Slashdot Mirror
Transmission Malware On Mac, Strike 2 (macrumors.com)
New reader puenktli writes: Just five months after Transmission was infected with the first 'ransomware' ever found on the Mac, the popular BitTorrent client is again at the center of newly uncovered OS X malware. Researchers at security website We Live Security have discovered the malware, called OSX/Keydnap, was spread through a recompiled version of Transmission temporarily distributed through the client's official website. OSX/Keydnap executes itself in a similar manner as the previous Transmission ransomware KeRanger, by adding a malicious block of code to the main function of the app, according to the researchers. Likewise, they said a legitimate code signing key was used to sign the malicious Transmission app, different from the legitimate Transmission certificate, but still signed by Apple and thereby able to bypass Gatekeeper on OS X.
Why would a platform which is hated by many multibillion dollar corporations for being used to violates their legal rights be a target for malware. :) but then again it does make you kind of wonder. Does anyone else know who or why people target this kind of system with malware. I suppose it is also a good target because the machines may already be using large amounts of bandwidth so there is less chance of detection. Seriously though, anybody out there know why malware makers pick specific targets, what makes some easier ect.
( ok.... I think I will go put on my tinfoil hat now
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
...since all it confirms is that the malicious author has managed to bypass the extremely primitive identity verification methods.
Does it have a master backdoor login to give easy access to very unpleasant people? (movie reference for people that remember which one)
if that was with the legit key, then it sounds like they got bigger issues than they realize.
...since all it confirms is that the malicious author has managed to bypass the extremely primitive identity verification methods.
Unlikely. A far more likely scenario is that the build machine itself was compromised.
We first started hearing widespread reports of fake versions of XCode making the rounds in China last year (apparently because download speeds in China from Apple's servers are atrocious, so people host local mirrors of XCode to help each other out), which were configured to inject malware at compilation into any software being built. At that point, the developer would then sign their app like normal and distribute it through their official channels, which is exactly what we saw happen here.
I mean, at the end of the day, do you really think it's more likely that someone managed to crack the entire signing mechanism and decided that their first target should be a relative small-fry whose website they'd have to take the time to personally hack in order to distribute the software via official channels, or is it instead possibly just a bit more likely that a known vector that's been in the wild was used to compromise this particular dev's system somewhere upstream?
The appy Transmission app was apped by Apple, which means it's super appy, NOT LUDDITE malware!
Apps!
Gatekeeper does not keep undiscovered malware out; it keeps known malware out. Expect a certificate revocation momentarily (unless it's already happened).
could be confusing. Transmission of some malware? two strikes? how many balls? Whose on first?
Oh, John Oliver, you are the funniest!
The good old days, when Macs didn't get sick, and we had to walk uphills 25 miles to school. In a blizzard. Both ways!
Now get off my lawn.
--sf
Man.
I suppose the Apple car will be kind of like the original iPod - just a steering wheel with one button in the center and no other controls.
The transmission only goes in one direction... forward.
Driving in reverse, similar to right clicking on a mouse is too difficult for new drivers to learn.
The build machine wasn't compromised. The Transmission web server was compromised and the Transmission binary was replaced on the server.
This has absolutely nothing to do with Xcode.
I didn't read the article, so I don't know if it's mentioned there or not, but where did you get that info?
I read the article.
This is one of those moments where I wish I could post a retraction to my comment. It may provide some useful info regarding an actual issue that's been happening, but it's inapplicable in this particular situation, as you pointed out, so I certainly appreciate the correction.
For anyone else reading this far, it's worth summarizing what the actual problem was. It was neither what the AC suggested nor what I suggested. Rather, what actually happened was that a different dev's certificate was used to sign the malicious app, which was then uploaded to the Transmission servers. Basically, the malware dev had their own valid certificate, signed their malicious binary with it, and then uploaded it to the Transmission dev's servers. At this point, the obvious next step would be for Apple to revoke the malware dev's certificate and add the binary's signature to their XProtect malware definitions list. Also, if it doesn't already do so, it would be beneficial for Transmission to disallow automatic updating from binaries that are signed by a certificate other than their own, but that's on them to do, not Apple, since they're distributing it outside of the Mac App Store.
Anyway, thanks again, Rosyna, both for the correction and the response.
The Transmission app uses the Sparkle Software Update mechanism. Sparkle uses certificate pinning to prevent exactly this type of attack. The auto-updater will not permit an application to be updated if the update is signed by a different entity.
So this malware only affected people that manually downloaded the app from the Transmission website.
You're just going above and beyond at this point. People need to be modding you up.
You realize back when Macs had no right click they had three different keyboard modifiers for shortcuts right? Right click was redundant.
Windows UI was simpler, with a right click context menu and fewer keyboard shortcuts.
The transmission only goes in one direction... forward.
Driving in reverse, similar to right clicking on a mouse is too difficult for new drivers to learn.
Without Jobs, it'll never fly. No, literally, it flies, but only if you're hip'n'cool enough to know that.
*ducks*
It's really hard to pull people out of a good hate-circlejerk.
Eat the rich.
If you are looking for a new BitTorrent client, then avoid Vuze. It used to be a superb client but recently they switched to the malware model. Last update it infected all my broswers with redirecting ad ware. My search engines were all set to Yahoo and it installed multiple extensions. It was painful to remove it all.
I'm not making this up since the company fully admits they do this on their own forum web pages. Well they don't use the word malware, but if it quacks like a duck.
Some drink at the fountain of knowledge. Others just gargle.
"Back when" they didn't? I'm pretty sure they still don't. My Macbook's trackpad certainly only has (well, is) one button, and as far as I can tell the OS treats right clicking on any external mice as identical to ctrl+click.
I didn't read the article either, but I did read the summary. It was entirely clear to me that the program was signed by a legitimate (to Apple) but "incorrect" key (as in, not the key issues to the Transmission people).
Good thing you guys wasted a bunch of time debating it. You definitely made the comments relevant.
This might be more correctly phrased as "satisfies gatekeeper."
The summary's claim is like saying that because a TLS Certificate Authority was compromised and issued illegitimate certificates for e.g. google.com, X509 has been broken.