5 ms·

I can't believe this. I literally downloaded handbrake like 45 minutes ago! Luckily I got the proper version, but boy oh boy, it was a close call. I think I'll

by atmosx 10y ago

I can't believe this. I literally downloaded handbrake like 45 minutes ago! Luckily I got the proper version, but boy oh boy, it was a close call. I think I'll reinstall claXmav on all my macs.

theGimp 10y ago
The real problem is that you're trusting binaries you find on disparate websites. If you want to avoid these sorts of compromises, use a package manager or check the hash of the downloaded file against one that you trust.
- zalmoxes 10y ago
  Which package manager? :P
  - petepete 10y ago
    What OS are you using?
    - sotojuan 10y ago
      Just to let people know, Handbrake is on Homebrew Cask in macOS.
      - sondr3 10y ago
        Sadly Homebrew is terrible for this, the developer guide for how to get the hash for the files you're downloading is literally to just test run the download with an empty hash in the brew file, and it will calculate the hash from the file on the website. In this case Homebrew would not help, as galad87 mentions here https://news.ycombinator.com/reply?id=14282116&goto=item%3Fid%3D14281998%2314282116 https://news.ycombinator.com/reply?id=14282116&goto=item%3Fi....
        oefrha 10y ago
        And, what's your proposed alternative for calculating a hash? Btw, we treat hash changes very seriously in homebrew-core; they are never merged without a confirmation from the upstream. Unfortunately Cask apparently doesn't live up to the same standard, but Homebrew Cask is not really Homebrew.
      - danieldk 10y ago
        ...which used the hash of the compromised version for ~3 days.
- galad87 10y ago
  HomeBrew Cask updated the hash to the infected one, so in this case it has been useless.
  - 0x0 10y ago
    If you look at the history for handbrake in cask, it looks like it was first updated to 1.0.7 with the correct hash, then later the hash was changed with no version bump, and then reverted. That's crazy! Why didn't alarm bells go off when the hash changed? https://github.com/caskroom/homebrew-cask/commits/master/Casks/handbrake.rb https://github.com/caskroom/homebrew-cask/commits/master/Cas...
    - adriancooney 10y ago
      What the absolute heck. Literally just the hash was updated yet the version stayed the same: https://github.com/caskroom/homebrew-cask/commit/461af7672fa267ed42bd5572c20bf337cb4da87e#diff-d2016e0c3103c7993f5cec00fd000a23 https://github.com/caskroom/homebrew-cask/commit/461af7672fa...
chmars 10y ago
Would antivirus software have helped? (And anyway, installing snake oil is rather desperate, especially for a techie who should know better …)
- rocqua 10y ago
  On windows, signed binaries might have been a defense. Antivirus might, but only if it happens to recognize the malware.
  - 21 10y ago
    This is highly unpopular here, but I think we need something like the iOS/Android permission system on the desktop. Windows Metro apps do this, but they are highly maligned here. I should be able to install a transcoding app like Handbrake without giving it all the keys to the kingdom and allowing it to do whatever it pleases.
    - rocqua 10y ago
      I know essentially nothing of the windows system API, but it would have to be implemented at that level. The Microsoft hate would suggest they are restricting the permission system to Metro to encourage development to move towards Metro. It could also be that the underlying metro API is much easier to build a permission system for than the old windows one. From what I've read though, these kinds of permission systems tend to only be a barrier. Sandboxes seem to always have some exploits. It would certainly be an improvement though. With regards to file-systems, a simple linux based file-ownership model would do essentially the same.
      - 21 10y ago
        Windows already supports sandboxing old api applications, through something called AppContainer: > Isolation is the primary goal of an AppContainer execution environment. By isolating an application from unneeded resources and other applications, opportunities for malicious manipulation are minimized. Granting access based upon least-privilege prevents applications and users from accessing resources beyond their rights. I'm not sure why this is not really used. Maybe requires some recoding from the original developer, maybe it's too inconvenient and creates frustration for users. Even with file systems permissions, there are a lot of problems. For example, a transcoding app like Handbrake should be allowed access to users files, but ideally it would only be able to access VIDEO files. Any attempt at reading any other kind of file (source code, text files, password stores) should be forbidden. This requires a very expressive permissioning system.

by atmosx 10y ago

I can't believe this. I literally downloaded handbrake like 45 minutes ago! Luckily I got the proper version, but boy oh boy, it was a close call. I think I'll reinstall claXmav on all my macs.

theGimp 10y ago

The real problem is that you're trusting binaries you find on disparate websites. If you want to avoid these sorts of compromises, use a package manager or check the hash of the downloaded file against one that you trust.

zalmoxes 10y ago
Which package manager? :P
- petepete 10y ago
  What OS are you using?
  - sotojuan 10y ago
    Just to let people know, Handbrake is on Homebrew Cask in macOS.
    - sondr3 10y ago
      Sadly Homebrew is terrible for this, the developer guide for how to get the hash for the files you're downloading is literally to just test run the download with an empty hash in the brew file, and it will calculate the hash from the file on the website. In this case Homebrew would not help, as galad87 mentions here https://news.ycombinator.com/reply?id=14282116&goto=item%3Fid%3D14281998%2314282116 https://news.ycombinator.com/reply?id=14282116&goto=item%3Fi....
      - oefrha 10y ago
        And, what's your proposed alternative for calculating a hash? Btw, we treat hash changes very seriously in homebrew-core; they are never merged without a confirmation from the upstream. Unfortunately Cask apparently doesn't live up to the same standard, but Homebrew Cask is not really Homebrew.
    - danieldk 10y ago
      ...which used the hash of the compromised version for ~3 days.
galad87 10y ago
HomeBrew Cask updated the hash to the infected one, so in this case it has been useless.
- 0x0 10y ago
  If you look at the history for handbrake in cask, it looks like it was first updated to 1.0.7 with the correct hash, then later the hash was changed with no version bump, and then reverted. That's crazy! Why didn't alarm bells go off when the hash changed? https://github.com/caskroom/homebrew-cask/commits/master/Casks/handbrake.rb https://github.com/caskroom/homebrew-cask/commits/master/Cas...
  - adriancooney 10y ago
    What the absolute heck. Literally just the hash was updated yet the version stayed the same: https://github.com/caskroom/homebrew-cask/commit/461af7672fa267ed42bd5572c20bf337cb4da87e#diff-d2016e0c3103c7993f5cec00fd000a23 https://github.com/caskroom/homebrew-cask/commit/461af7672fa...

chmars 10y ago

Would antivirus software have helped? (And anyway, installing snake oil is rather desperate, especially for a techie who should know better …)

rocqua 10y ago
On windows, signed binaries might have been a defense. Antivirus might, but only if it happens to recognize the malware.
- 21 10y ago
  This is highly unpopular here, but I think we need something like the iOS/Android permission system on the desktop. Windows Metro apps do this, but they are highly maligned here. I should be able to install a transcoding app like Handbrake without giving it all the keys to the kingdom and allowing it to do whatever it pleases.
  - rocqua 10y ago
    I know essentially nothing of the windows system API, but it would have to be implemented at that level. The Microsoft hate would suggest they are restricting the permission system to Metro to encourage development to move towards Metro. It could also be that the underlying metro API is much easier to build a permission system for than the old windows one. From what I've read though, these kinds of permission systems tend to only be a barrier. Sandboxes seem to always have some exploits. It would certainly be an improvement though. With regards to file-systems, a simple linux based file-ownership model would do essentially the same.
    - 21 10y ago
      Windows already supports sandboxing old api applications, through something called AppContainer: > Isolation is the primary goal of an AppContainer execution environment. By isolating an application from unneeded resources and other applications, opportunities for malicious manipulation are minimized. Granting access based upon least-privilege prevents applications and users from accessing resources beyond their rights. I'm not sure why this is not really used. Maybe requires some recoding from the original developer, maybe it's too inconvenient and creates frustration for users. Even with file systems permissions, there are a lot of problems. For example, a transcoding app like Handbrake should be allowed access to users files, but ideally it would only be able to access VIDEO files. Any attempt at reading any other kind of file (source code, text files, password stores) should be forbidden. This requires a very expressive permissioning system.