Slashdot Mirror
Transmission Malware On Mac, Strike 2 (macrumors.com)
New reader puenktli writes: Just five months after Transmission was infected with the first 'ransomware' ever found on the Mac, the popular BitTorrent client is again at the center of newly uncovered OS X malware. Researchers at security website We Live Security have discovered the malware, called OSX/Keydnap, was spread through a recompiled version of Transmission temporarily distributed through the client's official website. OSX/Keydnap executes itself in a similar manner as the previous Transmission ransomware KeRanger, by adding a malicious block of code to the main function of the app, according to the researchers. Likewise, they said a legitimate code signing key was used to sign the malicious Transmission app, different from the legitimate Transmission certificate, but still signed by Apple and thereby able to bypass Gatekeeper on OS X.
Why would a platform which is hated by many multibillion dollar corporations for being used to violates their legal rights be a target for malware. :) but then again it does make you kind of wonder. Does anyone else know who or why people target this kind of system with malware. I suppose it is also a good target because the machines may already be using large amounts of bandwidth so there is less chance of detection. Seriously though, anybody out there know why malware makers pick specific targets, what makes some easier ect.
( ok.... I think I will go put on my tinfoil hat now
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
...since all it confirms is that the malicious author has managed to bypass the extremely primitive identity verification methods.
Unlikely. A far more likely scenario is that the build machine itself was compromised.
We first started hearing widespread reports of fake versions of XCode making the rounds in China last year (apparently because download speeds in China from Apple's servers are atrocious, so people host local mirrors of XCode to help each other out), which were configured to inject malware at compilation into any software being built. At that point, the developer would then sign their app like normal and distribute it through their official channels, which is exactly what we saw happen here.
I mean, at the end of the day, do you really think it's more likely that someone managed to crack the entire signing mechanism and decided that their first target should be a relative small-fry whose website they'd have to take the time to personally hack in order to distribute the software via official channels, or is it instead possibly just a bit more likely that a known vector that's been in the wild was used to compromise this particular dev's system somewhere upstream?
The build machine wasn't compromised. The Transmission web server was compromised and the Transmission binary was replaced on the server.
This has absolutely nothing to do with Xcode.
The Dev ID used to sign it was not Transmission's Dev ID.
I read the article.
The Transmission app uses the Sparkle Software Update mechanism. Sparkle uses certificate pinning to prevent exactly this type of attack. The auto-updater will not permit an application to be updated if the update is signed by a different entity.
So this malware only affected people that manually downloaded the app from the Transmission website.