News for hackers. Stuff that matters.

A comment on Transmission BitTorrent app contained malware.

Re:Transmission BitTorrent app contained malware by dave2000 on Sunday March 06, 2016 @02:29PM (#11235131)
All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it.

When you can't (be bothered to) vet the source code, stick it in a vm. On a sensible machine with an ssd it's only 10 seconds away. Why risk it. Especially if the software you want/need to run only works under windows.

[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by Aleman360 on Sunday March 06, 2016 @05:04PM (#11235774)
This is exactly why sandboxed apps (e.g., iOS/UWP/etc.) are a good thing.
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by comex on Sunday March 06, 2016 @05:55PM (#11235995)
Or the Mac App Store itself. Its enforced sandboxing would have provided a decent first line of defense against this, but torrent clients can't be submitted to the App Store due to Apple not liking the legal aspects, not to mention the other issues people have with it. (Outside the store, apps can still opt into sandboxing, but that wouldn't help with a malicious installer.)
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by maerF0x0 on Sunday March 06, 2016 @06:31PM (#11236140)
I doubt Apple keeps it out for "Legal" aspects. iTunes sales seems more likely.
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by orionblastar on Sunday March 06, 2016 @05:57PM (#11236002)
For Windows there is SandboxIE: http://www.sandboxie.com/index.php?DownloadSandboxie

It should be able to sandbox Windows Apps, except for Metro/Modern UI Apps and Microsoft Edge.

Too many programs are having a backdoor or Trojan in them now. It is a good idea to run any app that accesses the Internet in a sandbox first to see what it does.

[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by drdaeman on Sunday March 06, 2016 @09:47PM (#11236787)
Just a warning: by default it doesn't protect your documents from reading.

It isolates the process, all writes (filesystem, registry) go to the sandbox instead of the host filesystem, so a malicious software can't easily install itself. But reading data is mostly unprotected by default, so a malware ran in a sandbox may steal some sensitive data. To protect such data you have to pre-configure sandbox manually.

[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by daveguy on Sunday March 06, 2016 @06:55PM (#11236254)
Also cameyo to make your own:

http://www.cameyo.com

And they have prepackaged sandboxed apps:

https://online.cameyo.com/public

[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by voltagex_ on Sunday March 06, 2016 @08:07PM (#11236458)
I have no problem paying for apps but for people who have paid for SandboxIE, do you think you've got your money's worth out of it?
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by kccqzy on Sunday March 06, 2016 @09:12PM (#11236664)
Yes. Back when I still used Windows five years ago, the app was an essential tool for me. All web browsers, downloaders and basically anything else that I consider high risk must be run in a sandbox, which is routinely emptied. Less risky apps are sometimes also installed in a sandbox, which is emptied much less frequently. And it's great for trying out trial versions of software before I fully trust their publishers. I didn't run any antivirus on that machine at all and I'm that confident. Nowadays I've switched to OS X but I still miss the easy sandboxing of basically any app.
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by TazeTSchnitzel on Sunday March 06, 2016 @02:32PM (#11235148)
Beware that VMs are not necessarily secure. They can be escaped!
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by nikanj on Sunday March 06, 2016 @02:46PM (#11235220)
This argument is similar to "a condom can always break". Technically you are correct, but I'd still use one.
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by conradev on Sunday March 06, 2016 @04:56PM (#11235738)
Which is the entire premise behind Qubes: https://www.qubes-os.org
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by feld on Monday March 07, 2016 @09:42AM (#11239109)
This argument is only similar if the condom is known to have huge design flaws

VMs have tons of well documented issues. If you want a smaller attack surface, try OS virtualization technologies (zones/jails)

[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by lawnchair_larry on Monday March 07, 2016 @10:08AM (#11239271)
This makes no sense. VMs are by far the most secure form of isolation. No one is going to get infected with malware that escapes VMs - it is far too valuable.
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by feld on Monday March 07, 2016 @10:19PM (#11243361)
How can you honestly think VMs are the most secure form of isolation?
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by dave2000 on Sunday March 06, 2016 @02:39PM (#11235184)
Sure, in theory. Are there any current exploits for VirtualBox?

The way I see it, they're more secure that running the same apps on bare metal. Ubuntu host running a Fedora VM; the latter (with Transmission etc) only running when I need the apps running - seems an almost entirely painless way of providing a lot of security.

[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by nevir on Sunday March 06, 2016 @02:49PM (#11235236)
Unsure if there are any currently publicly known exploits, but it sure isn't unheard of for VirtualBox:

* http://arstechnica.com/security/2015/05/extremely-serious-vi...

* http://www.securityfocus.com/archive/1/495095

* https://www.cert.be/advisories/oracle-vm-virtualbox-two-priv...

* http://www.coresecurity.com/content/virtualbox-privilege-esc...

[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by startling on Sunday March 06, 2016 @05:42PM (#11235941)
"Requires a 0-day" is still a huge barrier. It's not 100% secure, sure, but it's an improvement.
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by nevir on Monday March 07, 2016 @12:26AM (#11237291)
Yeah, not arguing that. Just don't treat it like a panacea
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by brians on Monday March 07, 2016 @12:04AM (#11237205)
Yes! Some reliable ways to extract an RSA key, and some less reliable ways to swap two cache lines. Virtualization on x86 is a helpful tool for configuration management, but should not be mistaken for a security feature.
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by digi_owl on Sunday March 06, 2016 @02:41PM (#11235197)
More secure than without though.

Lets try to avoid treating security as something binary.

[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by b1460151 on Monday March 07, 2016 @06:46AM (#11238355)
Yes but if you run a compromised App in VM A and have your sensitive data in VM B then they have to break out of the VM A and then break into VM B. It's no longer worth the effort. There are often easier ways like phising.
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by mirimir on Monday March 07, 2016 @01:03AM (#11237385)
You can also lease a VPS (anonymously even) and use Deluge with a webGUI. Said webGUI can be a Tor onion service, for better isolation.

But still, this is about malware in Transmission itself, not anything downloaded using it. So the fact that it's a BitTorrent client is rather beside the point, I think.

[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by 542458 on Monday March 07, 2016 @12:19AM (#11237267)
> soulseek

Neat. Never heard of this one before - what makes it special?

[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by rstacruz on Monday March 07, 2016 @12:27AM (#11237294)
It's a very old P2P file sharing network modeled after Napster. It's main propositions (in my opinion) are its active users who share harder-to-find electronic music, and its discussion groups which are available inside the app.
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by thirdsun on Monday March 07, 2016 @01:11AM (#11237404)
I didn't know Soulseek is still alive - brings me back to the days of Direct Connect / DC++ and hunting down rare live sets and (as you mentioned) electronic music over ISDN/dial up.
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by touristtam on Sunday March 06, 2016 @05:51PM (#11235973)
Wouldn't have a container for this be good enough ?
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by IncRnd on Sunday March 06, 2016 @11:55PM (#11237182)
A container may be "good enough", but running within a container generally doesn't give the same security posture as running within a virtual machine.
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by dave2000 on Sunday March 06, 2016 @08:10PM (#11236469)
I have no idea;I've never used a container. Is it easier than downloading an ISO, selecting how much ram/disk/cpu to give it and installing it?
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by kobayashi on Sunday March 06, 2016 @08:43PM (#11236565)
Admittedly, this might reasonably be considered a basic question, but how do you recommend running a VM on a Mac?
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by ceejayoz on Sunday March 06, 2016 @10:10PM (#11236880)
https://www.virtualbox.org/wiki/Downloads
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by bartvk on Monday March 07, 2016 @07:09AM (#11238423)
http://veertu.com

Note that I've only used it to run Linux so far.

[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by kobayashi on Tuesday March 08, 2016 @02:44PM (#11247929)
Does it run much better than in VirtualBox?
[ Parent | on HN ]
Re:Transmission BitTorrent app contained malware by frozenport on Sunday March 06, 2016 @05:19PM (#11235843)
Now you got an infected VM. How about we stop packing malware in OSS?
[ Parent | on HN ]