Become a MacRumors Supporter for $25/year with no ads, private forums, and more!
  • Did you order new AirTags? We've opened a dedicated AirTags forum.

MacRumors

macrumors bot
Original poster
Apr 12, 2001
52,456
14,151



Over the weekend, the first instance of Mac ransomware was found in a malicious update to the Transmission BitTorrent client. Version 2.90 of Transmission downloaded from the Transmission website was infected with "KeRanger" ransomware.

"Ransomware" is a class of malware that encrypts a user's hard drive and files, demanding money to decrypt it. In this case, KeRanger would have required Mac users to shell out a bitcoin for decryption, equivalent to approximately $400.

transmission-29.png

The developers behind Transmission have shared some additional details on the attack with Reuters, giving us some insight into how it occurred. The server that delivers the Transmission software to customers was breached in a cyber attack, allowing the KeRanger malware to be added to the disk-image of its software.
Transmission representative John Clay told Reuters via email that the ransomware was added to disk-image of its software after the project's server was compromised in a cyber attack.

"We're not commenting on the avenue of attack, other than to say that it was our main server that was compromised," he said. "The normal disk image (was) replaced by the compromised one."
During the time that the malware-infected version of Transmission was available, it was downloaded approximately 6,500 times before the vulnerability was discovered. Security on the server has since been increased, ensuring a similar attack can't occur a second time.

On Sunday, Transmission's developers released software updates to block the malicious software and to remove it from the Macs of users who had unwittingly installed the malicious version. Apple also updated its software protections to keep the malware from affecting Mac users and to prevent the bad version from being installed on additional machines.

Customers who have downloaded the Transmission BitTorrent client should make sure they have updated the software to version 2.92, which will remove the malware from infected computers. Additional details on how to determine if you have the malware installed are available through Palo Alto Networks.

Article Link: Transmission Malware Transmitted Through Server Hack, Downloaded 6,500 Times
 

rkieru

macrumors member
Jun 10, 2015
64
87
I wonder how the developers will handle the first case of a user's system being compromised. Would the developers be considered at fault as it was their servers and their website that allowed the download, or would the blame fall to the user for installing via a website instead of through the App Store?
 
  • Like
Reactions: thirdeyeopen666
Comment

manu chao

macrumors 604
Jul 30, 2003
7,104
2,911
I've always said that (almost) all OS level precautions are for nought if somebody hacks into a software vendor's servers, in particular if not only the download server is hacked but also the one holding the signing key. Certainly, if somebody can hack into a software maker's server, they might also be able to hack into your computer directly. However the payoff is much larger if you can infect shipping software as you reach many more people. The flip side is that detection is likely also much faster (compared to hacking a target's individual computer).
 
Comment

Glideslope

macrumors 604
Dec 7, 2007
6,829
4,116
The Adirondacks.
I wonder how the developers will handle the first case of a user's system being compromised. Would the developers be considered at fault as it was their servers and their website that allowed the download, or would the blame fall to the user for installing via a website instead of through the App Store?

Most likely the NSA. Plant the Malware, end up with millions of encrypted drives. Then make an analogy that this is what Apple is doing to the world. :apple:
 
Comment

pat500000

Suspended
Jun 3, 2015
8,523
7,513
Uggh.......UGGHHH........UGGGGGGGHHHHHHHH.

Why attack transmission? Let them be! Transmission came to this world in PEACE.
Mac changed dramatically over the years. I wish apple wasn't so popular...so that crap like this rarely occurs.

"That ain't cool, fool!" - pink panther.
 
Comment

manu chao

macrumors 604
Jul 30, 2003
7,104
2,911
I wonder how the developers will handle the first case of a user's system being compromised. Would the developers be considered at fault as it was their servers and their website that allowed the download, or would the blame fall to the user for installing via a website instead of through the App Store?
There is no legal requirement to restrict your software sources to a managed app store. And if you read through the legalese of any software you install, they almost always claim that the vendor cannot be held responsible for any potential damage whatsoever. In fact, one might conclude from all the disclaimers that the software is not fit for any purpose.
 
  • Like
Reactions: 997440
Comment

zorinlynx

macrumors 604
May 31, 2007
6,514
10,709
Florida, USA
It'd be nice if the Transmission developers would explain how their site got compromised.

Still no word from them at all. We need a statement from them to show how this happened and the steps they are taking to prevent it from happening again, otherwise all trust in this developer is pretty much gone.
 
Comment

benjitek

macrumors 6502a
Sep 23, 2012
863
452
I of course updated, but was relieved to learn that if you used the app's autoupdate feature, you weren't effected. If you downloaded and did a fresh install, or downloaded and installed over an existing install -- that's who got it...
 
Comment

foobarbaz

macrumors 6502a
Nov 29, 2007
602
795
"We're not commenting on the avenue of attack, other than to say that it was our main server that was compromised,"

Translation: It was so laughably easy to compromise our server that revealing it would be too embarrassing. Nobody would trust any of our software ever again.
 
  • Like
Reactions: jw2002 and Crambie
Comment

benjitek

macrumors 6502a
Sep 23, 2012
863
452
It'd be nice if the Transmission developers would explain how their site got compromised.

Still no word from them at all. We need a statement from them to show how this happened and the steps they are taking to prevent it from happening again, otherwise all trust in this developer is pretty much gone.
It's an open source project, and they're probably scrambling to get rid of it, figure out how it got there, before they make a public statement. First fix was a ransomware free version, and the 2nd included detection and removal of the ransomware. So far, that's pretty darn good ;)
 
Comment

rkieru

macrumors member
Jun 10, 2015
64
87
Still no word from them at all. We need a statement from them to show how this happened and the steps they are taking to prevent it from happening again, otherwise all trust in this developer is pretty much gone.

Assuming their reason for not commenting isn't because of sheer incompetence (as foobarbaz suggested) ... there are pretty valid reasons not to go into details about the nature of the attack.
  • The technical explanation would benefit few users
  • It provides more details about the server or how their security operates; which may provide greater information to people seeking to compromise the Transmission servers, or worse, compromise another similarly-structured server.
 
Comment

leftynaut

macrumors member
Nov 10, 2009
66
85
Does anyone have any recommendation on how to prepare for a ransomware attack? Let's say hypothetically I'm infected, aside from full backups, what other steps can I take? If I keep most of my important files on Dropbox, should I be okay?
 
Comment

sdz

macrumors 6502a
May 28, 2014
811
878
Europe/Germany
You listen Apple? This would not happen if you made it possible for Torrent Client authors to use your App Stores...
 
Comment

MentalFloss

macrumors 65816
Mar 14, 2012
1,018
840
There is no legal requirement to restrict your software sources to a managed app store. And if you read through the legalese of any software you install, they almost always claim that the vendor cannot be held responsible for any potential damage whatsoever. In fact, one might conclude from all the disclaimers that the software is not fit for any purpose.
The fact that something is stated in the disclaimers and the end-user license agreement does not automatically make it legally valid.
 
Comment

gsmornot

macrumors 68040
Sep 29, 2014
3,337
3,087
I almost downloaded this app based on a recent update news story. It said it had been a while since this was last updated and made me think I might like to try it. Good thing I had to travel and forgot about it until this story reminded me again. Whew, that was close. Ha.
 
  • Like
Reactions: Goatllama
Comment

manu chao

macrumors 604
Jul 30, 2003
7,104
2,911
The fact that something is stated in the disclaimers and the end-user license agreement does not automatically make it legally valid.
No, courts can invalidate any clauses they consider illegal. But we need a court case to have anything to go on and extrapolating from individual court cases can be rather risky, in particular for rulings from lower courts.
[doublepost=1457389059][/doublepost]
Guess this is why a restricted sandbox for each app is not such a bad idea...
Indeed, the tricky thing is to create flexible-enough sandboxing rules that as many apps as possible can abide by them without making them too flexible such that they allow 'malware' to sneak through them.
 
Comment

benjitek

macrumors 6502a
Sep 23, 2012
863
452
Does anyone have any recommendation on how to prepare for a ransomware attack? Let's say hypothetically I'm infected, aside from full backups, what other steps can I take? If I keep most of my important files on Dropbox, should I be okay?
If you applied the most recent update, you're OK.
 
Comment

oneMadRssn

macrumors 603
Sep 8, 2011
5,498
12,746
Europe
Does anyone have any recommendation on how to prepare for a ransomware attack? Let's say hypothetically I'm infected, aside from full backups, what other steps can I take? If I keep most of my important files on Dropbox, should I be okay?

Not sure why you're asking for something aside from full backups - that is the clear answer. And not just full backups, but disconnected full backups are important as ransomwear often tries to compromise backups and network drives too.
 
  • Like
Reactions: ignatius345
Comment
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.