1456
1457

SecurityTransmission 2.90 may be infected. (self.apple)

supermarketgangbang が 投稿

Just got this message when opening Transmission.

Update: It looks like the general consensus is users who updated within the app weren't affected, but those who downloaded from the website may be.

上位 200 件のコメント全て表示する 360
並べ替え:
ベスト
トップ新着論争中古い順Q&A

[–]falcon413 82ポイント83ポイント  (26子コメント)

Just got the message right now too. There was no strange process running in my computer. I'm wondering whether the infected version was distributed via update or direct download.

edit So I was looking through the Transmission forums and there is one post related to the malware with only four replies. However, those reporting strange behavior had downloaded 2.90 directly from the site and not updated through the app.

[–]levijohnson1 13ポイント14ポイント  (20子コメント)

checked it too and no strange process is running.

[–]PackerBoy 3ポイント4ポイント  (13子コメント)

how do I check if a strange process is running?

[–]KyleCardoza 7ポイント8ポイント  (12子コメント)

Open up Activity Monitor, go to View->All Processes, and look in the list in the main window for "kernel_service".

[–]whosingsthis 8ポイント9ポイント  (9子コメント)

I only see Kernel_task and KernelEventAgent when I search for Kernel

[–]Eruanno 4ポイント5ポイント  (6子コメント)

Me too! I've only been using the in-app update though so it should be fine. I hope. If it all goes to shit I have time machine backups to restore from, though!

[–]arrabiatto 8ポイント9ポイント  (4子コメント)

Unplug your time machine backups for now just in case. The security researchers found that it will try to encrypt Time Machine backups too.

[–]Glarseceiling 0ポイント1ポイント  (0子コメント)

No! That's the thing with this RansomWare, it'll encrypt your time machine backups rendering them unusable!

コメントをもっと表示する (2 返事)

    [–]TruelyChris 4ポイント5ポイント  (0子コメント)

    I also suggest the following from Palo Alto Networks:

    1. Using either Terminal or Finder, check whether /Applications/Transmission.app/Contents/Resources/ General.rtf or /Volumes/Transmission/Transmission.app/Contents/Resources/ General.rtf exist. If any of these exist, the Transmission application is infected and we suggest deleting this version of Transmission.
    2. Using “Activity Monitor” preinstalled in OS X, check whether any process named “kernel_service” is running. If so, double check the process, choose the “Open Files and Ports” and check whether there is a file name like “/Users/<username>/Library/kernel_service” (Figure 12). If so, the process is KeRanger’s main process. We suggest terminating it with “Quit -> Force Quit”.
    3. After these steps, we also recommend users check whether the files “.kernel_pid”, “.kernel_time”, “.kernel_complete” or “kernel_service” existing in ~/Library directory. If so, you should delete them.

    [–]PackerBoy 0ポイント1ポイント  (0子コメント)

    thanks!

    [–][削除されました]  (5子コメント)

    [deleted]

      [–]rafgas 6ポイント7ポイント  (1子コメント)

      Confirmation bias. I feel bad, but I had to comment.

      [–]flybypost 2ポイント3ポイント  (2子コメント)

      I checked through and couldn't find kernel_service.

      Me too, the only difference was that 2.90 kept crashing after each successful download.

      [–]caesurachris1 0ポイント1ポイント  (1子コメント)

      I'm pretty sure that I'm using the latest transmission version, and nothing out of the ordinary. But vlc player crashes every time I open it.

      [–]celibidaque 8ポイント9ポイント  (0子コメント)

      However, those reporting strange behavior had downloaded 2.90 directly from the site and not updated through the app.

      Phew...

      [–]ebikenx 3ポイント4ポイント  (3子コメント)

      I updated through direct download and it doesn't look like I'm affected. I don't have kernel_services running here.

      So, it's possible that whatever happened on their end, happened after I downloaded it. I think it was thursday or friday.

      [–]falcon413 2ポイント3ポイント  (1子コメント)

      So, it's possible that whatever happened on their end, happened after I downloaded it. I think it was thursday or friday.

      It's possible indeed. Someone in the forum thread mentioned a difference between the link starting with http:// and the one starting with https://. The attacker might've made one of the two redirect to the infected download, so perhaps not everyone got a compromised direct download.

      /u/wosmo commented on one of my other replies and provided a link to an article that goes more in-depth about this specific case. I checked the 2.90 bundle in one of my backups to make sure the specific files were (or were not) there and found it was clean.

      [–]Boejgen 0ポイント1ポイント  (0子コメント)

      That was supposedly a function of the forum itself, and how it displays links. The infected file was served from the official website, but it's possible someone could have downloaded and updated successfully through direct download before the real update was replaced by the infected one.

      [–]meeper88 2ポイント3ポイント  (0子コメント)

      If you want to be safe, Transmission has now released 2.92, which supposedly removes the infection.

      [–]squeezycheeseypeas 95ポイント96ポイント  (2子コメント)

      Thanks for the heads up, much appreciated

      [–]trai_dep 36ポイント37ポイント  (0子コメント)

      If I might hijack your comment to raise a point/plea to fellow Apple and Transmission fans. :)

      It's unclear, but it is increasingly looking as through it wasn't the Transmission App or the updating process that was compromised, but their web site. Then someone put a compromised version out which some people downloaded from the site, that was signed by a different developer's Certification, one apparently long-abandoned.

      Transmission is largely a volunteer effort and they do fantastic work, and have done so, for years. They probably have day jobs, which is why Transmission isn't state-of-the-art to the most recent security updates, perhaps for their Application, perhaps for their site (a whole other area of expertise requiring a different crew). And constant vigilance.

      I see a couple scattered comments suggesting folks abandon Transmission. If these developers who've worked on our behalf were instead supported however you can, but $$$ is great!, then they'd have the ability to both tend to these needs and… Eat. Eating is fun!

      So rather than consider this a reason to abandon Transmission and their excellent team, instead consider it a call to arms to support them, so they can continue to do the conscientious work they've done for years, only to also be able to tighten up their website and App security.

      Thanks!

      [–]supermarketgangbang[S] 40ポイント41ポイント  (0子コメント)

      Gotta look out for my fellow  friends!

      [–]maniacdepressive 40ポイント41ポイント  (4子コメント)

      I updated through the app directly and have no kernel_service process. I'm guessing their website was hacked and the direct download link was compromised.

      [–]savoytruffle 23ポイント24ポイント  (1子コメント)

      Claud Xiao at Palo Alto Networks, which discovered the malware, just tweeted there's an automatic 2.92 update now that tries to help remove KeRanger.

      https://twitter.com/claud_xiao/status/706579264036950016

      [–]TweetsInCommentsBot 3ポイント4ポイント  (0子コメント)

      @claud_xiao

      2016-03-06 20:36 UTC

      #Transmission just pushed 2.92 update that includes code to detect and to remove the #KeRanger ransomware. Update it before Monday 11:00am.

      This message was created by a bot

      [Contact creator][Source code]

      [–]i_spot_ads 34ポイント35ポイント  (5子コメント)

      For those of you who are infected, please, isolate the executable and send it me for inspection, (can't promise anything but I want to look into it)

      upload it here: http://cloud.vatsaev.com/data/public/kernel_service

      [–]CrystalSkull 11ポイント12ポイント  (0子コメント)

      Can't if it's infected, but they have the download for 2.90 still available if you check the previous releases page. Here's the link for you, https://download.transmissionbt.com/files/transmission-2.90.tar.xz

      Edit: Samples can be found here: https://twitter.com/claud_xiao/status/706563279355645953

      [–][削除されました]  (1子コメント)

      [deleted]

        [–]TweetsInCommentsBot 0ポイント1ポイント  (0子コメント)

        @claud_xiao

        2016-03-06 19:33 UTC

        Samples of the OSX Ransomware #KeRanger for your research, detection and prevention: https://paloaltonetworks.box.com/KeRangerSamples (password: KeRanger)

        This message was created by a bot

        [Contact creator][Source code]

        コメントをもっと表示する (2 返事)

          [–]antoniocesarm 178ポイント179ポイント  (62子コメント)

          J-Christ, I got the popup to update to 2.90 yesterday I think, and I am quite lazy so I chose not to update then. Luckily I'm still on 2.84.

          If you guys want to check whether you're on 2.90 or not without opening the app, just go to the Applications folder, select Transmission and press the space bar. Opening an infected app may not be a very smart idea.

          MORE INFO REGARDING BACKUPS, FROM /u/wosmo! Click to read.

          sorry for hijacking my own comment

          Please read this for your own safety.

          According to this user (thank you /u/wosmo!) the malware embedded in Transmission 2.90, OSX.KeRanger.A, is ransomware - one of the first ramsomwares, if not the first, to affect a Mac!

          More specifically, it will encrypt ALL of your data and "kidnap" it 3 days after infection (Monday to most users), demanding that you pay a ransom to have it back - potentially/certainly bitcoin, which is quite hard to track. Backup everything you have ASAP, run MBAM on your Mac and get rid of that ASAP or you'll either lose everything on your computer or suffer financial damage.

          To be honest, that makes me believe the Transmission team may have received compensation and/or some kind of incentive to do that. They inject it there, some people don't see it coming, are successfully targeted and a part of the profits goes to the team. AFAIK as I know that piece of malware shows no worm behavior, which makes me think someone injected it there on purpose. I'm deleting Transmission from my MacBook, even tho I am on 2.84, and I recommend you do the same. That software is simply not trustable anymore.

          more info here, in French

          Two versions of the software developed on March 4 download are infected, reports Palo Alto Threat Intelligence. Three days after the installation of Transmission, the malware will connect to a command and control server (C2) via the Tor network. It will then encrypt certain files on the Mac, and then ask the victim to pay 1 bitcoin - € 375 - to send the decryption key.

          The files that it tries to encrypt are many - more than 300 different types, some of which are here:

          • Documents: .doc, .docx, .docm, .dot, .dotm, .ppt, .pptx, .pptm, .pot, .potx, .potm, .pps, .ppsm, .ppsx, .xls, .xlsx, .xlsm, .xlt, .xltm, .xltx, .txt, .csv, .rtf, tex
          • Images: .jpg, .jpeg,
          • Audio and video: .mp3, .mp4, .avi, .mpg, .wav, .flac
          • Archives: .zip, .rar, tar, gzip.
          • Source Code: cpp, .asp, .csh, .class, .java, .lua
          • Database: .db, .sql
          • Email: .eml
          • Certificate: .pem

          How to check the integrity of your Mac

          To check if you have downloaded a compromised version of the software, go to the Utilities folder in your Applications and launch the Activity Monitor. In the search, enter:

          kernel_service

          If you find this process, click the "i" button in the window of the Activity Monitor, go to File, "Open Ports" (?) and search for:

          Users//Library/kernel_service

          If you find this, force-quit it and update Transmission. That is KeRanger, which you've eliminated by force-quitting and crushing the compromised version of Transmission.

          More info in English here.

          [–]falcon413 56ポイント57ポイント  (24子コメント)

          Seems updating through the app (if successful) was fine. Someone in the forums had issues updating through the app and decided to download directly from the website. It was then that they noticed the infection. I updated through the app without issues and didn't notice anything strange with the app or my computer. I hope the transmission team explains it more in-depth soon.

          [–]fishbert 33ポイント34ポイント  (2子コメント)

          Someone in the forums had issues updating through the app...

          That issue was Transmission refused to update due to a bad signature ... so going to the website to download was, in effect, circumventing built-in protections against this sort of thing. Hopefully it serves as a reminder to all of us not to ignore red flags in the future.

          [–]falcon413 6ポイント7ポイント  (1子コメント)

          That issue was Transmission refused to update due to a bad signature ... so going to the website to download was, in effect, circumventing built-in protections against this sort of thing. Hopefully it serves as a reminder to all of us not to ignore red flags in the future.

          Agreed. What I find strange, though, is that some of us had no issues updating through the app itself.

          [–]fishbert 17ポイント18ポイント  (0子コメント)

          Seems likely the malicious build was only out there for a certain period of time.

          [–][削除されました]  (9子コメント)

          [deleted]

            [–]falcon413 16ポイント17ポイント  (8子コメント)

            I agree. It definitely shakes trust on the app, but I'll keep using it for now. They got it fixed fairly fast from what I can see, but I'm still really worried as to how it got there in the first place.

            I really want the team to give us an update as to how it happened. It honestly sounds similar to the Linux Mint mess of a few weeks back. Either way, transparency is important. I hope they update soon with an explanation or something.

            (love your username, btw)

            [–][削除されました]  (7子コメント)

            [deleted]

              [–]falcon413 6ポイント7ポイント  (6子コメント)

              I'm hesitating to empty the bin now since it seems it was the downloaded build on the site that was infected and I don't want to lose my copy of the app-updated build.

              I updated in-app to 2.91 earlier today and the current build I'm running without issues is 2.91 (14711), if it gives you any more peace of mind

              Not that they owe me anything but I hope for my own peace of mind they will have a solid answer as to how this happened and how it will be prevented in the future.

              I actually think it goes beyond owing anything to the end-user. We, the users, trust the devs with their app to run on our system. On occasion we give some apps a lot of power to do what they do and the most responsible thing for devs to do is to keep these apps secure. If the app is compromised somehow, the most responsible thing is to be transparent about it, I think, and let the users know not only that they are in risk, but of what specifically.

              Transmission (and any other BT client) is, to me, a serious case because it's an open door to the internet. Usually I control what I download, but if the client is compromised I'd like to know what else it could potentially download to my computer unbeknownst to me and potential effects.

              This is sparks a bigger change in my mind about how much I appreciate the confidence of iOS's security and it's starting to make OS X feel more and more like a dated mess.

              I also appreciate iOS's security a ton but I wouldn't go so far as to say OS X is a mess in the sense. The people that reported the malware in the forums found out about it because OS X refused to run the app after finding it had malware. OS X's recommended course of action was to dispose of the application, so I guess that's actually pretty good.

              Fuck it I guess there's only one choice; Build an rtorrent home seedbox and just get it all outta my personal space. I've been thinking about it for a while I guess this is the impetus.

              I've been thinking about this for a while also. Besides it being somewhat more secure, I think it's also way more convenient. This episode will definitely push me to do this sooner rather than later.

              (oh and thank you, I have certainly enjoyed it but I'm starting to feel the weight of some history on this account so if I delete it soon please remember it when it's gone!)

              (embrace the history! but either way you go, I shall remember it well. CRTs really did nothing wrong.)

              [–]antoniocesarm 1ポイント2ポイント  (0子コメント)

              I actually think it goes beyond owing anything to the end-user. We, the users, trust the devs with their app to run on our system. On occasion we give some apps a lot of power to do what they do and the most responsible thing for devs to do is to keep these apps secure. If the app is compromised somehow, the most responsible thing is to be transparent about it, I think, and let the users know not only that they are in risk, but of what specifically.

              Agreed.

              [–]arynx 0ポイント1ポイント  (3子コメント)

              Doing this exact thing on a Raspberry Pi 2. It's been great. You can even use Internet Connection Sharing to let it piggyback off your Mac's internet over Ethernet.

              I have one that sits below my iMac and do similar since it's connected to my router over wifi.

              [–]mattbxd 0ポイント1ポイント  (2子コメント)

              I've attempted this but it would seem the RPi2 would impede speeds too much. The USB and ethernet port share the same bus. What kind of speeds do you get?

              [–]tibialsyndesmosis 2ポイント3ポイント  (0子コメント)

              The PI should still be capable of close to 100Mbit through its shared bus. If nothing else you can leave it on all night since it barely used any power and finish that way.

              [–]arynx 1ポイント2ポイント  (0子コメント)

              I haven't checked in a while but I believe it was capped at my internet speed (25 Mbps). You may notice this effect more so with faster internet speeds.

              I have a RPi3 coming which may have this alleviated with the onboard wifi chip.

              The Pine64 is a good alternative as well but I haven't played with one to know if it suffers the same bus issue.

              コメントをもっと表示する (1 返事)

                [–]flip69 1ポイント2ポイント  (2子コメント)

                I updated via the app and my system eventually crashed.

                I'm only able to type this now because I was able to erase and reinstall a earlier backup (pre update) via time machine.

                I think the dates for this are wrong. My last time machine update seems to have been March 2nd. (Wednesday is when I suffered the crash)

                Is it possible that I was a early dry run to test their ransom ware?

                [–]I_EAT_POOP_AMA 1ポイント2ポイント  (1子コメント)

                Doesnt Transmission still host on Sourceforge? If so then thats obviously the cause (sice sourceforge been under fire recently for bundling adware/malware in hosted pre-compiled executables)

                That being said it should be perfectly safe to update via the application itself. If that doesnt work then i suggest not updating at all until this all gets sorted out

                [–]AdmAkbar_2016 1ポイント2ポイント  (5子コメント)

                Updated through the app in OS X 10.9 Hack. What happens, does the virus do? EDIT nevermind saw picture link.

                [–]propanetank 9ポイント10ポイント  (0子コメント)

                The link that /u/wosmo shared in his post says that v2.90 was signed with a different key than the one the developers use. The key was created on the 4th when the infected file was uploaded. This makes me to believe that someone hacked the website and replaced the legitimate file with the malicious one.

                [–]Its-Not-A-Trap 26ポイント27ポイント  (9子コメント)

                To be honest, that makes me believe the Transmission team may have received compensation and/or some kind of incentive to do that. They inject it there, some people don't see it coming, are successfully targeted and a part of the profits goes to the team. AFAIK as I know that piece of malware shows no worm behavior, which makes me think someone injected it there on purpose.

                That is a very bold claim.

                Edit: Huh....you delete your reply to me, but leave the contentious paragraph in the OP?

                [–]alotufo 5ポイント6ポイント  (3子コメント)

                Note that this may not be a reliable way to determine the version. I upgraded to 2.91 and when pressing the spacebar on the application, it still showed 2.90.

                Instead, right-click the Transmission application and select Get Info and check the version there as well.

                [–]antoniocesarm 2ポイント3ポイント  (0子コメント)

                Still 2.84 there luckily.

                [–]CannonBall7 1ポイント2ポイント  (0子コメント)

                Finder doesn't update application version numbers immediately; you may have to relaunch it for that.

                [–]pxtang 0ポイント1ポイント  (0子コメント)

                Cmd+I also is get info! For those out there who like keyboard shortcuts.

                [–]GreenBlueSeduce 4ポイント5ポイント  (2子コメント)

                Just to clarify, if I'm on 2.90 and "kernel_service" doesn't show up in activity feed, does that mean I'm pretty much in the clear? Thanks a lot for this post by the way.

                [–]antoniocesarm 3ポイント4ポイント  (1子コメント)

                Just to clarify, if I'm on 2.90 and "kernel_service" doesn't show up in activity feed, does that mean I'm pretty much in the clear?

                That is the general consensus until now, so yes. Did you install 2.90 from the site or directly from the Transmission website?

                Thanks a lot for this post by the way.

                Thank /u/wosmo, not me, hahaha. I'm just taking his word to other people's ears too :s

                [–]GreenBlueSeduce 3ポイント4ポイント  (0子コメント)

                I updated directly through the app when prompted a couple days ago, so I guess that's the better option of the two regarding previous posts. And well thanks to everyone jumping on this to spread the word and keep other users safe from the malware!

                [–]wosmo 2ポイント3ポイント  (3子コメント)

                One thing you might want to add - if you're depending on backups, disconnect them from your system until this is over. The malware does target /Volumes, so if you leave them mounted, your backups get attacked too.

                Even if you backup now, and your backup is also infected, it'll at least have your personal files still.

                Thanks for spelling it out and getting the message out there. I thought about it, but I've had a really long weekend, and was simply too lazy :)

                I gotta say though, personally I'd hold off pointing fingers until the dust's settled. I have to think that only infecting the dmg, and not the bundle Sparkle uses for updates, indicates there was some limit to what the attacker was able to access.

                That said, "delete it until the dust settles" is also pretty sane, I think. "better safe than sorry".

                [–]antoniocesarm 2ポイント3ポイント  (0子コメント)

                Added a link to this comment to mine!

                I have to think that only infecting the dmg, and not the bundle Sparkle uses for updates, indicates there was some limit to what the attacker was able to access.

                Honestly I do hope it was not the T-team... but I completely agree with your last sentence.

                "better safe than sorry"

                Once again, thank you for helping the community so much!

                [–]magneto_ms 1ポイント2ポイント  (1子コメント)

                Question: Assume I was infected and updated to 2.92 which installed a clean version. Meanwhile Time Machine had taken a backup of my system during the period it had the 2.90 malware. Is there a risk of this Time Machine backup spreading the infection back or coming to bite me in the ass in the future?

                [–]wosmo 1ポイント2ポイント  (0子コメント)

                In theory, yes. But there's enough if's that it's not particularly realistic.

                You'd have to roll back the whole OS, plus your ~/Library/, to a point after you'd installed the infected version, but before apple had updated xprotect. So, late Friday / early Saturday.

                You'd have to prevent osx updating its xprotect definitions. (but without going offline, because the payload does require the internet).

                And then you'd need to open transmission, and ignore any errors you receive about the codesign being bad. (it's usually signed so you don't get that annoying box asking if you really want to open it. The infected version is signed by a different cert which has already been revoked).

                So I do think it's possible. But as long as timemachine has made at least one snapshot since xprotect was updated on saturday, I do think it's very improbable. You'd have to want to. And I can't promise I've thought of everything that'd stand in your way.

                [–]LarcusMywood 2ポイント3ポイント  (1子コメント)

                I don't have kernel_service running, and I've got Transmission 2.9. Does that mean I don't have a compromised version, or could the malware just not be running or something?

                [–]antoniocesarm 3ポイント4ポイント  (0子コメント)

                I don't have kernel_service running, and I've got Transmission 2.9.

                You probably updated directly from a older version, inside the app, right? If so, you're probably good to go.

                [–]Stoppels 1ポイント2ポイント  (0子コメント)

                QuickLook does not inform me of Transmission's version. The Info-window (⌘ + I), however, does. However, neither detours are necessary if you just use Finder's Columns view (⌘ + 3).

                [–]antoniocesarm 1ポイント2ポイント  (0子コメント)

                I should say that for now a reliable replacement to Transmission could be Deluge. It looks and feels terrible and dated, but has no adware bundled like some versions of BitTorrent had and is overall very clean compared to most of its competitors.

                [–]Kichigai 0ポイント1ポイント  (0子コメント)

                You can also do a Get Info on it.

                [–]LikelyPoopingNow 0ポイント1ポイント  (1子コメント)

                How do I safely delete it (Im on 2.84 too)? Just drag and drop to trash?

                What do you recommend as the next best application for torrents now then? uTorrent?

                [–]antoniocesarm 1ポイント2ポイント  (0子コメント)

                How do I safely delete it (Im on 2.84 too)? Just drag and drop to trash?

                As far as I know, yes. Preferably empty the trash after doing so.

                What do you recommend as the next best application for torrents now then? uTorrent?

                I'll be using Deluge from now on.

                Hope I helped :)

                [–]Mastacon 0ポイント1ポイント  (3子コメント)

                Noob here.. So I had that process running and I force quit it. I got the new update. Am I good?

                [–]antoniocesarm 2ポイント3ポイント  (2子コメント)

                So I had that process running and I force quit it.

                Congratulations, you just saved yourself your files and/or 375 euros.

                I got the new update. Am I good?

                Evidence to date is not 100% conclusive, but most probably yes. I would delete Transmission if I were you tho. And just for safety restart your computer and see if it (the process) shows up again on startup.

                [–]Mastacon 0ポイント1ポイント  (1子コメント)

                Thanks and btw 2.92 just came out and says it removes it (which I may have done when I force quit it)

                [–]antoniocesarm 1ポイント2ポイント  (0子コメント)

                Force-quitting does not delete it, it just stops it from running. In the end, you still need to get rid of the file - which newer version seem to do.

                コメントをもっと表示する (4 返事)

                  [–]-iNfluence 59ポイント60ポイント  (15子コメント)

                  What if the 2.90 d/l was clean, and this new 2.91 is the real infected build haha

                  [–]meeper88 5ポイント6ポイント  (4子コメント)

                  2.92 is now out, supposedly removes the infection cleanly.

                  [–]spoonyfork 14ポイント15ポイント  (2子コメント)

                  Exactly what I was thinking. Neither should be considered safe.

                  [–]daktaToolbox Wizard[M] 29ポイント30ポイント  (0子コメント)

                  Palo Alto Networks' security research team has confirmed that this malware was only present on 2.90 installer bundles present on the Transmission site for just over a day starting on the 4th. The malicious installed was cryptographically signed by a different person than all other Transmission releases.

                  There is no reason to believe that any other versions, particularly the security patched version 2.92, are infected. You should install v2.92 immediately.

                  [–]14366599109263810408 1ポイント2ポイント  (6子コメント)

                  Then why would this message appear in the 2.90 build? What you're saying makes no sense, unless the attacker infected BOTH 2.90 and 2.91.

                  [–]-iNfluence 2ポイント3ポイント  (5子コメント)

                  I was half kidding haha. But ostensibly it's possible that both builds are infected and the 2.91 build carries an additional payload, or a fix for an error in the previous payload.

                  [–]daktaToolbox Wizard[M] 6ポイント7ポイント  (4子コメント)

                  According to the developers and security researchers, the latest release 2.92 includes a security patch to remove the malicious software potentially installed by the compromised 2.90 Mac installer package.

                  [–]-iNfluence 0ポイント1ポイント  (3子コメント)

                  Can you explain how the in-app update build was clean but somehow there existed a different infected 2.91 build? Was it a totally separate dmg that the app pulled versus the update webpage?

                  [–]daktaToolbox Wizard 7ポイント8ポイント  (2子コメント)

                  The compromised software appears to have been the installation disk image (DMG) available to download for first-time users. The automatic installation process doesn't download the same DMG, since that would require the updater to mount the DMG on the filesystem, a highly visible operation which doesn't occur during updates. Some weird software like Google Earth actually does use a hidden DMG mount during updates, but that is an extremely uncommon procedure and one which was not used by the automatic update library that Transmission used.

                  According to security researchers, it is likely that the Transmission website was compromised allowing the attacker to upload the malicious version of the installation DMG. It seems that they did not touch the automatic update payload, which may have been protected with additional measures (such as a checksum). Since I am not a security researcher, I don't know if any such measures were taken. Depending on the structure of the Transmission website, it's possible that the attacker simply did not have access to the automatic update payloads, or to their checksums. If the update payloads are cryptographically signed, and their signature must match that of the originally installed software (a straightforward security measure), then the attacker would not have been able to infect the update payloads without compromising the account of the developer who signs Transmission Mac releases (which they did not, they used some other developer account to sign the malicious installer DMG).

                  [–]-iNfluence 0ポイント1ポイント  (0子コメント)

                  Damn great write up man, thank you.

                  [–]Boejgen 0ポイント1ポイント  (0子コメント)

                  Thanks for this! Just what I was looking for to ease my mind a bit.

                  [–]FullFrontalNoodly 8ポイント9ポイント  (19子コメント)

                  Can someone post an analysis of what exactly what happened here?

                  [–]Random 8ポイント9ポイント  (4子コメント)

                  This article:

                  http://ca.reuters.com/article/technologyNews/idCAKCN0W80VX

                  Says it is a 3-day-delay ransomware

                  [–]crackanape 11ポイント12ポイント  (3子コメント)

                  In that case, everyone make sure to back up your shit NOW.

                  [–]LikelyPoopingNow 4ポイント5ポイント  (1子コメント)

                  Is TimeMachine ok for this? sorry total noob

                  [–]gellis12 4ポイント5ポイント  (0子コメント)

                  Yes, with a catch.

                  Make sure that once your TM backup is finished, you disconnect your backup disk. The malware goes out of its way to target time machine backups to prevent victims from being able to simply load a backup to save their stuff.

                  Also, if you update Transmission to 2.92, it'll remove the ransomware from your system completely. If you're infected, I still recommend making a backup just to be safe.

                  [–]hellacat 2ポイント3ポイント  (0子コメント)

                  Yeah definitely. And then detach your backup disk from the computer in case it manages to encrypt that too if/when the encryption starts.

                  [–]bort_sampson 6ポイント7ポイント  (2子コメント)

                  Holy shit, that's very troubling!

                  Transmission was always my go-to BT client because of the lack of ads (unlike, say, uTorrent).

                  Is there another way to scrub your mac to make sure this kind of shit isn't lingering?

                  [–]Thundarrx 7ポイント8ポイント  (3子コメント)

                  I downloaded 2.90 from the site. Let's see.

                  # sudo ps -ef | grep -i kernel   
(nothing like this is listed)

# sudo open /Applications/Utilities/Activity\ Monitor.app
(Nothing)

# sudo lsof | grep kernel_
(nada)

# openssl sha1 Transmission-2.90.dmg 
 SHA1(Transmission-2.90.dmg)= f54e7590e8d69ea86edc24564048d17de1fa7f96

                  So, it looks like there was a problem with one specific host. If you have the 2.90 with the real SHA1 you might want to keep it in case their server was infected and 2.91 is also toast.

                  [–]Maxxist 0ポイント1ポイント  (1子コメント)

                  I used chrome and use https everywhere extension to download. I'm wondering if this helped download the proper version... I too downloaded through the site and dont have the offending process running.

                  [–]damog 2ポイント3ポイント  (0子コメント)

                  This is not a man in the middle attack so HTTPS or not, you wouldn't have been safe.

                  コメントをもっと表示する (1 返事)

                    [–]gellis12 5ポイント6ポイント  (0子コメント)

                    Transmission 2.92 has been released, which completely purges KeRanger from your system.

                    [–]osaka__sun 18ポイント19ポイント  (18子コメント)

                    Only kernal_service? Kernal_task is OK, correct?

                    Thanks for posting this.

                    [–]i_spot_ads 34ポイント35ポイント  (12子コメント)

                    Kernal_task is OK, correct?

                    Yes of course it is, lol don't delete it.

                    [–]gellis12 6ポイント7ポイント  (1子コメント)

                    If you have a process called Kernal_task, you have a big problem. If you just have kernel_task, you're fine.

                    [–]supermarketgangbang[S] 4ポイント5ポイント  (8子コメント)

                    What exactly is it? The kernel task that is.

                    [–]oonniioonn 31ポイント32ポイント  (7子コメント)

                    kernel_task is your actual OS kernel. It's literally the operating system.

                    [–]supermarketgangbang[S] 2ポイント3ポイント  (3子コメント)

                    I figured it was something important as you can't select it to quit it. Also I learned back in the days of the 90's iMac that deleting random files is not always smart.

                    [–]rspeed 10ポイント11ポイント  (0子コメント)

                    Even without knowing the process names, this is pretty standard for Unix:

                    PID 0 = kernel
                    PID 1 = init

                    Which essentially means that once the kernel is loaded, it kicks off a single process that initializes everything else. In the case of OS X, the init process is launchd, and everything spawns (directly or indirectly) from that.

                    コメントをもっと表示する (2 返事)

                      [–]gellis12 0ポイント1ポイント  (0子コメント)

                      Well, not quite. The kernel is what does all of the heavy lifting for the OS.

                      コメントをもっと表示する (2 返事)

                        [–]Slinkwyde 14ポイント15ポイント  (2子コメント)

                        Kernel, not kernal.

                        [–]KyleCardoza 3ポイント4ポイント  (0子コメント)

                        Glad I'm not the only one that annoys. "Kernal" is what runs in an old Commodore.

                        コメントをもっと表示する (1 返事)

                          [–]deadcow5 1ポイント2ポイント  (1子コメント)

                          Upvoting this for visibility. This was literally my first question when I checked Activity Monitor, even though I'm far from a noob.

                          [–]GhostalMedia 21ポイント22ポイント  (31子コメント)

                          How the fuck does this even happen? This makes me never want to use this app again.

                          [–]losh11 23ポイント24ポイント  (20子コメント)

                          In the last couple of weeks there were exploits announced which basically allowed an attacker to redirect website links to another server.

                          That's like the most simplified explanation ever, but Linux Mint was also taken over in a similar method.

                          [–]saint_whatever 3ポイント4ポイント  (6子コメント)

                          In the last couple of weeks there were exploits announced which basically allowed an attacker to redirect website links to another server.

                          any links about this?

                          [–]strobezerde 1ポイント2ポイント  (0子コメント)

                          "The KeRanger application was signed with a valid Mac app development certificate"

                          コメントをもっと表示する (12 返事)

                            [–]FullFrontalNoodly 2ポイント3ポイント  (0子コメント)

                            At the present time, it appears as if the website hosting the official download was compromised.

                            [–]ads8888 2ポイント3ポイント  (2子コメント)

                            Don't blame the app or the creators, it's not a fair thing to do. It's like having your car robbed and blaming Ford for it...

                            コメントをもっと表示する (6 返事)

                              [–]murrayhenson 5ポイント6ポイント  (3子コメント)

                              Just checked with TaskExplorer and, post-upgrade to 2.91, it seems fine - no viruses detected. I didn't have kernel_service running beforehand.

                              If I recall correctly, I updated to 2.90 via Transmission's own automatic update service (and same for the 2.91).

                              [–]Techsupportvictim 4ポイント5ポイント  (0子コメント)

                              Same with me. In app update and no kernel_service before or after

                              [–]ebikenx 0ポイント1ポイント  (1子コメント)

                              Are the utilities on that guys site legit? I mean, obviously you will say yes since you referenced TaskExplorer. I've just never heard of his work and they look like good security apps to use.

                              [–]murrayhenson 2ポイント3ポイント  (0子コメント)

                              I've been using them for quite awhile and know that other folks particularly concerned with security use Objective See's stuff as well.

                              Most of the time when someone asks about securing MacOS X, everyone tells them to turn on FileVault and the firewall and not much else - I did quite a lot of research about hardening MacOS X before I came across Objective See's work, but once I did then I started seeing references elsewhere... just not really here on the Apple/Mac reddits.

                              [–]MortalKHANbat 6ポイント7ポイント  (0子コメント)

                              Transmission just pushed 2.92 update that includes code to detect and to remove the KeRanger ransomware

                              [–]4nis 4ポイント5ポイント  (0子コメント)

                              Here's guide about the infection http://pastebin.com/zMBbdyDH

                              [–]machei 5ポイント6ポイント  (1子コメント)

                              First off, thank goodness for Reddit. I'd have never known otherwise. Second, I found the kernel_service running on my Mac mini server, and I've gone through everything outlined to remove it. After a reboot, there's no sign it's running the kernel_service, and a search of the hard disk reveals no General.rtf file.

                              Does this mean that there's now nothing I need to worry about? i.e. this software lays dormant and does nothing at all until it proceeds to encrypt, and so having removed it all, I'm safe, or is there something it's done in the meantime that I need to now be concerned is going to come back and bite me in the ass about at some unknown time in the future?

                              [–]TheMacMan 11ポイント12ポイント  (7子コメント)

                              Mentioned this when 2.90 was released as people were using the vulnerable version of the updates engine in 2.84 to update but no one seemed concerned at the time.

                              [–]mantra2 7ポイント8ポイント  (0子コメント)

                              If it makes you feel better, I do recall seeing your post.

                              [–]daktaToolbox Wizard[M] 7ポイント8ポイント  (0子コメント)

                              The security flaw in Sparkle was an unsecured HTTP problem, which could have allowed a Man in the Middle attack to be brought off.

                              If this were the mode of attack, then the malware would only affect upgrading users. Security researchers found the malicious DMG present on the Transmission website, and current indications are that automatic update users were not impacted.

                              Further, man in the middle is not a viable attack vector for infecting man users. It is a distinctly network-specific security hole; to use it, you have to infect or spoof the network that your target is connected to. Clearly that is not what happened here.

                              So, you're not wrong about there being a security hole in Sparkle, but there is no way that hole was used in this attack. It's the wrong kind of hole completely, and it doesn't fit any of the evidence.

                              [–]tiltowaitt 2ポイント3ポイント  (3子コメント)

                              Talking about Sparkle? If so, then somewhat ironically, it seems like people who used the vulnerable updater are the ones who are safe.

                              [–]gellis12 1ポイント2ポイント  (2子コメント)

                              Sparkle was actually patched a few days weeks before all of this happened. It's not a weak point.

                              Edit: dates

                              [–]tiltowaitt 0ポイント1ポイント  (1子コメント)

                              I thought apps had to update to a new version of the Sparkle framework. Was it just a server-side issue?

                              [–]gellis12 0ポイント1ポイント  (0子コメント)

                              The vulnerability was related to Sparkle running Javascript, and was only relevant to programs that used an HTTP connection instead of HTTPS to serve updates. OS X 10.11 actually blocks you from updating apps over an HTTP connection, so if you're able to auto-update to something on El Capitan, it's safe.

                              [–]RobertAPetersen 7ポイント8ポイント  (0子コメント)

                              How to Protect Yourself

                              Users who have directly downloaded Transmission installer from official website after 11:00am PST, March 4, 2016 and before 7:00pm PST, March 5, 2016, may be been infected by KeRanger. If the Transmission installer was downloaded earlier or downloaded from any third party websites, we also suggest users perform the following security checks. Users of older versions of Transmission do not appear to be affected as of now.

                              We suggest users take the following steps to identify and remove KeRanger holds their files for ransom:

                              Using either Terminal or Finder, check whether /Applicaions/Transmission.app/Contents/Resources/ General.rtf or /Volumes/Transmission/Transmission.app/Contents/Resources/ General.rtf exist. If any of these exist, the Transmission application is infected and we suggest deleting this version of Transmission.

                              Using “Activity Monitor” preinstalled in OS X, check whether any process named “kernel_service” is running. If so, double check the process, choose the “Open Files and Ports” and check whether there is a file name like “/Users/<username>/Library/kernel_service” (Figure 12). If so, the process is KeRanger’s main process. We suggest terminating it with “Quit -> Force Quit”.

                              After these steps, we also recommend users check whether the files “.kernel_pid”, “.kernel_time”, “.kernel_complete” or “kernel_service” existing in ~/Library directory. If so, you should delete them.

                              Ensure you update to Transmission 2.92.

                              Malwarebytes for Mac is updated to scan for this ransomware as well:

                              https://www.malwarebytes.org/antimalware/mac/

                              In general even us Mac users should be running anti-virus/anti-malware as well.

                              I recommend either Avira:

                              http://www.avira.com/en/free-antivirus-mac

                              or Sophos:

                              http://www.sophos.com/products/free-tools/sophos-antivirus-for-mac-home-edition.aspx

                              Extra recommended step for me personally, install BlockBlock:

                              Malware installs itself persistently, to ensure it's automatically re-executed at reboot. BlockBlock continually monitors common persistence locations and displays an alert whenever a persistent component is added to the OS.

                              https://objective-see.com/products/blockblock.html

                              This issue with Transmission only appears to have been for those who manually downloaded Transmission recently, if you've been using auto update within the application you should be OK, but even then run scans anyway to err on the side of caution.

                              Write-up with further information:

                              http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/

                              [–]rcrell 3ポイント4ポイント  (0子コメント)

                              Shit, I just updated last night... Will have to check that

                              [–]ready_1_take_1 5ポイント6ポイント  (0子コメント)

                              Ars Technica just posted an article about this.

                              The KeRanger application was signed with a valid Mac app development certificate; therefore, it was able to bypass Apple’s Gatekeeper protection. If a user installs the infected apps, an embedded executable file is run on the system. KeRanger then waits for three days before connecting with command and control (C2) servers over the Tor anonymizer network. The malware then begins encrypting certain types of document and data files on the system. After completing the encryption process, KeRanger demands that victims pay one bitcoin (about $400) to a specific address to retrieve their files. Additionally, KeRanger appears to still be under active development and it seems the malware is also attempting to encrypt Time Machine backup files to prevent victims from recovering their back-up data.

                              Palo Alto Networks reported the ransomware issue to the Transmission Project and to Apple on March 4. Apple has since revoked the abused certificate and updated XProtect antivirus signature, and Transmission Project has removed the malicious installers from its website. Palo Alto Networks has also updated URL filtering and Threat Prevention to stop KeRanger from impacting systems.

                              Users who have directly downloaded Transmission installer from official website after 11:00am PST, March 4, 2016 and before 7:00pm PST, March 5, 2016, may be been infected by KeRanger. If the Transmission installer was downloaded earlier or downloaded from any third-party websites, we also suggest users perform the following security checks. Users of older versions of Transmission do not appear to be affected as of now.

                              [–]Mastacon 2ポイント3ポイント  (1子コメント)

                              I downloaded Transmission yesterday... saw the update today. Mine was infected.. followed the directions and deleted the file. Downloaded the update.

                              edit: I downloaded from their website.

                              [–]Maxxist 2ポイント3ポイント  (0子コメント)

                              I downloaded my copy through the website shortly after reinstalling osx my mac last week. I've used transmission a couple times since, but i don't see the offending process in activity monitor. I just downloaded 2.91 from their site and replaced it. the 2.90 dmg is still in my downloads folder. 200KB size difference between the two version. 2.90 is 5.3MB and 2.91 is 5.1MB

                              [–]schacks 2ポイント3ポイント  (0子コメント)

                              More info on the KeRanger malware. Origin, internal workings and howto remove:

                              http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/

                              [–]ares623 4ポイント5ポイント  (15子コメント)

                              What are alternatives for Transmission?

                              [–]clee290 5ポイント6ポイント  (5子コメント)

                              I use Qbittorrent.

                              [–]RedgeQc 0ポイント1ポイント  (1子コメント)

                              Deluge is great.

                              [–]Hindu_Wardrobe 0ポイント1ポイント  (0子コメント)

                              Deluge.

                              [–]tibialsyndesmosis 0ポイント1ポイント  (0子コメント)

                              I use qBT in a Windows VM that only had write access to a share. So if it gets infected it can ruin only the directory I give it and nothing else

                              [–]FoferJ 0ポイント1ポイント  (0子コメント)

                              Deluge has a dated UI, but works very well!

                              コメントをもっと表示する (4 返事)

                                [–]notnick 1ポイント2ポイント  (0子コメント)

                                I seem to be fine, I used the auto updater originally for 2.90, but updated to 2.91 just in case.

                                [–]snotbot3000 1ポイント2ポイント  (2子コメント)

                                I backed up my laptop today with 2.90 on it, any recommendations on what to do?

                                [–]thepotatochronicles 0ポイント1ポイント  (1子コメント)

                                Same here. I am worried about my backup...

                                [–]kyd3 0ポイント1ポイント  (0子コメント)

                                I suggest to follow the three steps in the article: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/

                                First check if your infected. If you are infected delete the mentioned files from your hard drive and also from your time machine backup using "Delete All Backups of [item name]"

                                [–]transthrow203 1ポイント2ポイント  (0子コメント)

                                I assume those running 2.03 (it's the latest recognised client 'my' site allows) aren't in anyway effected by this?

                                [–]TheRootsCrew 1ポイント2ポイント  (1子コメント)

                                Alternative Tracker app suggestions?

                                [–]pdmcmahon 1ポイント2ポイント  (0子コメント)

                                Haven't used Transmission in a while, got this when I launched it just now.

                                [–]CrazyEdward 1ポイント2ポイント  (0子コメント)

                                It's amazing how much more informative this thread is than the article I just read over at Ars.

                                Thanks!

                                [–]-HERO 1ポイント2ポイント  (1子コメント)

                                Sorry if this is a stupid question, but can it affect files in the Dropbox folder?

                                [–]ohrer 1ポイント2ポイント  (0子コメント)

                                Yes, even some ransomwares encrypt files located in shared folder on the local network.

                                [–]kinkypussy 2ポイント3ポイント  (5子コメント)

                                oh shii, i have that process running. What kind of malware is it?

                                [–]falcon413 11ポイント12ポイント  (0子コメント)

                                Make sure it's kernel_service (and not kernel_task) and kill it. Then uninstall or update Transmission to 2.91.

                                There's hardly any information on what the malware is or does. Right now we only know it's called OSX.KeRanger.A or something along those lines, but searches bring up nothing.

                                [–]eigenvectors 0ポイント1ポイント  (0子コメント)

                                Its ransomware

                                [–]Rudayb 0ポイント1ポイント  (2子コメント)

                                Do you remember if you downloaded in from an internet browser or did you update it in app?

                                [–]kinkypussy 0ポイント1ポイント  (1子コメント)

                                I downloaded it from transmissionbt.com.

                                [–]Rudayb 0ポイント1ポイント  (0子コメント)

                                Intersting. It appears to be the same case for everyone else who is infected.

                                [–]hampa9 2ポイント3ポイント  (1子コメント)

                                This is why sandboxing is a really good idea for most apps.

                                [–]binford2k 1ポイント2ポイント  (2子コメント)

                                Friday, though, my update in Transmission failed due to a wrong signature. I then proceeded to a download through the web page.

                                And that was your mistake. Lol.

                                [–]nishioka 3ポイント4ポイント  (0子コメント)

                                Yeah, I got that "improperly signed" error and noped out of the whole thing. There wasn't anything wrong with the version I was running anyway.

                                [–]drwert 1ポイント2ポイント  (0子コメント)

                                Yikes. You can add all the security measures in the world. It doesn't help when someone walks right around them and lets the bad guy in.

                                [–]_asm 3ポイント4ポイント  (5子コメント)

                                This is just speculation, but I think it might have been an attack on their HTTPS server, probably using this little devil: https://drownattack.com/

                                Which means just the folks that downloaded the app via their website may have been infected. The in-app update service doesn't seem to have been compromised.

                                [–]seventoes 1ポイント2ポイント  (2子コメント)

                                Drown allows private key recovery, not hosting a malicious binary on their servers. You could spoof being the correct website, but you can't actually get into the request path with drown alone.

                                [–]NewAccountFor2016 0ポイント1ポイント  (1子コメント)

                                Is it all the people who downloaded the app from the web might be infected, or only people who downloaded 2.90 from the web?

                                [–]amplitudeomega 0ポイント1ポイント  (0子コメント)

                                Just 2.90 from the web.

                                [–]TODO_getLife 1ポイント2ポイント  (2子コメント)

                                Probably shouldn't have direct downloaded Transmission at work then. Going to have to do some cleanup on monday!

                                [–]1N54N3M0D3 6ポイント7ポイント  (1子コメント)

                                that doesn't sound like a good idea anyway, honestly.

                                [–]TODO_getLife 2ポイント3ポイント  (0子コメント)

                                It's a shared building, so we all share the same wifi network, so a few of us download the things we want at work rather than at home because the speeds are crazy good.

                                [–]Zero_Waist 1ポイント2ポイント  (0子コメント)

                                Looks like it's ransomware

                                Apple users targeted in first known Mac ransomware campaign - Reuters https://apple.news/AOkHXx3zOSOmoKH4HsxnyTA

                                [–]TheMacMan 1ポイント2ポイント  (0子コメント)

                                Would be funny if 2.91. and 2.92 were just the same hacker using the publicity this story got to encourage more to install compromised versions.

                                [–]wuhkay 1ポイント2ポイント  (0子コメント)

                                Not even kidding, as much as I would like to think that this is random occurrence, I wouldn't be shocked if some money from the music or film industry was behind this. Infect the popular bit torrent client.

                                [–]bvhj 0ポイント1ポイント  (2子コメント)

                                I'm running 2.90 (updating to 2.91 now), but updated to 2.90 yesterday through the app. I don't see kernel_service in my activity monitor, but also don't see kernel_task which a few people have mentioned as being something which should be there, am I alright or is there anywhere else I should check to make sure.

                                [–]apxx 2ポイント3ポイント  (0子コメント)

                                The incident was isolated to users who downloaded the .dmg from their website. The in-app update would've failed due to a signature check (the infected App was signed by a different Apple dev certificate, not Transmission's).

                                You should be fine. I'm in the same boat as you and updated to 2.91/2.92 without issue.

                                [–]NewAccountFor2016 1ポイント2ポイント  (0子コメント)

                                Have you selected VIEW- ALL processes ?

                                [–]supercowrider 0ポイント1ポイント  (4子コメント)

                                Can I be infected if I just opened the app from the .dmg to check it?

                                [–]gorskiegangsta 0ポイント1ポイント  (0子コメント)

                                I updated from within the app. No kernel_service running or in system files. Will definitely recheck over the course of next weeks regardless.

                                [–]Maxxist 0ポイント1ポイント  (0子コメント)

                                Anyone have the md5 sum for the official non infected 2.90? Their site is having some problems right now.

                                [–]dat_pure_kid 0ポイント1ポイント  (0子コメント)

                                Those who updated through the web server, they can control the web page.

                                [–]odisseius 0ポイント1ポイント  (7子コメント)

                                Sooo if I'm still on 2.81 should I update ? delete ? do nothing ? I used to use µtorrent but after the they use you for mining bitcoins shenanigans switched to transmission, should I switch to something else ?

                                edit: word

                                [–]Maxxist 5ポイント6ポイント  (5子コメント)

                                I'm still a fan of transmission. Their transparency so far with this hack give me hope for their group.

                                [–]mantra2 3ポイント4ポイント  (4子コメント)

                                Where is the transparency? They've made almost no statement.

                                [–]Maxxist 2ポイント3ポイント  (0子コメント)

                                The big red sign on the front page of their website is a great start.

                                [–]unseen_vision 2ポイント3ポイント  (0子コメント)

                                Considering that this was JUST found out, perhaps they are trying to find out how it happened before making a statement...

                                They do have a notice on their website, for now.

                                [–]DrAmbulanceDriver 1ポイント2ポイント  (1子コメント)

                                They clearly explain in their update notes how to check to see if you're infected and how to stop the processes and remove the malware. How is that "no statement?"

                                [–]krackers 1ポイント2ポイント  (0子コメント)

                                I would just say do nothing.

                                My motto has always been — if it's working fine don't upgrade now (unless you really need the new features).

                                Since transmission hasn't really added any new features, I just stick with what I have installed.

                                [–]quinncom 0ポイント1ポイント  (0子コメント)

                                If someone has an affected Transmission .dmg or .app, could they upload it to https://www.virustotal.com/ and post the link to the results?

                                I've just uploaded my Transmission.app v2.90 (I don't think it's affected) and the results look like this.

                                [–]flybypost 0ポイント1ポイント  (0子コメント)

                                users who updated within the app weren't affected

                                I didn't get that warning, just a window to update to 2.90 a few days ago when I started the app. The only difference I saw with 2.90 was that it crashed whenever it completed a download.

                                [–]miloworld 0ポイント1ポイント  (2子コメント)

                                Breaking on 9to5mac:

                                http://9to5mac.com/2016/03/06/first-os-x-ransomware-detected-in-the-wild-will-maliciously-encrypt-hard-drives-on-infected-macs

                                Ransomware bundled with download.

                                [–]iscandr 0ポイント1ポイント  (3子コメント)

                                Infected sample: https://www.virustotal.com/en/file/99792afc994b3a0652b23621ed12f42b2d78bef0b5891c7ec9b56e77b4cb46f9/analysis/1457291458/

                                [–]enMTW 0ポイント1ポイント  (2子コメント)

                                Do you know that copy to be infected, or is it just the clean version of 2.90. If it is infected, would you mind uploading a copy? Would like to poke at it.

                                [–]iscandr 1ポイント2ポイント  (0子コメント)

                                Sure. https://dropfile.to/rfHnT For clarity: this file contains the KeRanger malware.

                                [–]arne 0ポイント1ポイント  (0子コメント)

                                You can tell it's the infected one since it has the General.rtf file in the Transmission.app/Contents/Resources/ directory. It's also marked as a Mac OS X Executable file.

                                [–]McNuttyNutz 0ポイント1ポイント  (0子コメント)

                                just checked mine and I'm clean from what i can tell i have Kernel_task but no services running i updated to the 2.9 through the app and again to 2.92

                                [–]thepotatochronicles 0ポイント1ポイント  (0子コメント)

                                I updated through the website (I checked that it was 2.90) but I don't see any kernel_service running. I scanned with sophos and uninstalled the app using cleanmymac. Should I still be worried?

                                edit: if it helps, I downloaded it off the website on the very hour it was announced

                                [–]sfachime 0ポイント1ポイント  (0子コメント)

                                It appears to be ransomware, Ars has a writeup here.

                                [–]saint_whatever 0ポイント1ポイント  (0子コメント)

                                "can’t confirm how this infection occurred."

                                [–]notrodash 0ポイント1ポイント  (0子コメント)

                                Damn, I downloaded the app from the website yesterday. It didn't want to launch so I gave up and downloaded a different client.

                                コメントをもっと表示する (67 返事)