums or (better) signatures is the most common way to mitigate it. Otherwise, this will continue to happen. Dare I say that is the entire reason repo managers of all stripes do this in the first place.
kefka 9y ago
Sigh.. This could be somewhat repaired by making a beta-release, distributing to devs and testers. Once confirmed good, rename file and release via IPFS. The key here, is if multiple devs did this, the hashsum would prove the file being shared. Any one client that's been hacked or infected would show up as an improper hash and easily spotted.
- vomitcuddle 9y ago
  hindsight is always 20/20 i'm sure <insert your favourite open source project here> would appreciate patches for reproducible, cryptographically signed releases
nly 9y ago
Aren't the dmgs digitally signed?
- TillE 9y ago
  The legitimate version of Handbrake is not signed, at least not in the standard Apple way. I know a cert costs some money, but well, this is why they exist and why the latest versions of MacOS have hard-to-override warnings.
  - goodplay 9y ago
    Perhaps we need a letsencrypt for signing packages on walled-garden systems.
    - tonyedgecombe 9y ago
      Code signing requires some verification that you are who you say you are in the real world so there is an additional cost.
      - goodplay 9y ago
        Not necessarily. For issues like the one discussed in this thread, a simple ssh-style "trust initially" would have sufficed, and would have prevented the malicious installer from running. Note that I'm not proposing this as a replacement for the current cert system (which you pay into), but as a replacement for unsigned executables.
vomitcuddle 9y ago
I'm going to take this opportunity to plug my favourite open source project - the Nix package manager[1]. It can work as a universal homebrew replacement (works on MacOS, Linux, WSL and can be easily ported to most BSD variants), comes with a huge collection of packages[2] and produces its own reproducible source builds. Like homebrew, it's a hybrid source and binary based package manager (if you haven't done anything to modify the build, it will likely be downloaded from a cache of pre-built binaries[3]). Unlike something like homebrew-cask, it will never download the pre-built .dmg file from the developer's website - with the obvious exception of proprietary software. It can also work as a great AUR/ports replacement on Linux systems. Fedora doesn't provide FFmpeg or an up-to-date version of a package you need? No problem, just get it from Nix! All the advantages of a rolling release distro, without actually having to use one. Due to its functional nature, it comes with a wealth of advantages over homebrew and other traditional package managers[4]. Once you get past the learning curve, creating your own packages or modifying existing ones is a breeze. It can create disposable development environments with dependencies of whatever project you're working on, without having to install them in your system or user profile! Check out the Nix manual[5] for more information. It's so flexible that people have built a Linux distribution where your entire system configuration is a Nix derivation (package) - with atomic upgrades, rollbacks, reproducible configuration and much more! [6] [1] https://nixos.org/nix/ https://nixos.org/nix/ [2] https://nixos.org/nixos/packages.html https://nixos.org/nixos/packages.html [3] https://hydra.nixos.org/ https://hydra.nixos.org/ [4] https://nixos.org/nix/about.html https://nixos.org/nix/about.html [5] https://nixos.org/nix/manual/ https://nixos.org/nix/manual/ [6] https://nixos.org/nixos/about.html https://nixos.org/nixos/about.html
- skybrian 9y ago
  It looks like you can search the nix package list but not browse it? Based on clicking on the first few packages listed, most Nix packages are apparently for Linux. Is there some way to see which packages are available for Macs?
- nagvx 9y ago
  If we're plugging functional package management, we may as well mention the other significant project in this space - Guix: https://www.gnu.org/software/guix/download/ https://www.gnu.org/software/guix/download/ Essentially, all the benefits touted above apply here, but it is worth noting that Guix is a younger project. The author was originally a Nix dev, but found the DSL to be too awkward to use in practice, and opted to use Scheme through and through. Yes, Emacs bindings are available. Also, Guix can now produce Dockerfiles, if that floats your boat: https://www.gnu.org/software/guix/news/creating-bundles-with-guix-pack.html https://www.gnu.org/software/guix/news/creating-bundles-with...
Girlang 9y ago
That's impossible! Macs are immune to viruses. Secure by design.
mikewhy 9y ago
> The Download Mirror Server is going to be completely rebuilt from scratch. Am I alone in thinking that this is irresponsible? Why not move releases to github? Why aren't you going to start signing macOS binaries? I find this offensive. Thanks for potentially compromising users because you couldn't be arsed to pay for a certificate.
- JohnTHaller 9y ago
  Please feel free to donate the funds necessary to cover the Apple ID signup for multiple years as well as the potentially necessary Apple hardware to install the SDK on and sign the app (since Apple artificially restricts code signing to only run on their own hardware) as well as any necessary training hours to the team to setup said environment so that they can sign the software they're giving to you for free.
  - symlinkk 9y ago
    It's $100 for the signing and $500 for a Mac Mini. Any professional software developer would make that kind of money in a few days. And I would bet that an open source project as big as this gets at least that amount in donations yearly. It's completely irresponsible to not sign releases after something like this happens.
    - JohnTHaller 9y ago
      And if they did get $600 in donations in the last year... they should dedicate all of that to the Mac build? Even if they've already spent those funds on hosting and other expenses? A user of a free product telling the developer of said free product how the developer should be spending the money that said user isn't giving them takes a special kind of entitlement.
      - comex 9y ago
        Hold on… your premise doesn't make sense. Apple's SDK only officially runs on Mac - but that applies to the entire build process, not just codesigning. Anyone who is already producing a Mac build either has access to a Mac build host, which they can also use to sign, or is using third party tools to cross-compile from another OS. In the latter case, there is also a third party tool capable of signing binaries: https://github.com/saucelabs/isign https://github.com/saucelabs/isign You do need to pay the $99/year for the certificate, but it shouldn't be necessary to buy hardware just to sign things.
aethos 9y ago
test
oceanghost 9y ago
God dammit. I downloaded this a few days ago and sure enough, I'm infected. What are reasonable mitigation steps to prevent this in the future? I noticed handbrake said it must "install additional codecs" which is mighty odd, but I didn't think much of it at the time. Is there a security product on OSX that would have prevented this?
- deleted 9y ago
  [deleted]
- hughw 9y ago
  You can (should) check the SHA hash of the .dmg file you download against the ones here: https://github.com/HandBrake/HandBrake/wiki/Checksums https://github.com/HandBrake/HandBrake/wiki/Checksums
  - danieldk 9y ago
    One possibility is that the credentials of one of the developers is obtained. Then this only adds marginal security, since the page with hashes could have been updated as well.
- nol13 9y ago
  Get a PeeCee.
- donatj 9y ago
  I downloaded it 3-4 days ago and I don't appear to be infected as far as I can tell but this gives me serious concerns about if I might be in some other way. Sigh.
- danieldk 9y ago
  Is there a security product on OSX that would have prevented this? Little Flocker. Unfortunately, it was sold to F-Secure [1]. I'm infected Personally, I would wipe the whole system (rather than just removing the malware as in the steps that they describe) and change all credentials (passwords, SSH keys, etc.). [1] https://9to5mac.com/2017/04/06/little-flocker-acquisition/ https://9to5mac.com/2017/04/06/little-flocker-acquisition/
PhantomGremlin 9y ago
What about creating different users on a MacOS system to do different things? Wouldn't this mitigate exploits like this? Why shouldn't I create a "Tommy Transcoder" user on my system? That user would have the Handbrake app in his own Application folder. I assume that Handbrake will run correctly without needing to be installed in the system /Applications? I already do this for a few items of software. Maybe it should be SOP to do this for most/all software? Or what about installing most apps into virtual machines and using VMWare to run them? I do recognize that such an approach couldn't be used universally. E.g. VMWare itself must run on the native machine, and with elevated privileges. I'm interested in "defense in depth". No single technique can defend against all possible exploits.
abalone 9y ago
Did the author not sign the binary?[1] Why not? Is it really just because of the $99/yr developer program fee? And if so.. is it starting to sound like a better value now? [1] https://developer.apple.com/library/content/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html https://developer.apple.com/library/content/documentation/Se...
- voltagex_ 9y ago
  $99 for Apple, $300+ for Windows. It adds up. I suspect Handbrake gets plenty of donations, but most projects don't. Heaven help you if you want to build a signed driver for Windows.
  - hirsin 9y ago
    $300 for Windows? Where does that come from? Submitting to the Store should handle the signing for you (not that I know if it does).
    - i336_ 9y ago
      I think this is for signing arbitrary EXEs. I'd always been curious how that worked, TIL it's that expensive though :(
      - user5994461 9y ago
        It's peanuts to distribute your software to millions of people.
        i336_ 9y ago
        Yeah, fair point. I guess I was erroneously looking at that from the standpoint of the financial scale I'm working with right now (don't have a job, etc) and didn't catch myself. (Hmm. I'll keep an eye on that.) If distributing a commercial (or enterprise) application then yeah it's peanuts (or a rounding error). Good point.
theunixbeard 9y ago
Looks like the XProton malware is a RAT. Full description here: https://www.cybersixgill.com/wp-content/uploads/2017/02/02072017%20-%20Proton%20-%20A%20New%20MAC%20OS%20RAT%20-%20Sixgill%20Threat%20Report.pdf https://www.cybersixgill.com/wp-content/uploads/2017/02/0207...
HedleyLamar 9y ago
How does this happen? Even if installed, doesn't Mac's secure operating system prevent user programs from accessing passwords?
- kccqzy 9y ago
  The malware uses social engineering to obtain root.
JohnTHaller 9y ago
There's a quick analysis of it here: https://objective-see.com/blog/blog_0x1D.html https://objective-see.com/blog/blog_0x1D.html Along with the fact that Apple updated the built-in sorta-antivirus in MacOS to detect it. But it only detects an SHA1 hash on the original DMG. If someone rebuilds the DMG or puts the malware with another app and builds a DMG, it'll bypass the MacOS sorta-antivirus.
- Buge 9y ago
  >HandBrake needs to install additional codecs. Enter your password to allow this. Interesting, the malware creates a phishing-ish popup.
soraminazuki 9y ago
I think the main concern here is the state of GUI apps in macOS and Windows. Popular apps in these platforms are mostly closed-source, even for personal side projects. For the few open source GUI apps, no package manager provides support for building GUI apps from source. I wish package managers would make it easier to build GUI apps from source, or even provide their own binary packages for GUI apps. I really feel reluctant to install most GUI apps on macOS and Windows because I can't trust that the build/distribution platforms for these apps are properly secured.
- Benjamin_Dobell 9y ago
  Being open source isn't going to stop someone replacing a download on a hacked server. Also, the package manager you're after is brew, specifically 'brew cask', which installs GUI apps. EDIT: By the way, building from source doesn't stop someone replacing the source package the package manager uses. Sure you can look at the code in the package, but are you going to? It's more likely you'd check the code on Github, if at all.
  - soraminazuki 9y ago
    I'm mostly worried about the security of the build/distribution platform, which is why I would would prefer a reputable package manager to provide binaries built and distributed using their own infrastructure. If this isn't feasible, better support for building from source would at least ensure that the binaries are correct, provided that your own computer isn't compromised. Homebrew Cask currently can't address this kind of situation, since the binary is still built and distributed from non-reputable sources. The correctness of the source code itself is surely a problem, but it's better than having to trust random binaries built and distributed from non-reputable sources.
    - simooooo 9y ago
      The leakyness here was the Dev, would likely be the Dev again, just pre-github
  - rovr138 9y ago
Angostura 9y ago
The most important bit of the advice - change all your passwords in keychain. To coin a phrase - oh shit
riobard 9y ago
The SHA hash of the dmg file is useless. Who still keeps the dmg file? I need a way to verify the app itself is compromised.
deleted 9y ago
[deleted]
leonroy 9y ago
Yikes. Missed this by 1 day. I updated Handbrake to 1.0.7 on 1st May to compress a bunch of videos. Was a little surprised to see it wasn't signed but after scanning it with ClamXav I figured I was safe and installed it on every Mac in the house so I could crank through my project faster. If I understand correctly even if I had in fact downloaded the compromised version ClamXav wouldn't have detected the malware? This kind of stuff is extremely worrying and really strengthens Apple's case for signed application binaries across the board. Are package managers like Homebrew and MacPorts not also susceptible to this kind of binary poisoning?
joshua_wold 9y ago
Did this affect Handbrake installs that were checking for updates or only newly downloaded installs?

383 points by zalmoxes 9y ago

A working link: https://forum.handbrake.fr/viewtopic.php?f=33&t=36364 https://forum.handbrake.fr/viewtopic.php?f=33&t=36364

fnj 9y ago
Nice try but not working.
zalmoxes 9y ago
In case the site goes down: http://imgur.com/a/I6gpB http://imgur.com/a/I6gpB

asmosoinio 9y ago

" Further Actions Required Based on the information we have, you must also change all the passwords that may reside in your OSX KeyChain or any browser password stores." That sounds like a very large exercise...

tjoff 9y ago
One very good reason to not rely on password managers... That is not to say that there are many good reason to do so, but the password manager do become a very coveted target. edit: Maybe I phrased that badly. It is a risk associated with password managers that everyone that are using one should be aware of.
- mikeash 9y ago
  What's the alternative? Using different passwords for every account is not practical without some way to store them, and using the same password makes you even more vulnerable. We could write them all down in a big book or something, but that leaves us vulnerable to physical theft and loss.
  - Navarr 9y ago
    Certificates, maybe? You'd need a way to change your certificate though (and keep it to the same account). Some system through DNS? I think I'm just slowly reinventing OpenID
    - rocky1138 9y ago
      Client side certificates are a thing but hardly anyone uses them because they are unwieldy.
  - arjie 9y ago
    Theorycrafting without a real idea here but how about a physical device with private keys and challenge-response authentication from a site. To login you have to press a button to sign a specific message as a specific person. Then they can't silently gain access to your account persistently. They can gain access until you logout but then they have to wait for you to login again. Or they can change the key but then you'd notice that you can't login.
    - andrewaylett 9y ago
      That sounds like this: https://en.wikipedia.org/wiki/Universal_2nd_Factor https://en.wikipedia.org/wiki/Universal_2nd_Factor
  - rocqua 9y ago
    To protect against password compromise in general, use 2 factor auth. For this to really work, you need a way to detect compromise of the password. This way the 2nd factor holds you over until you've managed to rotate all important enough passwords. Alternatively, separate trusted hardware with an interactive (i.e. challenge-response) protocol. Something like a TPM or yubikey.
  - xoa 9y ago
    You now have 3 responses as of my comment and they're all worthless because they completely miss the point of Password Managers. PMs are not elegant, they are not ideal, their limits are very well known. They exist purely as a hack around the objective real world reality that authentication in general in the modern world completely sucks and depends on passwords. And that that reality is something we've got to live with and deal with for the foreseeable future. Yes, we shouldn't have passwords for authentication at all, ever, period, and shouldn't have had them for at least a decade now. All the tech has long existed to switch to hardware backed public key cryptographic auth, and even to do so in a way that is far more user friendly then endless passwords and more secure at the same time, a sort of win-win that is quite unusual. We should all have HSMs (be it in the form of tokens, cards, compliant hardware in phones, or whatever) holding our private keys, and websites should only have our public certs. Entire classes of issues (like everything associated with password databases) would be perfectly and completely eliminated forever. There would be no dependence on any 3rd party services. Users would only need to remember at most a couple of PINs and that's it. Back here on Earth though I can count every single site I've used in my life that had certificate based authentication and still have plenty of fingers left. Maybe U2F will make a bit more of a dent, but for a long time to come passwords will be the core of a lot of people's most critical personal security (like most of their money) and online identities. To have any value passwords need to be unique, and need to be fully random, and also have to deal with layers of extra crap that have been piled on top like password policies, arbitrary allowed characters (universal UTF? hahahaha), arbitrary minimum/maximum lengths, "security" questions (which should of course just be random strings lest they undermine the point of having a password but probably have their own special character restrictions), etc. Humans cannot remember all this garbage for more then a handful of sites. Password Managers are a practical solution to this mess of the "worst one except for all the other ones" variety. They effectively replicate (badly, but that's not their fault) some of what an actual decent key system would offer by default. They make attack scaling harder. In short they're the best match to the most typical threat models most people face. Any good efforts to replace passwords period with keys is to be applauded, and if successful would eventually (years down the line) make password managers obsolete by making passwords themselves obsolete. But in the mean time password managers matter and people talking down at them due to issues that don't actually match general threat models are doing a terrible disservice to the public.
- mixedCase 9y ago
  > One very good reason to not rely on password managers... Or for desktop security. Pretty sure Wayland's current security model prevents this as long as the password manager has a well-designed API.
- zalmoxes 9y ago
  No it's not. In this case 1Password wouldn't be compromised, since having access to the system doesn't mean you can decrypt the passwords. With OS X keychain(and browser) unfortunately, if your system is compromised, you can decrypt the password store.
  - symlinkk 9y ago
    If your system is compromised you're fucked, it's game over, they could install a key logger that records your 1Password master password or just replace the 1Password binary with an infected one.
- kazazes 9y ago
  Password managers aren't implicated in the compromise of the OS X keychain or your browser... this is FUD. Your browser's native store is probably unencrypted [1], and the OS X keychain password can be snatched with a clone of the native password prompt. Neither is true for any respected password manager. They keep you safe. [1] https://news.ycombinator.com/item?id=10884000 https://news.ycombinator.com/item?id=10884000
  - tjoff 9y ago
    The OS X keychain is a password manager, right? Just as your browser. Your browsers native store is probably encrypted, see your own source. How would a respected password manager guard against an infected machine? Take keepass as an example, they state: The actual problem here is running specialized spyware (as the same user and with the same rights, like KeeFarce assumes). If you are doing this, everything is over. An application cannot protect itself in such a case; all modern PC operating systems (Windows, Linux, ...) http://keepass.info/help/kb/sec_issues.html#keefarce http://keepass.info/help/kb/sec_issues.html#keefarce Also, at the bottom of the page: Neither KeePass nor any other password manager can magically run securely in a spyware-infected, insecure environment. Users still are responsible for the security of their PC.
Tinyyy 9y ago
Handbrake doesn’t run with admin/ root privileges, how could it access the Keychain?
- objclxt 9y ago
  Because the malware presented a fake authentication prompt under the pretense of "installing additional codecs" which allows it to escalate privilege.
Angostura 9y ago
About 200 passwords in my case. Looking forward to going into work tomorrow and discussing whether I'm infected.
- deleted 9y ago
  [deleted]

nnutter 9y ago

Didn't this also happen somewhat recently? How can this be prevented? The window could be reduced by actively monitoring mirrors? Could BitTorrent help mitigate this because the torrent file validates data and isn't under the control of the parties?

zalmoxes 9y ago
This could have been prevented by hosting downloads on a reputable site(Github), instead of developer's own PHP backend. Software like https://github.com/google/santa https://github.com/google/santa can help, especially if you're doing IT in a large enterprise. The feed used by the software's autoupdate framework(sparkle) was signed, so that would've prevented bad downloads through autoupdate.
- 21 9y ago
  Hosting on GitHub solves one problem, but creates another. Chrome for example has a sort of a bloom filter which is used to check all downloaded executables. This will raise a nasty warning if the thing you downloaded is not a "popular" download. For obvious reason, this check is disabled for a bunch of sites, like github, sf, ... I know for a fact that some malware authors host their stuff on GitHub exactly to bypass this Chrome check.
  - gaadd33 9y ago
    Do you have any more info about this? I've downloaded random executables from a lot of unpopular (and in some cases, newly created by me) sites and never seen anything pop up in chrome warning me not to download it.
    - 21 9y ago
      Information is scarce on this (a little bit of security through obscurity). Here is theirs blog post introducing the feature in 2012: https://chrome.googleblog.com/2012/02/faster-browsing-safer-downloading.html https://chrome.googleblog.com/2012/02/faster-browsing-safer-... > Chrome also does checks on executable files (like ".exe" and ".msi" files). If the executable doesn't match a whitelist, Chrome checks with Google for more information, such as whether the website you're accessing hosts a high number of malicious downloads. At the time I looked at the implementation in the Chrome source code, but I remember that it took me a while to locate it.

rasmi 9y ago

Something similar has happened with Transmission's download DMGs being replaced on their servers [1] (twice! [2]) in recent memory. [1] https://news.ycombinator.com/item?id=11234589 https://news.ycombinator.com/item?id=11234589 [2] https://news.ycombinator.com/item?id=12403768 https://news.ycombinator.com/item?id=12403768

tehabe 9y ago
The original developer of Transmission and Handbrake are the same IIRC. I hope this is just a coincidence.
- tyingq 9y ago
  Coincidence seems unlikely, doesn't it? Same compromised admin level password, or same vector/hole in 2 places seems likely to me.
  - dmix 9y ago
    Could be the same hacker just continuing to prod his lazy security practices. Or exploiting existing knowledge of his systems to bypass new layers. Or he exposed himself on criminal hacking forums as an easy mark. But this is purely baseless conjecture.
closeparen 9y ago
Were the posted checksums also replaced?
- galad87 9y ago
  No, the website was not compromised.

plg 9y ago

I don't understand how I'm supposed to verify the checksum if I've already installed (and run) the HandBrake.app ... and long since deleted the .dmg installer file ????

luhn 9y ago
You aren't. They describe how to check your system for the Trojan if you've already run the installer.
- plg 9y ago
  well aren't I the idiot
  - atmosx 9y ago
    No worries, happens to most of us ;-)

thinknot 9y ago

Using an ftp server is just asking for trouble. Get an S3 bucket.

atmosx 9y ago

I can't believe this. I literally downloaded handbrake like 45 minutes ago! Luckily I got the proper version, but boy oh boy, it was a close call. I think I'll reinstall claXmav on all my macs.

theGimp 9y ago
The real problem is that you're trusting binaries you find on disparate websites. If you want to avoid these sorts of compromises, use a package manager or check the hash of the downloaded file against one that you trust.
- zalmoxes 9y ago
  Which package manager? :P
  - petepete 9y ago
    What OS are you using?
    - sotojuan 9y ago
      Just to let people know, Handbrake is on Homebrew Cask in macOS.
      - sondr3 9y ago
        Sadly Homebrew is terrible for this, the developer guide for how to get the hash for the files you're downloading is literally to just test run the download with an empty hash in the brew file, and it will calculate the hash from the file on the website. In this case Homebrew would not help, as galad87 mentions here https://news.ycombinator.com/reply?id=14282116&goto=item%3Fid%3D14281998%2314282116 https://news.ycombinator.com/reply?id=14282116&goto=item%3Fi....
        oefrha 9y ago

noobermin 9y ago

Usually package managers on linux distros, to use an example for comparison, tend to check checksums of downloads for security purposes during any installation. For MacOS users, I guess I understand they want to use software not blessed by Apple, then isn't homebrew or whatever supposed to do the same thing?

mikeash 9y ago
Most Mac users don't use anything like Homebrew. Typically you just download the software as a .zip file or equivalent, unpack it, and run it. Apple does support code signatures for apps downloaded this way through their Developer ID program, but you have to pay $99/year to be a member of their developer program in order to do so. In theory, you could still sign downloads using a code signing certificate you got elsewhere, but system wouldn't check it for you, and few people would bother to do it manually.
- zalmoxes 9y ago
  If you have Gatekeeper enabled(which it is by default), the system prevents the user from running random unsigned apps.
  - mikeash 9y ago
    You can't turn Gatekeeper off anymore, at least not without using the command line. You can bypass it on an app-by-app basis by just right-clicking an app and selecting "Open" there, which is what you'd have to do if you're downloading apps like Handbrake.
- noobermin 9y ago
  >In theory, you could still sign downloads using a code signing certificate you got elsewhere, but system wouldn't check it for you, and few people would bother to do it manually. Hence, we have occurrences like the OP. The point is checking checksums or (better) signatures is the most common way to mitigate it. Otherwise, this will continue to happen. Dare I say that is the entire reason repo managers of all stripes do this in the first place.

kefka 9y ago

Sigh.. This could be somewhat repaired by making a beta-release, distributing to devs and testers. Once confirmed good, rename file and release via IPFS. The key here, is if multiple devs did this, the hashsum would prove the file being shared. Any one client that's been hacked or infected would show up as an improper hash and easily spotted.

vomitcuddle 9y ago
hindsight is always 20/20 i'm sure <insert your favourite open source project here> would appreciate patches for reproducible, cryptographically signed releases

nly 9y ago

Aren't the dmgs digitally signed?

TillE 9y ago
The legitimate version of Handbrake is not signed, at least not in the standard Apple way. I know a cert costs some money, but well, this is why they exist and why the latest versions of MacOS have hard-to-override warnings.
- goodplay 9y ago
  Perhaps we need a letsencrypt for signing packages on walled-garden systems.
  - tonyedgecombe 9y ago
    Code signing requires some verification that you are who you say you are in the real world so there is an additional cost.
    - goodplay 9y ago
      Not necessarily. For issues like the one discussed in this thread, a simple ssh-style "trust initially" would have sufficed, and would have prevented the malicious installer from running. Note that I'm not proposing this as a replacement for the current cert system (which you pay into), but as a replacement for unsigned executables.

vomitcuddle 9y ago

I'm going to take this opportunity to plug my favourite open source project - the Nix package manager[1]. It can work as a universal homebrew replacement (works on MacOS, Linux, WSL and can be easily ported to most BSD variants), comes with a huge collection of packages[2] and produces its own reproducible source builds. Like homebrew, it's a hybrid source and binary based package manager (if you haven't done anything to modify the build, it will likely be downloaded from a cache of pre-built binaries[3]). Unlike something like homebrew-cask, it will never download the pre-built .dmg file from the developer's website - with the obvious exception of proprietary software. It can also work as a great AUR/ports replacement on Linux systems. Fedora doesn't provide FFmpeg or an up-to-date version of a package you need? No problem, just get it from Nix! All the advantages of a rolling release distro, without actually having to use one. Due to its functional nature, it comes with a wealth of advantages over homebrew and other traditional package managers[4]. Once you get past the learning curve, creating your own packages or modifying existing ones is a breeze. It can create disposable development environments with dependencies of whatever project you're working on, without having to install them in your system or user profile! Check out the Nix manual[5] for more information. It's so flexible that people have built a Linux distribution where your entire system configuration is a Nix derivation (package) - with atomic upgrades, rollbacks, reproducible configuration and much more! [6] [1] https://nixos.org/nix/ https://nixos.org/nix/ [2] https://nixos.org/nixos/packages.html https://nixos.org/nixos/packages.html [3] https://hydra.nixos.org/ https://hydra.nixos.org/ [4] https://nixos.org/nix/about.html https://nixos.org/nix/about.html [5] https://nixos.org/nix/manual/ https://nixos.org/nix/manual/ [6] https://nixos.org/nixos/about.html https://nixos.org/nixos/about.html

skybrian 9y ago
It looks like you can search the nix package list but not browse it? Based on clicking on the first few packages listed, most Nix packages are apparently for Linux. Is there some way to see which packages are available for Macs?
nagvx 9y ago
If we're plugging functional package management, we may as well mention the other significant project in this space - Guix: https://www.gnu.org/software/guix/download/ https://www.gnu.org/software/guix/download/ Essentially, all the benefits touted above apply here, but it is worth noting that Guix is a younger project. The author was originally a Nix dev, but found the DSL to be too awkward to use in practice, and opted to use Scheme through and through. Yes, Emacs bindings are available. Also, Guix can now produce Dockerfiles, if that floats your boat: https://www.gnu.org/software/guix/news/creating-bundles-with-guix-pack.html https://www.gnu.org/software/guix/news/creating-bundles-with...

Girlang 9y ago

That's impossible! Macs are immune to viruses. Secure by design.

mikewhy 9y ago

> The Download Mirror Server is going to be completely rebuilt from scratch. Am I alone in thinking that this is irresponsible? Why not move releases to github? Why aren't you going to start signing macOS binaries? I find this offensive. Thanks for potentially compromising users because you couldn't be arsed to pay for a certificate.

JohnTHaller 9y ago
Please feel free to donate the funds necessary to cover the Apple ID signup for multiple years as well as the potentially necessary Apple hardware to install the SDK on and sign the app (since Apple artificially restricts code signing to only run on their own hardware) as well as any necessary training hours to the team to setup said environment so that they can sign the software they're giving to you for free.
- symlinkk 9y ago
  It's $100 for the signing and $500 for a Mac Mini. Any professional software developer would make that kind of money in a few days. And I would bet that an open source project as big as this gets at least that amount in donations yearly. It's completely irresponsible to not sign releases after something like this happens.
  - JohnTHaller 9y ago
    And if they did get $600 in donations in the last year... they should dedicate all of that to the Mac build? Even if they've already spent those funds on hosting and other expenses? A user of a free product telling the developer of said free product how the developer should be spending the money that said user isn't giving them takes a special kind of entitlement.
    - comex 9y ago
      Hold on… your premise doesn't make sense. Apple's SDK only officially runs on Mac - but that applies to the entire build process, not just codesigning. Anyone who is already producing a Mac build either has access to a Mac build host, which they can also use to sign, or is using third party tools to cross-compile from another OS. In the latter case, there is also a third party tool capable of signing binaries: https://github.com/saucelabs/isign https://github.com/saucelabs/isign You do need to pay the $99/year for the certificate, but it shouldn't be necessary to buy hardware just to sign things.

aethos 9y ago

test

oceanghost 9y ago

God dammit. I downloaded this a few days ago and sure enough, I'm infected. What are reasonable mitigation steps to prevent this in the future? I noticed handbrake said it must "install additional codecs" which is mighty odd, but I didn't think much of it at the time. Is there a security product on OSX that would have prevented this?

deleted 9y ago
[deleted]
hughw 9y ago
You can (should) check the SHA hash of the .dmg file you download against the ones here: https://github.com/HandBrake/HandBrake/wiki/Checksums https://github.com/HandBrake/HandBrake/wiki/Checksums
- danieldk 9y ago
  One possibility is that the credentials of one of the developers is obtained. Then this only adds marginal security, since the page with hashes could have been updated as well.
nol13 9y ago
Get a PeeCee.
donatj 9y ago
I downloaded it 3-4 days ago and I don't appear to be infected as far as I can tell but this gives me serious concerns about if I might be in some other way. Sigh.
danieldk 9y ago
Is there a security product on OSX that would have prevented this? Little Flocker. Unfortunately, it was sold to F-Secure [1]. I'm infected Personally, I would wipe the whole system (rather than just removing the malware as in the steps that they describe) and change all credentials (passwords, SSH keys, etc.). [1] https://9to5mac.com/2017/04/06/little-flocker-acquisition/ https://9to5mac.com/2017/04/06/little-flocker-acquisition/

PhantomGremlin 9y ago

What about creating different users on a MacOS system to do different things? Wouldn't this mitigate exploits like this? Why shouldn't I create a "Tommy Transcoder" user on my system? That user would have the Handbrake app in his own Application folder. I assume that Handbrake will run correctly without needing to be installed in the system /Applications? I already do this for a few items of software. Maybe it should be SOP to do this for most/all software? Or what about installing most apps into virtual machines and using VMWare to run them? I do recognize that such an approach couldn't be used universally. E.g. VMWare itself must run on the native machine, and with elevated privileges. I'm interested in "defense in depth". No single technique can defend against all possible exploits.

abalone 9y ago

Did the author not sign the binary?[1] Why not? Is it really just because of the $99/yr developer program fee? And if so.. is it starting to sound like a better value now? [1] https://developer.apple.com/library/content/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html https://developer.apple.com/library/content/documentation/Se...

voltagex_ 9y ago
$99 for Apple, $300+ for Windows. It adds up. I suspect Handbrake gets plenty of donations, but most projects don't. Heaven help you if you want to build a signed driver for Windows.
- hirsin 9y ago
  $300 for Windows? Where does that come from? Submitting to the Store should handle the signing for you (not that I know if it does).
  - i336_ 9y ago
    I think this is for signing arbitrary EXEs. I'd always been curious how that worked, TIL it's that expensive though :(
    - user5994461 9y ago
      It's peanuts to distribute your software to millions of people.
      - i336_ 9y ago
        Yeah, fair point. I guess I was erroneously looking at that from the standpoint of the financial scale I'm working with right now (don't have a job, etc) and didn't catch myself. (Hmm. I'll keep an eye on that.) If distributing a commercial (or enterprise) application then yeah it's peanuts (or a rounding error). Good point.

theunixbeard 9y ago

Looks like the XProton malware is a RAT. Full description here: https://www.cybersixgill.com/wp-content/uploads/2017/02/02072017%20-%20Proton%20-%20A%20New%20MAC%20OS%20RAT%20-%20Sixgill%20Threat%20Report.pdf https://www.cybersixgill.com/wp-content/uploads/2017/02/0207...

HedleyLamar 9y ago

How does this happen? Even if installed, doesn't Mac's secure operating system prevent user programs from accessing passwords?

kccqzy 9y ago
The malware uses social engineering to obtain root.

JohnTHaller 9y ago

There's a quick analysis of it here: https://objective-see.com/blog/blog_0x1D.html https://objective-see.com/blog/blog_0x1D.html Along with the fact that Apple updated the built-in sorta-antivirus in MacOS to detect it. But it only detects an SHA1 hash on the original DMG. If someone rebuilds the DMG or puts the malware with another app and builds a DMG, it'll bypass the MacOS sorta-antivirus.

Buge 9y ago
>HandBrake needs to install additional codecs. Enter your password to allow this. Interesting, the malware creates a phishing-ish popup.

soraminazuki 9y ago

I think the main concern here is the state of GUI apps in macOS and Windows. Popular apps in these platforms are mostly closed-source, even for personal side projects. For the few open source GUI apps, no package manager provides support for building GUI apps from source. I wish package managers would make it easier to build GUI apps from source, or even provide their own binary packages for GUI apps. I really feel reluctant to install most GUI apps on macOS and Windows because I can't trust that the build/distribution platforms for these apps are properly secured.

Benjamin_Dobell 9y ago
Being open source isn't going to stop someone replacing a download on a hacked server. Also, the package manager you're after is brew, specifically 'brew cask', which installs GUI apps. EDIT: By the way, building from source doesn't stop someone replacing the source package the package manager uses. Sure you can look at the code in the package, but are you going to? It's more likely you'd check the code on Github, if at all.
- soraminazuki 9y ago
  I'm mostly worried about the security of the build/distribution platform, which is why I would would prefer a reputable package manager to provide binaries built and distributed using their own infrastructure. If this isn't feasible, better support for building from source would at least ensure that the binaries are correct, provided that your own computer isn't compromised. Homebrew Cask currently can't address this kind of situation, since the binary is still built and distributed from non-reputable sources. The correctness of the source code itself is surely a problem, but it's better than having to trust random binaries built and distributed from non-reputable sources.
  - simooooo 9y ago
    The leakyness here was the Dev, would likely be the Dev again, just pre-github
- rovr138 9y ago

Angostura 9y ago

The most important bit of the advice - change all your passwords in keychain. To coin a phrase - oh shit

riobard 9y ago

The SHA hash of the dmg file is useless. Who still keeps the dmg file? I need a way to verify the app itself is compromised.

deleted 9y ago

[deleted]

leonroy 9y ago

Yikes. Missed this by 1 day. I updated Handbrake to 1.0.7 on 1st May to compress a bunch of videos. Was a little surprised to see it wasn't signed but after scanning it with ClamXav I figured I was safe and installed it on every Mac in the house so I could crank through my project faster. If I understand correctly even if I had in fact downloaded the compromised version ClamXav wouldn't have detected the malware? This kind of stuff is extremely worrying and really strengthens Apple's case for signed application binaries across the board. Are package managers like Homebrew and MacPorts not also susceptible to this kind of binary poisoning?

joshua_wold 9y ago

Did this affect Handbrake installs that were checking for updates or only newly downloaded installs?