Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

BitTorrent Client Transmission Again Victimized by OS X Malware

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
68,160
38,935



Transmission.jpg
Just five months after Transmission was infected with the first "ransomware" ever found on the Mac, the popular BitTorrent client is again at the center of newly uncovered OS X malware.

Researchers at security website We Live Security have discovered the malware, called OSX/Keydnap, was spread through a recompiled version of Transmission temporarily distributed through the client's official website.

OSX/Keydnap executes itself in a similar manner as the previous Transmission ransomware KeRanger, by adding a malicious block of code to the main function of the app, according to the researchers. Likewise, they said a legitimate code signing key was used to sign the malicious Transmission app, different from the legitimate Transmission certificate, but still signed by Apple and thereby able to bypass Gatekeeper on OS X.

The researchers said they notified the Transmission team about the malware, and within minutes they removed the malicious file from their web server and launched an investigation. The researchers believe the infected Transmission app was signed on August 28 and distributed only on August 29, and thus recommend anyone who downloaded version 2.92 of the app between those dates to verify if their system is compromised by checking for the presence of any of the following files or directories:
/Applications/Transmission.app/Contents/Resources/License.rtf
/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf
$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd
$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id
$HOME/Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist
/Library/Application Support/com.apple.iCloud.sync.daemon/
$HOME/Library/LaunchAgents/com.geticloud.icloud.photo.plist
Transmission version 2.92 remains available through the software's update mechanism.

Article Link: BitTorrent Client Transmission Again Victimized by OS X Malware
 
Article Link
https://www.macrumors.com/2016/08/30/transmission-keydnap-os-x-malware/
  • Like
Reactions: 997440
I had that brief moment of panic until I realized it was on installations that were distributed during that time window. So that's me out. I may never update that app again, however...
 
  • Like
Reactions: Naaaaak and sudo1996
I use Bit Rocket.

There's tons of bit torrent clients around - I find it odd that everyone congregates around a single one... or ever update it? They're single purpose tools - plug in the torrent you want to download and it downloads.

I find it odd that web browsers don't just support the protocol directly.
 
  • Like
Reactions: tennisproha and sudo1996
SandboxGeneral said:
I'm glad I don't use these types of apps. I don't need the headaches of potentially getting malicious software on my machines.
Click to expand...
You can as easily get malware using any Internet browser, and yet most people posting on these forums seem to be using one.
Unless if by "these types of apps" you mean "apps that can be used to commit copyright infringement," in which case you'll need to stop using your Internet browser, your camera app, and more generally any kind of operating system.
 
  • Like
Reactions: milo, Shirasaki and wlossw
Can someone please clarify what is and isn't safe.

For example if transmission automatically updated within this period is it compromised. Or does the download have to be direct from the website using browser?
 
  • Like
Reactions: scapegoat81 and AgentMcGeek
Transmission is an extremely polished client, so it's rather disappointing that they've managed to get their official builds, distributed from their own website, built with malware twice now. That does not speak well, at all, to how they maintain either their servers or their dev team.

An aside to those ragging on BitTorrent:

First, there are surprisingly enough some legit things that are now distributed primarily or exclusively through BT. I needed to get Transmission running to download ATI's tech demo package recently.

And second, while its obviously heavily abused to pirate content, there is also a huge grey area of technically-not-okay things that don't really fall into the standard bin of piracy. Example: J-dramas. While this has been improving (mostly Crunchyroll and, for K-dramas, Hulu) there are still many, particularly older ones, that have never been licensed or officially released outside Japan, so while there's always the "market poisoning" question if somebody does consider licensing in the future, there's currently no legitimate way to view them if you live in the US, and since there is no official distributor in this country there's also nobody defending the copyrights. Conversely, it's quite likely that if there was no underground scene of fansubbing and distributing J-dramas illegally, there would be almost none of the interest that makes a legit service like Crunchyroll possible.
 
  • Like
Reactions: Shirasaki, cicuz, Naaaaak and 8 others
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back