OSX Ransomware

[Deleted member 49549]

Hi all. For those with OS X machines. There has been a piece of Ransomware distributed. If you use Transmission torrent client read this.

http://researchcenter.paloaltonetwo...ted-transmission-bittorrent-client-installer/

 

[dejongj]

So only if you downloaded the client on 4/3. I was concerned as I do use the software.

The response of all involved including Apple was pretty good and quick.

Stay safe out there.

 

[neil_g]

Mac users will have to pull their head out of the sand at some point soon.

 

[dejongj]

Mac users will have to pull their head out of the sand at some point soon.

Now now. No need for that. They are people too.

 

[JonathanRyan]

Mac users will have to pull their head out of the sand at some point soon.

Nope, we're still good thanks. Maybe pop back when somebody manages a viable virus.

 

[neil_g]

Now now. No need for that. They are people too.

Well maybe.. Although I also have a mac on my desk

Nope, we're still good thanks. Maybe pop back when somebody manages a viable virus.

I'm not talking viruses, I'm talking malware and ransomware (viruses don't make money). Its a growing and real threat. I can say for sure that we're seeing an increase of cross platform attempts in our mac av/malware alerts.

 

[dejongj]

Well maybe.. Although I also have a mac on my desk

Yup you keep saying that before twisting the knife.

 

[Ricardodaforce]

Hi all. For those with OS X machines. There has been a piece of Ransomware distributed. If you use Transmission torrent client read this.

http://researchcenter.paloaltonetwo...ted-transmission-bittorrent-client-installer/

Why not post it in the correct forum too? https://www.talkphotography.co.uk/forums/talk-computers-websites-and-other-technology.60/

 

[Mikesphotaes]

Little boxes, little boxes

 

[JonathanRyan]

I'm not talking viruses, I'm talking malware and ransomware (viruses don't make money). Its a growing and real threat. I can say for sure that we're seeing an increase of cross platform attempts in our mac av/malware alerts.

That's true. The details of the current attack are interesting. Somehow the bad guys managed to get past the app signing system allowing Transmission (which is actually a good app with non-dodgy uses) to be trusted by OS X. The report I saw said it was likely to have involved an attack on the Transmission team's servers to pollute the code at source.

Obviously Transmission need to protect their code, but Apple need to beef up their signing process. I suspect we are only a short step away from only allowing apps to be installed from the App store. And I'm not sure that's a good thing.

 

[JonathanRyan]

One interesting detail appears to be missing from all the mainstream "news" reports of this attack - OS X actually stops the installation of this malware.

https://forum.transmissionbt.com/viewtopic.php?t=17834

TL;DR: even though it manages to bypass Gatekeeper, OS X will warn you that you are about to install ransomware on your machine. Your choice if you go ahead. Which is nice

 

[neil_g]

Yup you keep saying that before twisting the knife.

just imparting some information from using both platforms. maybe my initial comment was a bit harsh.