Slashdot Mirror
Transmission BitTorrent App Contained Malware (cnbc.com)
An anonymous reader writes: Apple users were targeted in the first known Mac ransomware campaign. Hackers targeted Transmission, which is one of the most popular Mac applications used to download software, videos, music, and other data from the BitTorrent peer-to-peer information sharing network. As per this forum post (English screenshot of warning), OS X detected malware called OSX.KeRanger.A. This is the first one in the wild that is functional as it encrypts your files and seeks a ransom. An Apple representative said the company had taken steps over the weekend to prevent attacks by revoking a digital certificate from a legitimate Apple developer that enabled the rogue software to install on Macs.
In fact, in this case probably it was the contrary. I guess the developer was not part of the developer team for transmission, but external. If it were easy to package software for macs without having to pay lots of fees, the dev team could have done it themselves. Apple really should give free dev licenses to free software developers, to help fight abuse. Github does something like that too.
try "bittorrent protocol" because that's what it is, a PROTOCOL.. not a network.. and certainly not a singular "information sharing network".. that's rich, even for slashdot editors.
In Linux Mint 13.
I think that version is safe. My guess at the core of the whole story is that transmission wanted to provide binaries for mac, and they asked someone external to the project to do it, because neither of them had a mac nor wanted to afford $100 in order to build software for free, and that person was malicious and included the ransomware.
I guess that that made enough money to compensate for the Mac purchase and the 100$ developer fee. One can even say that in this case, apple made money with malware.
Yeah, no. They say the attack vector was unknown and was likely to have hacked the server.
Stop trying to find ways to steal other people's work without compensating them and you won't have this problem.
But just like drug users, there will always be an excuse for why people think it's acceptable.
Ok, I give up. What are you nattering on about?
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Go fuck yourself, thats what comment moderation is here for. Anonymity on the internet is immeasurably valuable in terms of free speech and this is one of the last somewhat meanigful places on the internet you can still have it.
Apparently a peer-to-peer file transfer protocol can be used to transfer files from one peer to another. And... err... Chewbacca lives on the planet Endor, therefore coping files is stealing, we've always been at war with Eastasia, and you have to compensate people for their work, because... they've not lost anything?
Who ordered that?
Don't give up. Don't ask.
Don't step on the baby.
Given that Transmission originates as a project purely for Mac OS (which has subsequently become cross platform), I'd be amazed if the main devs didn't own Macs.
Now the ransomware's certificate is revoked, I guess there is no hope to pay the crooks and recover the data?
I think everything you're proposing can be achived via psuedonymity, which allows you to create a new persona detached from your real one (insulating the real you from persecution), but which allows the rest of use to set the "dipshit" flag on that persona if you're clearly a dipshit. Anonymity encourages assholism. Just reading through the "anonymous cowards" comments on Slashdot should be enough to make that fact evident.
How is an encrypted drive different from a failed drive, other than that if it's only encrypted you don't even have to buy a new one - just wipe it and restore your backup, maybe reinstall your OS first.
thegodmovie.com - watch it
I've been reading and commenting on slashdot since at least 1999, possibly earlier I can't really remember. I've never bothered to setup an acct and always posted AC. Good or bad IDK but I appreciated the quick comment option. Just like ads and a lot of things. It isn't essential to my existence if the ability goes away but sometimes it is nice.
If you don't believe in AC then don't post AC.
This site doesn't give a shit if you sign up or not.
Also, banning AC won't stop any of that. All it will do is add a bunch of throwaway accounts to the site real fast.
That implies there is something wrong with assholism, which is where I disagree. People should be able to speak as they choose, it is how the community judges their statements that is important. This decides what is and isn't socially acceptable, and comment moderation serves this purpose here on /. I personally don't feel the need to post as AC that often but sometimes you want to make sure that what you say isn't linked to any presence other than your IP which can be hidden using VPN/TOR etc if necessary.
Transmission started on the Mac. You really think that a couple $k for tools is a big deal to those with a job?
TL;DR: Geez Louise, cuntcheese, if you don't know what you're talking about...don't say it!
Well, AC is useless in your case. We'll instantly know it's you the next time a homosexual African American creates an account here.
transmission is a longtime award winning mac app.
At the RSA Conference 2016 in San Francisco, last week, during one of the sessions dealing with Apple malware, a question was asked, why is was no mac cryptolocker yet, and an opinion was that there will be one within 6 months.
RSAC ended on Friday.
So, if you find your important file encrypted by ransomware, how difficult is it to just restore it from a Time Machine backup?
After all, once it was encrypted, you can use it anymore, so it is simple to just get the version before the last update time.
Oliver.
is in-browser support for BitTorrent so there can be better trust.
Now, if you'll excuse me, I have backups to corrupt.
And... err... Chewbacca lives on the planet Endor...
Chewbacca lives on Endor? Does he have a thing for the furry little Ewoks, or are they just food? Next you'll be telling us that Jar-Jar Binks is a Sith Lord!
Oh wait, perhaps he actually was meant to be that, but Lucas backed off because of the vitriol towards Binks. More info in link.
Even an interesting secondary thread on the name Bink name possibly referencing a Piers Anthony character.
In Linux Mint 13.
Yes: and so is the source code https://www.transmissionbt.com/about/ So if there is hacked version for Linux it will be a compiled binary without the source being available which is against the terms and conditions of Mint. The dev that released the app on the APPLE "APE STORE" must monkeyed around with the code and deserves to be black balled from the dev communities permanently. I can't say as I blame the folks at transmission.COM for not paying to release it on the APE STORE system. Don't sweat it the black hats like this prick don't go after Linux users 1. because by and large we know to look out for stupid alteration that do not include source. 2. We are mostly cheap assholes who thumb our noses at Apple and Mac users LOL. First rule of linux if the code 'aint available and easily verifiable don't use it.
This always brightens my day a little.
Anonymity on the internet is immeasurably valuable in terms of free speech and this is one of the last somewhat meanigful places on the internet you can still have it.
AC posting on Slashdot is no more anonymous than posting with an account. It just uniquifies your identity in the discussion.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
as more users move away from windows 10 more focus will gather on the mac vulnerabilies
IN SOVIET RUSSIA, Anonymous Cowards ban YOU!
Hi, I have two computers.
I remember I saw that "improved compatibilty with modern OS X" and pressed install update..., but I can not remember which one or even both. After checking this machines Transmission, it is still 2.84
And I when reading this, I actually catched an uber to get to my other office to check what was going on there. ... but that also had 2.84, so it seems that the 2.9 update was unsuccessful on both computer / or one of them...
so then all safe? or is it masking itself as an older version or something.
Transmission is a pretty lightweight and nice torrent client, with the core separated from the GUI, the latter varies a lot between the GTK and the mac version.
It's also written in C and with few dependencies, which makes compilation for embedded architectures easy.
According to a comment at MacRumors, the malware only infected software downloaded from the website, not software updated through the updater mechanism.
I prefer deluge's UI. Transmission misses some important features. Although for the life of me I don't understand why they had to complicate deluged so much. Yes, I'm sure there is going to be that one guy who needs to run it as a server/thin client app, and it's great that that's supported. I've even set it up correctly once before. But halfway through doing that again I decided it was completely not worth the trouble to be able to manage torrents from the command line. ssh -X deluge-gtk; done.
you speak off?
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
From the technical analysis section of the research document
In addition to this behavior, it seems like KeRanger is still under development. There are some apparent functions named “_create_tcp_socket”, “_execute_cmd” and “_encrypt_timemachine”. Some of them have been finished but are not used in current samples. Our analysis suggests the attacker may be trying to develop backdoor functionality and encrypt Time Machine backup files as well. If these backup files are encrypted, victims would not be able to recover their damaged files using Time Machine.
So it would appear that Time Machine's current design keeps it's data safe -- for now -- from having one's online backups encrypted. As others have pointed out, that's not likely to last and offline backups are a *very* good idea.
try Vuse
Transmission started on the Mac. You really think that a couple $k for tools is a big deal to those with a job?
TL;DR: Geez Louise, cuntcheese, if you don't know what you're talking about...don't say it!
Just hits me as a tad odd that a program supplied as a default Linux program - that does the same thing, shares the same name, and not hit a copyright wall; so suspect as an update.
Transmission started on the Mac. You really think that a couple $k for tools is a big deal to those with a job?
TL;DR: Geez Louise, cuntcheese, if you don't know what you're talking about...don't say it!
Just hits me as a tad odd that a program supplied as a default Linux program - that does the same thing, shares the same name, and not hit a copyright wall; so suspect as an update.
All said and done it would appear my concerns a non issue. I just came across Transmission included in the excellent program "Portable Apps" https://sourceforge.net/projec... . Not as isolated as I tended to believe; many checks and balances.
But seriously , this is why open source software needs open distribution