Top all-time · #1390
Palo Alto Networks Blog
Company blog · researchcenter.paloaltonetworks.comsecurity
Palo Alto Networks Blog is the company blog at researchcenter.paloaltonetworks.com, writing about security. Since 2014, 52 different Hacker News readers have linked it 65 times, most often “Transmission OSX ppa malware in-depth”. It is still writing: the last post was on 2026-10-26, and you can follow it by feed.
Too few sampled comments (21) to say how often HN recommends it.?
Why HN links it
HN readers link Palo Alto Networks Unit 42 research posts as technical sources on malware, such as XcodeGhost, Mac and Android threats, and WannaCry variants.
Summarised by Claude from a sample of 21 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Empower your cybersecurity strategy with Palo Alto Networks' blog. Gain insights on AI, machine learning, threat detection, and best practices.
Most-linked posts?
- Transmission OSX ppa malware in-depth8 people · 11 mentions · first linked 2016-03-06
- /2015/09/novel-malware-xcodeghost-modifies-xcode-infects-apple-ios-apps-and-hits-app-store/5 people · 5 mentions · first linked 2015-09-18
- /2015/09/malware-xcodeghost-infects-39-ios-apps-including-wechat-affecting-hundreds-of-millions-of-users/3 people · 3 mentions · first linked 2015-09-19
- Active GitHub Users Targeted by Malware3 people · 3 mentions · first linked 2017-03-30
- AceDeceiver: First iOS Trojan Exploiting Apple DRM Design Flaws to Infect iOS3 people · 3 mentions · first linked 2016-03-16
- Pirated iOS App Store’s Client Successfully Evaded Apple iOS Code Review2 people · 2 mentions · first linked 2016-02-22
- An Analysis of Unauthorized JavaScript Coin Mining2 people · 2 mentions · first linked 2017-10-17
- Sofacy’s ‘Komplex’ OS X Trojan2 people · 2 mentions · first linked 2016-09-26
- Angler Exploit Kit Continues to Evade Detection: Over 90000 Websites Compromised2 people · 2 mentions · first linked 2016-01-18
What Hacker News says?
I do not think it was the build server, though. According to this analysis[1], the developer used a different key to sign the build (all Mac apps need to be signed or the default behavior is to reject that App. You can permanently disable this behavior in settings, or just for on app by holding control while opening the App, which a lot users who use transmission probably do because not all legitimate Apps are signe…
Comment linking /2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/
on “Transmission BitTorrent app contained malware”Submitted Palo Alto Networks bets on Google Cloud Platform as a story · 25 points
HN discussionThanks, I just realized it after reading Claud Xiao and Jin Chen's analysis, too. Apparently, this ransomware uses Tor to hide its origin. Analysis: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
Comment linking /2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/
on “Transmission BitTorrent app contained malware”Submitted KeyRaider Jailbroken iOS Malware Steals Over 225,000 Apple Accounts as a story · 11 points
HN discussionhttp://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
Comment linking /2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/
on “Transmission BitTorrent app contained malware”Submitted WireLurker: A New Era in OS X and iOS Malware as a story · 10 points
HN discussionOr, as is the case here, the malicious party was simply issued a key by Apple (for apps that are downloaded from places other than the Mac App Store, developers can get a unique Developer ID from Apple (for free) and use it to digitally sign their apps, the purpose being that Apple can revoke it after the fact if it turns out to be malware): “ The two KeRanger infected Transmission installers were signed with a legi…
Comment linking /2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/
on “Transmission BitTorrent app contained malware”Submitted AceDeceiver: First iOS Trojan Exploiting Apple DRM Design Flaws to Infect iOS as a story · 9 points
HN discussionIt seems like it was not http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
Comment linking /2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/
on “Transmission BitTorrent app contained malware”Submitted An Analysis of Unauthorized JavaScript Coin Mining as a story · 7 points
HN discussionNo, it wasn’t: “ The two KeRanger infected Transmission installers were signed with a legitimate certificate issued by Apple. The developer ID in this certificate is “POLISAN BOYA SANAYI VE TICARET ANONIM SIRKETI (Z7276PX673)”, which was different from the developer ID used to sign previous versions of the Transmission installer. In the code signing information, we found that these installers were generated and sign…
Comment linking /2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/
on “Transmission BitTorrent app contained malware”Submitted First iOS Trojan Exploiting Apple DRM Design Flaws to Infect Any iOS Device as a story · 7 points
HN discussionThis article explains how to check if for infection: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
Comment linking /2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/
on “Transmission BitTorrent app contained malware”Submitted Transmission OSX ppa malware in-depth as a story · 7 points
HN discussionAnd according to the analysis [0], this is exactly what they did. They used a different cert to sign their malware. I have to admit that Windows' UAC is better in that regard, as it shows the signees name. But of course this is only useful if you know the "right" name. [0] http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
Comment linking /2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/
on “Transmission BitTorrent app contained malware”Submitted Pirated iOS App Store’s Client Successfully Evaded Apple iOS Code Review as a story · 6 points
HN discussionHere's an analysis of the malware - http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
Comment linking /2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/
on “Transmission BitTorrent app contained malware”Submitted Angler Exploit Kit Continues to Evade Detection: Over 90000 Websites Compromised as a story · 6 points
HN discussionThat's the power of marketing for you. One required privacy policies while the other didn't. One asks before enabling AGPS data collection, while the other doesn't even let you opt out. One allows you to use on-device maps as default, while the other doesn't. One allows you to replace the default SMS app with Signal, while the other doesn't. When you think of a toxic hellstew of vulnerabilities, you probably don't t…
Comment linking /2015/09/malware-xcodeghost-infects-39-ios-apps-including-wechat-affecting-hundreds-of-millions-of-users/
on “Apple's best product is now privacy”Submitted New OS X Ransomware KeRanger Infected Transmission BitTorrent Client Installer as a story · 5 points
HN discussionSeriously! Here is technical analysis of one of the malware used. http://researchcenter.paloaltonetworks.com/2015/07/unit-42-t... Why does everyone thinks that only Russians can write such a malware, that too in python! Also, does it dawns on anyone that anyone can actually take this malware up and reverse engineer it and repurpose it. All it takes is changing one JSON blob embedded in the code to point to your own…
Comment linking /2015/07/unit-42-technical-analysis-seaduke/
on “Technical report on DNC hack [pdf]”Submitted YiSpecter: iOS Malware Attacks Any iOS Device by Abusing Private APIs as a story · 5 points
HN discussionLookout Security describes it as malware[2] and as malicious, as does Palo Alto Networks[3], Ars[4], Reuters[5] and The NY Times[6]. From here[1]: > Remote control security risks > XcodeGhost can be remotely controlled via commands sent by an attacker from a Command and control server through HTTP. This data is encrypted using the DES algorithm in ECB mode. Not only is this encryption mode known to be weak, the encr…
Comment linking /2015/09/malware-xcodeghost-infects-39-ios-apps-including-wechat-affecting-hundreds-of-millions-of-users/
on “Senators introduce bipartisan antitrust bill to promote app store competition”Submitted New iOS malware steals Apple ID, buys apps as a story · 5 points
HN discussion3.35% according to [this webpage]( http://researchcenter.paloaltonetworks.com/app-usage-risk-re... ( cited by [BitTorrent wikipedia article]( https://en.wikipedia.org/wiki/BitTorrent ) Impressive how it went from being the 35% of traffic in 2004.
Comment linking /app-usage-risk-report-visualization/
on “You can take down Pirate Bay, but you can’t kill the Internet it created”Submitted 132 Android Apps Infected with Windows-Based Malware via Webview (iframes) as a story · 4 points
HN discussion> Again, source? Xcodeghost was one instance of limited impact. https://www.google.com/amp/s/www.macrumors.com/2015/09/20/xc... shows 500 million infected from 50 apps. > You're assuming that Apple doesn't do this? No need to assume. https://researchcenter.paloaltonetworks.com/2015/09/more-det... not only shows that there were thousands more apps affected by Xcodeghost than originally reported (and thus, more infect…
Comment linking /2015/09/more-details-on-the-xcodeghost-malware-and-affected-ios-apps/
on “iOS 11 Security [pdf]”Submitted Angler Exploit Kit Continues to Evade Detection:Over 90,000 Websites Compromised as a story · 4 points
HN discussionThis might help: http://researchcenter.paloaltonetworks.com/2017/05/palo-alto...
Comment linking /2017/05/palo-alto-networks-protections-wanacrypt0r-attacks/
on “WannaCry – New Variants Detected”Submitted IoT Botnets on Steroids as a story · 3 points
HN discussion
