Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

First Mac Ransomware Found in Transmission BitTorrent Client

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
63,453
30,657



transmission-29.png

This weekend, a notice appeared on Transmissionbt.com warning users that version 2.90 of the popular Mac BitTorrent client downloaded from their site may have been infected with malware. The warning reads:
Everyone running 2.90 on OS X should immediately upgrade to 2.91 or delete their copy of 2.90, as they may have downloaded a malware-infected file.

Using "Activity Monitor" preinstalled in OS X, check whether any process named "kernel_service" is running. If so, double check the process, choose the "Open Files and Ports" and check whether there is a file name like "/Users//Library/kernel_service". If so, the process is KeRanger's main process. We suggest terminating it with "Quit -> Force Quit"
Click to expand...
Reuters reports that the infected download contained the first "Ransomware" found on the Mac platform. Ransomware is a type of malware that encrypts a user's hard drive and demands payment in order to unencrypt it. This type of attack has been increasingly popular on the PC, but this is the first time it has been seen on the Mac.

According to Reuters, Apple is aware of the issue and has already revoked "a digital certificate from a legitimate Apple developer that enabled the rogue software to install on Macs."

The malware in question is said to delay encrypting the user's hard drive for 3 days, so we may see the first reports of those affected as early as Monday. Transmissionbt.com offers instructions on how to see you are affected (above). If you don't use the Transmission software, there is nothing you need to do at this time.

Update: Technical details about the malware.

Update 2: Transmissionbt.com says version 2.92 of Transmission will actively remove the malware.

Article Link: First Mac Ransomware Found in Transmission BitTorrent Client
 
Article Link
https://www.macrumors.com/2016/03/06/mac-ransomware-transmission/
0098386

0098386

Suspended
Jan 18, 2005
21,574
2,908
That's worrying. You're encouraged to constantly keep your applications and OS updated, but recently that's becoming troublesome. First with Apple's silent security update disabling wired networks and now this! Worrying year for security this.
 
  • Like
Reactions: Wowereit, sd70mac, alvindarkness and 14 others
thisisnotmyname

thisisnotmyname

macrumors 68020
Oct 22, 2014
2,438
5,251
known but velocity indeterminate
Backups people, backups! Too often no one cares about backups until they are struck with something like this. There was an article, I think on NPR, a while back that chronicled the hoops people have to jump through in order to get rid of ransomware when they haven't practiced good backup strategy. There's a clock running and for someone who has never dealt with bitcoin before it can be challenging even if you want to pay the ransom.

Edit to add: here was the article I was thinking of, it was on RadioLab: http://www.radiolab.org/story/darkode/
 
Last edited:
  • Like
Reactions: sd70mac, t1meless1nf1n1t, pianophile and 1 other person
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom