Become a MacRumors Supporter for $25/year with no ads, private forums, and more!
  • Did you order new AirTags? We've opened a dedicated AirTags forum.

MacRumors

macrumors bot
Original poster
Apr 12, 2001
52,456
14,151



Transmission.jpg
Just five months after Transmission was infected with the first "ransomware" ever found on the Mac, the popular BitTorrent client is again at the center of newly uncovered OS X malware.

Researchers at security website We Live Security have discovered the malware, called OSX/Keydnap, was spread through a recompiled version of Transmission temporarily distributed through the client's official website.

OSX/Keydnap executes itself in a similar manner as the previous Transmission ransomware KeRanger, by adding a malicious block of code to the main function of the app, according to the researchers. Likewise, they said a legitimate code signing key was used to sign the malicious Transmission app, different from the legitimate Transmission certificate, but still signed by Apple and thereby able to bypass Gatekeeper on OS X.

The researchers said they notified the Transmission team about the malware, and within minutes they removed the malicious file from their web server and launched an investigation. The researchers believe the infected Transmission app was signed on August 28 and distributed only on August 29, and thus recommend anyone who downloaded version 2.92 of the app between those dates to verify if their system is compromised by checking for the presence of any of the following files or directories:
/Applications/Transmission.app/Contents/Resources/License.rtf
/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf
$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd
$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id
$HOME/Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist
/Library/Application Support/com.apple.iCloud.sync.daemon/
$HOME/Library/LaunchAgents/com.geticloud.icloud.photo.plist
Transmission version 2.92 remains available through the software's update mechanism.

Article Link: BitTorrent Client Transmission Again Victimized by OS X Malware
 
  • Like
Reactions: 997440

GeneralChang

macrumors 68000
Dec 2, 2013
1,546
1,213
I had that brief moment of panic until I realized it was on installations that were distributed during that time window. So that's me out. I may never update that app again, however...
 
Comment

ArtOfWarfare

macrumors G3
Nov 26, 2007
9,130
5,099
I use Bit Rocket.

There's tons of bit torrent clients around - I find it odd that everyone congregates around a single one... or ever update it? They're single purpose tools - plug in the torrent you want to download and it downloads.

I find it odd that web browsers don't just support the protocol directly.
 
Comment

a0me

macrumors 65816
Oct 5, 2006
1,074
166
Tokyo, Japan
I'm glad I don't use these types of apps. I don't need the headaches of potentially getting malicious software on my machines.
You can as easily get malware using any Internet browser, and yet most people posting on these forums seem to be using one.
Unless if by "these types of apps" you mean "apps that can be used to commit copyright infringement," in which case you'll need to stop using your Internet browser, your camera app, and more generally any kind of operating system.
 
Comment

LERsince1991

macrumors 65816
Jul 24, 2008
1,245
37
UK
Can someone please clarify what is and isn't safe.

For example if transmission automatically updated within this period is it compromised. Or does the download have to be direct from the website using browser?
 
Comment

Makosuke

macrumors 603
Aug 15, 2001
6,350
622
The Cool Part of CA, USA
Transmission is an extremely polished client, so it's rather disappointing that they've managed to get their official builds, distributed from their own website, built with malware twice now. That does not speak well, at all, to how they maintain either their servers or their dev team.

An aside to those ragging on BitTorrent:

First, there are surprisingly enough some legit things that are now distributed primarily or exclusively through BT. I needed to get Transmission running to download ATI's tech demo package recently.

And second, while its obviously heavily abused to pirate content, there is also a huge grey area of technically-not-okay things that don't really fall into the standard bin of piracy. Example: J-dramas. While this has been improving (mostly Crunchyroll and, for K-dramas, Hulu) there are still many, particularly older ones, that have never been licensed or officially released outside Japan, so while there's always the "market poisoning" question if somebody does consider licensing in the future, there's currently no legitimate way to view them if you live in the US, and since there is no official distributor in this country there's also nobody defending the copyrights. Conversely, it's quite likely that if there was no underground scene of fansubbing and distributing J-dramas illegally, there would be almost none of the interest that makes a legit service like Crunchyroll possible.
 
Comment
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.