Discussion:
[Audacity-devel] Hacked Download - Impact on Development.
James Crook
2016-08-03 09:26:52 UTC
Permalink
Many of you will already know that we were hit by hackers yesterday.

Vaughan's credentials were compromised, and a malware laden upload
placed on our FossHub site. I have put a post about it on our website:
http://www.audacityteam.org/hacked-download/

We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for a hacker to
place a bad download there. We also need to make it easier for users to
check and for us to be alerted to problems. As RM for 2.1.3 I am making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that. Upping security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our 2.1.3 release
schedule - and it is not the only measure we need to take.


--James





------------------------------------------------------------------------------
David Bailes
2016-08-03 09:55:03 UTC
Permalink
Post by James Crook
Many of you will already know that we were hit by hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity and
classic shell overwrite the MBR. Is that the case?
If so, there needs to be a clear warning about this on Audacity's home page,

David.
Post by James Crook
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for a hacker to
place a bad download there. We also need to make it easier for users to
check and for us to be alerted to problems. As RM for 2.1.3 I am making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that. Upping security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our 2.1.3 release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
David Bailes
2016-08-03 09:57:41 UTC
Permalink
Post by David Bailes
Post by James Crook
Many of you will already know that we were hit by hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity
and classic shell overwrite the MBR. Is that the case?
If so, there needs to be a clear warning about this on Audacity's home page,
ps. info gained from this website:
https://linustechtips.com/main/topic/637190-fosshub-website-was-compromised-yesterday-serving-up-malware-downloads/

David.
Post by David Bailes
David.
Post by James Crook
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for a hacker to
place a bad download there. We also need to make it easier for users to
check and for us to be alerted to problems. As RM for 2.1.3 I am making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that. Upping security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our 2.1.3 release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Arturo 'Buanzo' Busleiman
2016-08-03 11:30:59 UTC
Permalink
We have published an updated blog post:
http://www.audacityteam.org/compromised-download-partner/

I added a message by FossHub team, and some additional considerations on
behalf of our security group.
Post by David Bailes
Post by David Bailes
Post by James Crook
Many of you will already know that we were hit by hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity
and classic shell overwrite the MBR. Is that the case?
If so, there needs to be a clear warning about this on Audacity's home page,
https://linustechtips.com/main/topic/637190-fosshub-website-was-compromised-yesterday-serving-up-malware-downloads/
David.
Post by David Bailes
David.
Post by James Crook
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for a hacker to
place a bad download there. We also need to make it easier for users to
check and for us to be alerted to problems. As RM for 2.1.3 I am making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that. Upping security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our 2.1.3 release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Bill Unruh
2016-08-03 11:50:45 UTC
Permalink
I would agree that there should be an item on the main audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the 2.1.2 is
OK, you can say that, but you have to be upfront and open about it. (Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily be a deathknell.
Noone will see the special web page unless they are looking for it, and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you really need to
warn them fast. (Do you have logs as to who downloaded it from you?
Can you send out warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?




William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____ ***@physics.ubc.ca
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by James Crook
Many of you will already know that we were hit by hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home page,
David. 
We are going to be tightening up on security in conjunction with
FossHub.  Some of the work we do for this will have an impact on
schedule for 2.1.3.  We need to make it much harder for a hacker to
place a bad download there.  We also need to make it easier for users to
check and for us to be alerted to problems.  As RM for 2.1.3 I am making
signing of the windows installer an essential, not an optional for
2.1.3.  We need additionally to show the 'signed by' name on the
download page.  Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that.  Upping security
will take us some time.  I am estimating that getting the signing
properly and securely sorted out will add a month to our 2.1.3 release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Arturo 'Buanzo' Busleiman
2016-08-03 12:06:09 UTC
Permalink
The link is right there, on the "RECENT POSTS". Left side menu.
Post by Bill Unruh
I would agree that there should be an item on the main audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the 2.1.2 is
OK, you can say that, but you have to be upfront and open about it. (Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily be a
deathknell. Noone will see the special web page unless they are looking for
it, and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you really need to
warn them fast. (Do you have logs as to who downloaded it from you? Can
you send out warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by James Crook
Many of you will already know that we were hit by hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home page,
David.
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for a hacker to
place a bad download there. We also need to make it easier for users to
check and for us to be alerted to problems. As RM for 2.1.3 I am making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that. Upping security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our 2.1.3 release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Arturo 'Buanzo' Busleiman
2016-08-03 12:06:33 UTC
Permalink
But I will move it to front-page for this week.


On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman <
Post by Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
Post by Bill Unruh
I would agree that there should be an item on the main audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the 2.1.2 is
OK, you can say that, but you have to be upfront and open about it. (Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily be a
deathknell. Noone will see the special web page unless they are looking for
it, and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you really need to
warn them fast. (Do you have logs as to who downloaded it from you? Can
you send out warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by James Crook
Many of you will already know that we were hit by hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home page,
David.
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for a hacker to
place a bad download there. We also need to make it easier for users to
check and for us to be alerted to problems. As RM for 2.1.3 I am making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that. Upping security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our 2.1.3 release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Arturo 'Buanzo' Busleiman
2016-08-03 12:14:37 UTC
Permalink
There. Added a very prominent link on top of the main page. Is that visible
enough? We have no interest in hiding a security incident. I have worked
with IT security for the past 20 years, and I *HATE* security through
obscurity and FUD.


On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman <
Post by Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman <
Post by Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
Post by Bill Unruh
I would agree that there should be an item on the main audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the 2.1.2 is
OK, you can say that, but you have to be upfront and open about it. (Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily be a
deathknell. Noone will see the special web page unless they are looking for
it, and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you really need to
warn them fast. (Do you have logs as to who downloaded it from you? Can
you send out warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by James Crook
Many of you will already know that we were hit by hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home page,
David.
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for a hacker to
place a bad download there. We also need to make it easier for users to
check and for us to be alerted to problems. As RM for 2.1.3 I am making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that. Upping security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our 2.1.3 release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Peter Sampson
2016-08-03 12:38:53 UTC
Permalink
And well done Buanzo for remebering to update the official
Audacity FaceBook page with this
https://www.facebook.com/AudacityTeamOfficial/posts/497840767075681?notif_t=feedback_reaction_generic&notif_id=1470227044747967

On Wed, Aug 3, 2016 at 1:14 PM, Arturo 'Buanzo' Busleiman <
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in hiding a security incident. I have
worked with IT security for the past 20 years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman <
Post by Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman <
Post by Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
Post by Bill Unruh
I would agree that there should be an item on the main audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the 2.1.2 is
OK, you can say that, but you have to be upfront and open about it. (Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily be
a deathknell. Noone will see the special web page unless they are looking
for it, and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you really need to
warn them fast. (Do you have logs as to who downloaded it from you? Can
you send out warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
Post by James Crook
Many of you will already know that we were hit by hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of
audacity and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home page,
David.
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for a hacker to
place a bad download there. We also need to make it easier for users to
check and for us to be alerted to problems. As RM for 2.1.3 I am making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that. Upping security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our 2.1.3 release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Bill Unruh
2016-08-03 13:07:46 UTC
Permalink
Great. It would help to list which three hours (or make it 5 to make sure you
get the overlap region) it was, so that worried people can check and be
relieved or panic as the case may be. It would also help to make clear what was
done to ensure that nothing slipped by. For example did they do a test run the
day before, and slip in some tiny hole into audacity that they could use to
subvert it in the future? Ie, to reassure people, they need to know lhow
thoroughly the infection was stemmed. They are forgiving and if they see that
you really did do a lot to make sure things are OK now, they will even forgive
a discovery that something slipped by, but if they think that the process
was perfunctory, they will not. The explanation now posted does go part way there.
How sure can you be that other downloads are not at issue? Can you point
people who were damaged to places where they can find out how to recover from
those damages?

The FosHub note seems to say that noone downloaded the damaged version of
Audacity (but did download the Shell). Is that correct? You might ask people
to notify you if they did download on Aug 2.

The "use different passwords" advice, though certainly good advice, is really
irrelevant to the users. It was not their fault, or their using bad passwords,
if they downloaded or ran an infected version. It may be part of the reason
why the infected version was uploaded but that is in a sense your problem, not
the user's problem. The users need to know that in future your system will be
sufficiently robust, that even if a developer password is compromised, it will still not
result in the user being damaged.


Also, that link on the main page should state what it is about. Simply saying "Click here"
without explaining why, is a classic malware tactic. You need to give them a
reason to click there-- telling them why they should.
"Audacity Malware Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
There. Added a very prominent link on top of the main page. Is that visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the past 20 years, and I *HATE* security
through obscurity and FUD.
But I will move it to front-page for this week.
The link is right there, on the "RECENT POSTS". Left side menu.
I would agree that there should be an item on the main audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the 2.1.2 is
OK, you can say that, but you have to be upfront and open about it. (Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily be a deathknell.
Noone will see the special web page unless they are looking for it, and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you really need to
warn them fast. (Do you have logs as to who downloaded it from you? Can you send out
warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
      Many of you will already know that we were hit by hackers yesterday.
      Vaughan's credentials were compromised, and a malware laden upload
      placed on our FossHub site.  I have put a post about it on our
      http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home
page,
David. 
      We are going to be tightening up on security in conjunction with
      FossHub.  Some of the work we do for this will have an impact on
      schedule for 2.1.3.  We need to make it much harder for a hacker to
      place a bad download there.  We also need to make it easier for
users to
      check and for us to be alerted to problems.  As RM for 2.1.3 I am
making
      signing of the windows installer an essential, not an optional for
      2.1.3.  We need additionally to show the 'signed by' name on the
      download page.  Hackers could easily sign with some other plausible
      looking credentials, so we need to guard against that.  Upping
security
      will take us some time.  I am estimating that getting the signing
      properly and securely sorted out will add a month to our 2.1.3
release
      schedule - and it is not the only measure we need to take.
      --James
     
------------------------------------------------------------------------------
      _______________________________________________
      audacity-devel mailing list
      https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Gale Andrews
2016-08-03 22:56:01 UTC
Permalink
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.

But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.

Someone can edit further if they wish.


Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to make sure you
get the overlap region) it was, so that worried people can check and be
relieved or panic as the case may be. It would also help to make clear what was
done to ensure that nothing slipped by. For example did they do a test run the
day before, and slip in some tiny hole into audacity that they could use to
subvert it in the future? Ie, to reassure people, they need to know lhow
thoroughly the infection was stemmed. They are forgiving and if they see that
you really did do a lot to make sure things are OK now, they will even forgive
a discovery that something slipped by, but if they think that the process
was perfunctory, they will not. The explanation now posted does go part way there.
How sure can you be that other downloads are not at issue? Can you point
people who were damaged to places where they can find out how to recover from
those damages?
The FosHub note seems to say that noone downloaded the damaged version of
Audacity (but did download the Shell). Is that correct? You might ask people
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice, is really
irrelevant to the users. It was not their fault, or their using bad passwords,
if they downloaded or ran an infected version. It may be part of the reason
why the infected version was uploaded but that is in a sense your problem, not
the user's problem. The users need to know that in future your system will be
sufficiently robust, that even if a developer password is compromised, it will still not
result in the user being damaged.
Also, that link on the main page should state what it is about. Simply saying "Click here"
without explaining why, is a classic malware tactic. You need to give them a
reason to click there-- telling them why they should. "Audacity Malware
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the past 20
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
I would agree that there should be an item on the main
audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the 2.1.2 is
OK, you can say that, but you have to be upfront and open about it. (Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily
be a deathknell.
Noone will see the special web page unless they are looking for it, and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you really need to
warn them fast. (Do you have logs as to who downloaded it from you?
Can you send out
warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
+1(604)822-3273
+1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were hit by hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
placed on our FossHub site. I have put a post about it
on our
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home
page,
David.
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for a hacker to
place a bad download there. We also need to make it
easier for
users to
check and for us to be alerted to problems. As RM for
2.1.3 I am
making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that.
Upping
security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our
2.1.3
release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Paul Licameli
2016-08-03 23:24:01 UTC
Permalink
Is there a more trusted mirror that users might be directed to in the
interim for downloads of 2.1.2?
PRL
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to make sure you
get the overlap region) it was, so that worried people can check and be
relieved or panic as the case may be. It would also help to make clear
what
Post by Bill Unruh
was
done to ensure that nothing slipped by. For example did they do a test
run
Post by Bill Unruh
the
day before, and slip in some tiny hole into audacity that they could use
to
Post by Bill Unruh
subvert it in the future? Ie, to reassure people, they need to know lhow
thoroughly the infection was stemmed. They are forgiving and if they see that
you really did do a lot to make sure things are OK now, they will even forgive
a discovery that something slipped by, but if they think that the process
was perfunctory, they will not. The explanation now posted does go part
way
Post by Bill Unruh
there.
How sure can you be that other downloads are not at issue? Can you point
people who were damaged to places where they can find out how to recover from
those damages?
The FosHub note seems to say that noone downloaded the damaged version of
Audacity (but did download the Shell). Is that correct? You might ask
people
Post by Bill Unruh
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice, is really
irrelevant to the users. It was not their fault, or their using bad passwords,
if they downloaded or ran an infected version. It may be part of the
reason
Post by Bill Unruh
why the infected version was uploaded but that is in a sense your
problem,
Post by Bill Unruh
not
the user's problem. The users need to know that in future your system
will
Post by Bill Unruh
be
sufficiently robust, that even if a developer password is compromised, it
will still not
result in the user being damaged.
Also, that link on the main page should state what it is about. Simply
saying "Click here"
without explaining why, is a classic malware tactic. You need to give
them a
Post by Bill Unruh
reason to click there-- telling them why they should. "Audacity Malware
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the past
20
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
I would agree that there should be an item on the main audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that
the
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.2 is
OK, you can say that, but you have to be upfront and open about
it.
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
(Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can
easily
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
be a deathknell.
Noone will see the special web page unless they are looking for
it,
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you really need to
warn them fast. (Do you have logs as to who downloaded it from
you?
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Can you send out
warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
+1(604)822-3273
+1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were hit by
hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
placed on our FossHub site. I have put a post about
it
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
on our
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions
of
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home
page,
David.
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder
for
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
a hacker to
place a bad download there. We also need to make it
easier for
users to
check and for us to be alerted to problems. As RM for
2.1.3 I am
making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that.
Upping
security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to
our
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3
release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by Bill Unruh
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Martyn Shaw
2016-08-04 00:17:31 UTC
Permalink
Hi

Thanks to all for the notice on the Audacity homepage, I see it has
evolved in light of feedback, which is good. I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.

Some people did download the spurious version, I know because I
knowingly did. I deleted it though.

I don't think we can know how many people did, or how much harm it has
done. More harm to FossHub I suspect, and more to their rep than
ours. I see that it was Vaughan's credentials that were used this
time, another one of us next time I guess. I also saw that 'Cult of
Peggle' apologised to Vaughan on twitter (and mis-represented Buanzo,
I believe), although that appears to have gone now. No way was this
any fault of Vaughan.

I agree with Bill's later post that none of the usual advice would
have caught this, for a user. I don't think I've seen a proposal that
would help with this kind of attack either, somebody pretending that
they are 'one of us'.

TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to make sure you
get the overlap region) it was, so that worried people can check and be
relieved or panic as the case may be. It would also help to make clear what was
done to ensure that nothing slipped by. For example did they do a test run the
day before, and slip in some tiny hole into audacity that they could use to
subvert it in the future? Ie, to reassure people, they need to know lhow
thoroughly the infection was stemmed. They are forgiving and if they see that
you really did do a lot to make sure things are OK now, they will even forgive
a discovery that something slipped by, but if they think that the process
was perfunctory, they will not. The explanation now posted does go part way there.
How sure can you be that other downloads are not at issue? Can you point
people who were damaged to places where they can find out how to recover from
those damages?
The FosHub note seems to say that noone downloaded the damaged version of
Audacity (but did download the Shell). Is that correct? You might ask people
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice, is really
irrelevant to the users. It was not their fault, or their using bad passwords,
if they downloaded or ran an infected version. It may be part of the reason
why the infected version was uploaded but that is in a sense your problem, not
the user's problem. The users need to know that in future your system will be
sufficiently robust, that even if a developer password is compromised, it will still not
result in the user being damaged.
Also, that link on the main page should state what it is about. Simply
saying "Click here"
without explaining why, is a classic malware tactic. You need to give them a
reason to click there-- telling them why they should. "Audacity Malware
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the past 20
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
I would agree that there should be an item on the main
audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the 2.1.2 is
OK, you can say that, but you have to be upfront and open about it. (Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily
be a deathknell.
Noone will see the special web page unless they are looking for it, and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you really need to
warn them fast. (Do you have logs as to who downloaded it from you?
Can you send out
warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
+1(604)822-3273
+1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were hit by hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
placed on our FossHub site. I have put a post about it
on our
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home
page,
David.
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for a hacker to
place a bad download there. We also need to make it
easier for
users to
check and for us to be alerted to problems. As RM for
2.1.3 I am
making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that.
Upping
security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our
2.1.3
release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Arturo 'Buanzo' Busleiman
2016-08-04 00:31:04 UTC
Permalink
I will not comment on FossHub, as I know they are probably more worried
about securing everything than doing PR, but we will follow up on that,
Bill. The rest of the team can edit the website easily, and add notices as
they see fit. Thank you for all your support.
Post by Martyn Shaw
Hi
Thanks to all for the notice on the Audacity homepage, I see it has
evolved in light of feedback, which is good. I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.
Some people did download the spurious version, I know because I
knowingly did. I deleted it though.
I don't think we can know how many people did, or how much harm it has
done. More harm to FossHub I suspect, and more to their rep than
ours. I see that it was Vaughan's credentials that were used this
time, another one of us next time I guess. I also saw that 'Cult of
Peggle' apologised to Vaughan on twitter (and mis-represented Buanzo,
I believe), although that appears to have gone now. No way was this
any fault of Vaughan.
I agree with Bill's later post that none of the usual advice would
have caught this, for a user. I don't think I've seen a proposal that
would help with this kind of attack either, somebody pretending that
they are 'one of us'.
TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to make
sure
Post by Gale Andrews
Post by Bill Unruh
you
get the overlap region) it was, so that worried people can check and be
relieved or panic as the case may be. It would also help to make clear
what
Post by Gale Andrews
Post by Bill Unruh
was
done to ensure that nothing slipped by. For example did they do a test
run
Post by Gale Andrews
Post by Bill Unruh
the
day before, and slip in some tiny hole into audacity that they could
use to
Post by Gale Andrews
Post by Bill Unruh
subvert it in the future? Ie, to reassure people, they need to know lhow
thoroughly the infection was stemmed. They are forgiving and if they see that
you really did do a lot to make sure things are OK now, they will even forgive
a discovery that something slipped by, but if they think that the
process
Post by Gale Andrews
Post by Bill Unruh
was perfunctory, they will not. The explanation now posted does go
part way
Post by Gale Andrews
Post by Bill Unruh
there.
How sure can you be that other downloads are not at issue? Can you point
people who were damaged to places where they can find out how to recover from
those damages?
The FosHub note seems to say that noone downloaded the damaged version
of
Post by Gale Andrews
Post by Bill Unruh
Audacity (but did download the Shell). Is that correct? You might ask
people
Post by Gale Andrews
Post by Bill Unruh
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice, is really
irrelevant to the users. It was not their fault, or their using bad passwords,
if they downloaded or ran an infected version. It may be part of the
reason
Post by Gale Andrews
Post by Bill Unruh
why the infected version was uploaded but that is in a sense your
problem,
Post by Gale Andrews
Post by Bill Unruh
not
the user's problem. The users need to know that in future your system
will
Post by Gale Andrews
Post by Bill Unruh
be
sufficiently robust, that even if a developer password is compromised,
it
Post by Gale Andrews
Post by Bill Unruh
will still not
result in the user being damaged.
Also, that link on the main page should state what it is about. Simply
saying "Click here"
without explaining why, is a classic malware tactic. You need to give
them a
Post by Gale Andrews
Post by Bill Unruh
reason to click there-- telling them why they should. "Audacity Malware
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the
past 20
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
I would agree that there should be an item on the main audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that
the
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.2 is
OK, you can say that, but you have to be upfront and open about
it.
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
(Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can
easily
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
be a deathknell.
Noone will see the special web page unless they are looking for
it,
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you
really need to
warn them fast. (Do you have logs as to who downloaded it from
you?
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Can you send out
warnings?)
And are you really really sure that you got all the malware--
that
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
they did
not sneak in some hidden treasure elesewhere than the obvious?
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were hit by
hackers yesterday.
Vaughan's credentials were compromised, and a malware
laden upload
placed on our FossHub site. I have put a post about
it
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
on our
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked
versions of
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home
page,
David.
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have
an
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
impact on
schedule for 2.1.3. We need to make it much harder
for
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
a hacker to
place a bad download there. We also need to make it
easier for
users to
check and for us to be alerted to problems. As RM
for
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3 I am
making
signing of the windows installer an essential, not an
optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some
other plausible
looking credentials, so we need to guard against
that.
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Upping
security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to
our
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3
release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by Gale Andrews
Post by Bill Unruh
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by Gale Andrews
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Gale Andrews
2016-08-04 00:30:29 UTC
Permalink
Post by Martyn Shaw
Hi
Thanks to all for the notice on the Audacity homepage, I see it has
evolved in light of feedback, which is good. I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.
Done.


Gale
Post by Martyn Shaw
Some people did download the spurious version, I know because I
knowingly did. I deleted it though.
I don't think we can know how many people did, or how much harm it has
done. More harm to FossHub I suspect, and more to their rep than
ours. I see that it was Vaughan's credentials that were used this
time, another one of us next time I guess. I also saw that 'Cult of
Peggle' apologised to Vaughan on twitter (and mis-represented Buanzo,
I believe), although that appears to have gone now. No way was this
any fault of Vaughan.
I agree with Bill's later post that none of the usual advice would
have caught this, for a user. I don't think I've seen a proposal that
would help with this kind of attack either, somebody pretending that
they are 'one of us'.
TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to make sure you
get the overlap region) it was, so that worried people can check and be
relieved or panic as the case may be. It would also help to make clear what was
done to ensure that nothing slipped by. For example did they do a test run the
day before, and slip in some tiny hole into audacity that they could use to
subvert it in the future? Ie, to reassure people, they need to know lhow
thoroughly the infection was stemmed. They are forgiving and if they see that
you really did do a lot to make sure things are OK now, they will even forgive
a discovery that something slipped by, but if they think that the process
was perfunctory, they will not. The explanation now posted does go part way there.
How sure can you be that other downloads are not at issue? Can you point
people who were damaged to places where they can find out how to recover from
those damages?
The FosHub note seems to say that noone downloaded the damaged version of
Audacity (but did download the Shell). Is that correct? You might ask people
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice, is really
irrelevant to the users. It was not their fault, or their using bad passwords,
if they downloaded or ran an infected version. It may be part of the reason
why the infected version was uploaded but that is in a sense your problem, not
the user's problem. The users need to know that in future your system will be
sufficiently robust, that even if a developer password is compromised, it
will still not
result in the user being damaged.
Also, that link on the main page should state what it is about. Simply
saying "Click here"
without explaining why, is a classic malware tactic. You need to give them a
reason to click there-- telling them why they should. "Audacity Malware
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the past 20
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
I would agree that there should be an item on the main audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the 2.1.2 is
OK, you can say that, but you have to be upfront and open about it. (Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily
be a deathknell.
Noone will see the special web page unless they are looking for it, and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you really need to
warn them fast. (Do you have logs as to who downloaded it from you?
Can you send out
warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
+1(604)822-3273
+1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were hit by
hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
placed on our FossHub site. I have put a post about it
on our
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home
page,
David.
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for a hacker to
place a bad download there. We also need to make it
easier for
users to
check and for us to be alerted to problems. As RM for
2.1.3 I am
making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that.
Upping
security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our
2.1.3
release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Arturo 'Buanzo' Busleiman
2016-08-04 00:32:05 UTC
Permalink
Thank you Gale!
Post by Bill Unruh
Post by Martyn Shaw
Hi
Thanks to all for the notice on the Audacity homepage, I see it has
evolved in light of feedback, which is good. I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.
Done.
Gale
Post by Martyn Shaw
Some people did download the spurious version, I know because I
knowingly did. I deleted it though.
I don't think we can know how many people did, or how much harm it has
done. More harm to FossHub I suspect, and more to their rep than
ours. I see that it was Vaughan's credentials that were used this
time, another one of us next time I guess. I also saw that 'Cult of
Peggle' apologised to Vaughan on twitter (and mis-represented Buanzo,
I believe), although that appears to have gone now. No way was this
any fault of Vaughan.
I agree with Bill's later post that none of the usual advice would
have caught this, for a user. I don't think I've seen a proposal that
would help with this kind of attack either, somebody pretending that
they are 'one of us'.
TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to make
sure
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
you
get the overlap region) it was, so that worried people can check and be
relieved or panic as the case may be. It would also help to make clear
what
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
was
done to ensure that nothing slipped by. For example did they do a test
run
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
the
day before, and slip in some tiny hole into audacity that they could
use to
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
subvert it in the future? Ie, to reassure people, they need to know
lhow
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
thoroughly the infection was stemmed. They are forgiving and if they
see
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
that
you really did do a lot to make sure things are OK now, they will even forgive
a discovery that something slipped by, but if they think that the
process
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
was perfunctory, they will not. The explanation now posted does go
part way
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
there.
How sure can you be that other downloads are not at issue? Can you
point
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
people who were damaged to places where they can find out how to
recover
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
from
those damages?
The FosHub note seems to say that noone downloaded the damaged version
of
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Audacity (but did download the Shell). Is that correct? You might ask
people
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice, is really
irrelevant to the users. It was not their fault, or their using bad passwords,
if they downloaded or ran an infected version. It may be part of the
reason
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
why the infected version was uploaded but that is in a sense your
problem,
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
not
the user's problem. The users need to know that in future your system
will
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
be
sufficiently robust, that even if a developer password is compromised,
it
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
will still not
result in the user being damaged.
Also, that link on the main page should state what it is about. Simply
saying "Click here"
without explaining why, is a classic malware tactic. You need to give
them a
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
reason to click there-- telling them why they should. "Audacity Malware
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the
past 20
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
I would agree that there should be an item on the main
audacitytam.org site,
and on the audacityteam.org/download site. If you are sure
that the
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.2 is
OK, you can say that, but you have to be upfront and open about
it.
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
(Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can
easily
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
be a deathknell.
Noone will see the special web page unless they are looking for
it,
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
and it
looks like you are hiding the problem. Because of the
potentially
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
disasterous
consequences for someone who downloaded the hacked version, you
really need to
warn them fast. (Do you have logs as to who downloaded it from
you?
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Can you send out
warnings?)
And are you really really sure that you got all the malware--
that
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
they did
not sneak in some hidden treasure elesewhere than the obvious?
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were hit by
hackers yesterday.
Vaughan's credentials were compromised, and a
malware
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
laden upload
placed on our FossHub site. I have put a post
about it
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
on our
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked
versions of
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on
Audacity's home
page,
David.
We are going to be tightening up on security in
conjunction with
FossHub. Some of the work we do for this will have
an
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
impact on
schedule for 2.1.3. We need to make it much harder
for
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
a hacker to
place a bad download there. We also need to make it
easier for
users to
check and for us to be alerted to problems. As RM
for
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3 I am
making
signing of the windows installer an essential, not
an
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
optional for
2.1.3. We need additionally to show the 'signed by'
name on the
download page. Hackers could easily sign with some
other plausible
looking credentials, so we need to guard against
that.
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Upping
security
will take us some time. I am estimating that
getting
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
the signing
properly and securely sorted out will add a month
to our
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3
release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by Martyn Shaw
Post by Gale Andrews
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by Martyn Shaw
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Bill Unruh
2016-08-04 01:40:06 UTC
Permalink
Looks good. One problem. The "More help here" pointer goes to Facebook. Some of
us do not belong to Facebook, and putting an extra obstacle in the way of
getting help is not a great idea in my opinion, even if only for some people.

That facebook post needs to be duplicated in a format that we know they can
read-- Since they are reading http we know they can read that.



William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____ ***@physics.ubc.ca
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by James Crook
Post by Martyn Shaw
Hi
Thanks to all for the notice on the Audacity homepage, I see it has
evolved in light of feedback, which is good. I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.
Done.
Gale
Post by Martyn Shaw
Some people did download the spurious version, I know because I
knowingly did. I deleted it though.
I don't think we can know how many people did, or how much harm it has
done. More harm to FossHub I suspect, and more to their rep than
ours. I see that it was Vaughan's credentials that were used this
time, another one of us next time I guess. I also saw that 'Cult of
Peggle' apologised to Vaughan on twitter (and mis-represented Buanzo,
I believe), although that appears to have gone now. No way was this
any fault of Vaughan.
I agree with Bill's later post that none of the usual advice would
have caught this, for a user. I don't think I've seen a proposal that
would help with this kind of attack either, somebody pretending that
they are 'one of us'.
TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to make sure you
get the overlap region) it was, so that worried people can check and be
relieved or panic as the case may be. It would also help to make clear what was
done to ensure that nothing slipped by. For example did they do a test run the
day before, and slip in some tiny hole into audacity that they could use to
subvert it in the future? Ie, to reassure people, they need to know lhow
thoroughly the infection was stemmed. They are forgiving and if they see that
you really did do a lot to make sure things are OK now, they will even forgive
a discovery that something slipped by, but if they think that the process
was perfunctory, they will not. The explanation now posted does go part way there.
How sure can you be that other downloads are not at issue? Can you point
people who were damaged to places where they can find out how to recover from
those damages?
The FosHub note seems to say that noone downloaded the damaged version of
Audacity (but did download the Shell). Is that correct? You might ask people
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice, is really
irrelevant to the users. It was not their fault, or their using bad passwords,
if they downloaded or ran an infected version. It may be part of the reason
why the infected version was uploaded but that is in a sense your problem, not
the user's problem. The users need to know that in future your system will be
sufficiently robust, that even if a developer password is compromised, it
will still not
result in the user being damaged.
Also, that link on the main page should state what it is about. Simply
saying "Click here"
without explaining why, is a classic malware tactic. You need to give them a
reason to click there-- telling them why they should. "Audacity Malware
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the past 20
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
I would agree that there should be an item on the main audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the 2.1.2 is
OK, you can say that, but you have to be upfront and open about it.
(Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily
be a deathknell.
Noone will see the special web page unless they are looking for it, and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you
really need to
warn them fast. (Do you have logs as to who downloaded it from you?
Can you send out
warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were hit by
hackers yesterday.
Vaughan's credentials were compromised, and a malware
laden upload
placed on our FossHub site. I have put a post about it
on our
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home
page,
David.
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for
a hacker to
place a bad download there. We also need to make it
easier for
users to
check and for us to be alerted to problems. As RM for
2.1.3 I am
making
signing of the windows installer an essential, not an
optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some
other plausible
looking credentials, so we need to guard against that.
Upping
security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our
2.1.3
release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Arturo 'Buanzo' Busleiman
2016-08-04 02:08:15 UTC
Permalink
There is no need to be logged into a facebook account to read that content.

I just tested from a Google Chrome "Incognito" window.
Post by Bill Unruh
Looks good. One problem. The "More help here" pointer goes to Facebook. Some of
us do not belong to Facebook, and putting an extra obstacle in the way of
getting help is not a great idea in my opinion, even if only for some people.
That facebook post needs to be duplicated in a format that we know they can
read-- Since they are reading http we know they can read that.
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by James Crook
Post by Martyn Shaw
Hi
Thanks to all for the notice on the Audacity homepage, I see it has
evolved in light of feedback, which is good. I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.
Done.
Gale
Post by Martyn Shaw
Some people did download the spurious version, I know because I
knowingly did. I deleted it though.
I don't think we can know how many people did, or how much harm it has
done. More harm to FossHub I suspect, and more to their rep than
ours. I see that it was Vaughan's credentials that were used this
time, another one of us next time I guess. I also saw that 'Cult of
Peggle' apologised to Vaughan on twitter (and mis-represented Buanzo,
I believe), although that appears to have gone now. No way was this
any fault of Vaughan.
I agree with Bill's later post that none of the usual advice would
have caught this, for a user. I don't think I've seen a proposal that
would help with this kind of attack either, somebody pretending that
they are 'one of us'.
TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to make
sure
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
you
get the overlap region) it was, so that worried people can check and
be
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
relieved or panic as the case may be. It would also help to make
clear what
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
was
done to ensure that nothing slipped by. For example did they do a
test run
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
the
day before, and slip in some tiny hole into audacity that they could
use to
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
subvert it in the future? Ie, to reassure people, they need to know
lhow
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
thoroughly the infection was stemmed. They are forgiving and if they
see
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
that
you really did do a lot to make sure things are OK now, they will even forgive
a discovery that something slipped by, but if they think that the
process
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
was perfunctory, they will not. The explanation now posted does go
part way
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
there.
How sure can you be that other downloads are not at issue? Can you
point
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
people who were damaged to places where they can find out how to
recover
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
from
those damages?
The FosHub note seems to say that noone downloaded the damaged
version of
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Audacity (but did download the Shell). Is that correct? You might ask
people
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice, is really
irrelevant to the users. It was not their fault, or their using bad passwords,
if they downloaded or ran an infected version. It may be part of the
reason
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
why the infected version was uploaded but that is in a sense your
problem,
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
not
the user's problem. The users need to know that in future your system
will
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
be
sufficiently robust, that even if a developer password is
compromised, it
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
will still not
result in the user being damaged.
Also, that link on the main page should state what it is about. Simply
saying "Click here"
without explaining why, is a classic malware tactic. You need to give
them a
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
reason to click there-- telling them why they should. "Audacity
Malware
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the
past 20
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
I would agree that there should be an item on the main
audacitytam.org site,
and on the audacityteam.org/download site. If you are sure
that the
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.2 is
OK, you can say that, but you have to be upfront and open
about it.
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
(Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can
easily
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
be a deathknell.
Noone will see the special web page unless they are looking
for it,
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
and it
looks like you are hiding the problem. Because of the
potentially
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
disasterous
consequences for someone who downloaded the hacked version, you
really need to
warn them fast. (Do you have logs as to who downloaded it from
you?
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Can you send out
warnings?)
And are you really really sure that you got all the malware--
that
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
they did
not sneak in some hidden treasure elesewhere than the obvious?
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were hit by
hackers yesterday.
Vaughan's credentials were compromised, and a
malware
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
laden upload
placed on our FossHub site. I have put a post
about it
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
on our
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked
versions of
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on
Audacity's home
page,
David.
We are going to be tightening up on security in
conjunction with
FossHub. Some of the work we do for this will
have an
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
impact on
schedule for 2.1.3. We need to make it much
harder for
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
a hacker to
place a bad download there. We also need to make
it
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
easier for
users to
check and for us to be alerted to problems. As RM
for
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3 I am
making
signing of the windows installer an essential, not
an
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
optional for
2.1.3. We need additionally to show the 'signed
by'
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
name on the
download page. Hackers could easily sign with some
other plausible
looking credentials, so we need to guard against
that.
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Upping
security
will take us some time. I am estimating that
getting
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
the signing
properly and securely sorted out will add a month
to our
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3
release
schedule - and it is not the only measure we need
to
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
take.
--James
------------------------------------------------------------------------------
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by James Crook
Post by Martyn Shaw
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by James Crook
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Bill Unruh
2016-08-04 02:55:32 UTC
Permalink
I got a "See more of Audacity by logging in to Facebook" and the signup covers
most of the screen. You can read some of the post around the edges. but it
really is not very good. Ie, it would be good to have it also as just a web
page, not a Facebook post.


William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____ ***@physics.ubc.ca
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by Arturo 'Buanzo' Busleiman
There is no need to be logged into a facebook account to read that content.
I just tested from a Google Chrome "Incognito" window.
Looks good. One problem. The "More help here" pointer goes to Facebook. Some of
us do not belong to Facebook, and putting an extra obstacle in the way of
getting help is not a great idea in my opinion, even if only for some people.
That facebook post needs to be duplicated in a format that we know they can
read-- Since they are reading http we know they can read that.
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by James Crook
Post by Martyn Shaw
Hi
Thanks to all for the notice on the Audacity homepage, I see it has
evolved in light of feedback, which is good.  I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.
Done.
Gale
Post by Martyn Shaw
Some people did download the spurious version, I know because I
knowingly did.  I deleted it though.
I don't think we can know how many people did, or how much harm it has
done.  More harm to FossHub I suspect, and more to their rep than
ours.  I see that it was Vaughan's credentials that were used this
time, another one of us next time I guess.  I also saw that 'Cult of
Peggle' apologised to Vaughan on twitter (and mis-represented Buanzo,
I believe), although that appears to have gone now.  No way was this
any fault of Vaughan.
I agree with Bill's later post that none of the usual advice would
have caught this, for a user.  I don't think I've seen a proposal that
would help with this kind of attack either, somebody pretending that
they are 'one of us'.
TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to make sure
you
get the overlap region) it was, so that worried people can check and be
relieved or panic as the case may be. It would also help to make clear what
was
done to ensure that nothing slipped by. For example did they do a test run
the
day before, and slip in some tiny hole into audacity that they could use to
subvert it in the future? Ie, to reassure people, they need to know lhow
thoroughly the infection was stemmed. They are forgiving and if they see
that
you really did do a lot to make sure things are OK now, they will even
forgive
a discovery that something slipped by, but if they think that the process
was perfunctory, they will not.  The explanation now posted does go part way
there.
How sure can you be that other downloads are not at issue? Can you point
people who were damaged to places where they can find out how to recover
from
those damages?
The FosHub note seems to say that noone downloaded the damaged version of
Audacity (but did download the Shell). Is that correct? You might ask people
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice, is
really
irrelevant to the users. It was not their fault, or their using bad
passwords,
if they downloaded or ran an infected version. It may be part of the reason
why the infected version was uploaded but that is in a sense your problem,
not
the user's problem. The users need to know that in future your system will
be
sufficiently robust, that even if a developer password is compromised, it
will still not
result in the user  being damaged.
Also, that link on the main page should state what it is about. Simply
saying "Click here"
without explaining why, is a classic malware tactic. You need to give them a
reason to click there-- telling them why they should. "Audacity Malware
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the past 20
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
       But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
       The link is right there, on the "RECENT POSTS". Left side menu.
       I would agree that there should be an item on the main
audacitytam.org site,
       and on the audacityteam.org/download site. If you are sure that the
2.1.2 is
       OK, you can say that, but you have to be upfront and open about it.
(Johson and
       Johanson re poisoned tylenol, Maple foods in Canada re the
Lysteria). Not
       being upfront (eg Blackberry-- it took 4 days for them ) can easily
be a deathknell.
       Noone will see the special web page unless they are looking for it,
and it
       looks like you are hiding the problem. Because of the potentially
disasterous
       consequences for someone who downloaded the hacked version, you
really need to
       warn them fast. (Do you have logs as to who downloaded it from you?
Can you send out
       warnings?)
       And are you really really sure that you got all the malware-- that
they did
       not sneak in some hidden treasure elesewhere than the obvious?
+1(604)822-3273
+1(604)822-5324
       UBC, Vancouver,BC _|_ Program in Cosmology |____
       Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
             On Wed, Aug 3, 2016 at 10:26 AM, James Crook
                   Many of you will already know that we were hit by
hackers yesterday.
                   Vaughan's credentials were compromised, and a malware
laden upload
                   placed on our FossHub site.  I have put a post about it
on our
                   http://www.audacityteam.org/hacked-download/
             I can't see this from Audacity's home page.
             Info that I found by googling said that the hacked versions of
audacity
             and classic shell overwrite the MBR.
             Is that the case?
             If so, there needs to be a clear warning about this on
Audacity's home
             page,
             David.
                   We are going to be tightening up on security in
conjunction with
                   FossHub.  Some of the work we do for this will have an
impact on
                   schedule for 2.1.3.  We need to make it much harder for
a hacker to
                   place a bad download there.  We also need to make it
easier for
             users to
                   check and for us to be alerted to problems.  As RM for
2.1.3 I am
             making
                   signing of the windows installer an essential, not an
optional for
                   2.1.3.  We need additionally to show the 'signed by'
name on the
                   download page.  Hackers could easily sign with some
other plausible
                   looking credentials, so we need to guard against that.
Upping
             security
                   will take us some time.  I am estimating that getting
the signing
                   properly and securely sorted out will add a month to our
2.1.3
             release
                   schedule - and it is not the only measure we need to
take.
                   --James
------------------------------------------------------------------------------
                   _______________________________________________
                   audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Arturo 'Buanzo' Busleiman
2016-08-04 04:05:34 UTC
Permalink
Clearly, YMMV.
Post by Bill Unruh
I got a "See more of Audacity by logging in to Facebook" and the signup covers
most of the screen. You can read some of the post around the edges. but it
really is not very good. Ie, it would be good to have it also as just a web
page, not a Facebook post.
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
There is no need to be logged into a facebook account to read that content.
Post by Arturo 'Buanzo' Busleiman
I just tested from a Google Chrome "Incognito" window.
Looks good. One problem. The "More help here" pointer goes to Facebook. Some of
us do not belong to Facebook, and putting an extra obstacle in the way of
getting help is not a great idea in my opinion, even if only for some people.
That facebook post needs to be duplicated in a format that we know they can
read-- Since they are reading http we know they can read that.
+1(604)822-3273
+1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
Post by James Crook
Post by Martyn Shaw
Hi
Thanks to all for the notice on the Audacity homepage, I see it
has
Post by James Crook
Post by Martyn Shaw
evolved in light of feedback, which is good. I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.
Done.
Gale
Post by Martyn Shaw
Some people did download the spurious version, I know because I
knowingly did. I deleted it though.
I don't think we can know how many people did, or how much harm
it has
Post by James Crook
Post by Martyn Shaw
done. More harm to FossHub I suspect, and more to their rep than
ours. I see that it was Vaughan's credentials that were used
this
Post by James Crook
Post by Martyn Shaw
time, another one of us next time I guess. I also saw that
'Cult of
Post by James Crook
Post by Martyn Shaw
Peggle' apologised to Vaughan on twitter (and mis-represented
Buanzo,
Post by James Crook
Post by Martyn Shaw
I believe), although that appears to have gone now. No way was
this
Post by James Crook
Post by Martyn Shaw
any fault of Vaughan.
I agree with Bill's later post that none of the usual advice
would
Post by James Crook
Post by Martyn Shaw
have caught this, for a user. I don't think I've seen a
proposal that
Post by James Crook
Post by Martyn Shaw
would help with this kind of attack either, somebody pretending
that
Post by James Crook
Post by Martyn Shaw
they are 'one of us'.
TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5
to make sure
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
you
get the overlap region) it was, so that worried people can
check and be
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
relieved or panic as the case may be. It would also help to
make clear what
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
was
done to ensure that nothing slipped by. For example did they
do a test run
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
the
day before, and slip in some tiny hole into audacity that they
could use to
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
subvert it in the future? Ie, to reassure people, they need to
know lhow
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
thoroughly the infection was stemmed. They are forgiving and
if they see
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
that
you really did do a lot to make sure things are OK now, they
will even
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
forgive
a discovery that something slipped by, but if they think that
the process
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
was perfunctory, they will not. The explanation now posted
does go part way
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
there.
How sure can you be that other downloads are not at issue? Can
you point
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
people who were damaged to places where they can find out how
to recover
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
from
those damages?
The FosHub note seems to say that noone downloaded the damaged
version of
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Audacity (but did download the Shell). Is that correct? You
might ask people
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good
advice, is
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
really
irrelevant to the users. It was not their fault, or their
using bad
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
passwords,
if they downloaded or ran an infected version. It may be part
of the reason
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
why the infected version was uploaded but that is in a sense
your problem,
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
not
the user's problem. The users need to know that in future your
system will
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
be
sufficiently robust, that even if a developer password is
compromised, it
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
will still not
result in the user being damaged.
Also, that link on the main page should state what it is
about. Simply
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
saying "Click here"
without explaining why, is a classic malware tactic. You need
to give them a
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
reason to click there-- telling them why they should.
"Audacity Malware
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page.
Is that
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
visible enough? We have no interest in
hiding a security incident. I have worked with IT security
for the past 20
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left
side menu.
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
On Wed, Aug 3, 2016 at 8:50 AM, Bill Unruh <
I would agree that there should be an item on the main
audacitytam.org site,
and on the audacityteam.org/download site. If you are
sure that the
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.2 is
OK, you can say that, but you have to be upfront and
open about it.
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
(Johson and
Johanson re poisoned tylenol, Maple foods in Canada re
the
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them
) can easily
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
be a deathknell.
Noone will see the special web page unless they are
looking for it,
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
and it
looks like you are hiding the problem. Because of the
potentially
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
disasterous
consequences for someone who downloaded the hacked
version, you
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
really need to
warn them fast. (Do you have logs as to who downloaded
it from you?
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Can you send out
warnings?)
And are you really really sure that you got all the
malware-- that
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
they did
not sneak in some hidden treasure elesewhere than the
obvious?
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
+1(604)822-3273
+1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were
hit by
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
hackers yesterday.
Vaughan's credentials were compromised, and
a malware
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
laden upload
placed on our FossHub site. I have put a
post about it
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
on our
http://www.audacityteam.org/hacked-download/
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
I can't see this from Audacity's home page.
Info that I found by googling said that the
hacked versions of
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about
this on
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Audacity's home
page,
David.
We are going to be tightening up on
security in
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
conjunction with
FossHub. Some of the work we do for this
will have an
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
impact on
schedule for 2.1.3. We need to make it
much harder for
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
a hacker to
place a bad download there. We also need
to make it
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
easier for
users to
check and for us to be alerted to
problems. As RM for
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3 I am
making
signing of the windows installer an
essential, not an
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
optional for
2.1.3. We need additionally to show the
'signed by'
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
name on the
download page. Hackers could easily sign
with some
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
other plausible
looking credentials, so we need to guard
against that.
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Upping
security
will take us some time. I am estimating
that getting
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
the signing
properly and securely sorted out will add a
month to our
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3
release
schedule - and it is not the only measure
we need to
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
take.
--James
------------------------------------------------------------------------------
_______________________________________________
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by James Crook
Post by Martyn Shaw
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Post by James Crook
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Gale Andrews
2016-08-04 18:10:08 UTC
Permalink
Hi Bill U,

I did consider linking directly to the search result, but I thought
there was benefit too in making users aware of our Facebook
page. That is likely to evolve as the primary place to deliver
news and urgent announcements.

I did see the problem with the Facebook message but having
said "Not now" the message stops at the bottom of the page
for me. Also it is possible that there will be replies to that
Facebook post that could be worth reading.



Gale
Post by Bill Unruh
Looks good. One problem. The "More help here" pointer goes to Facebook. Some of
us do not belong to Facebook, and putting an extra obstacle in the way of
getting help is not a great idea in my opinion, even if only for some people.
That facebook post needs to be duplicated in a format that we know they can
read-- Since they are reading http we know they can read that.
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by James Crook
Post by Martyn Shaw
Hi
Thanks to all for the notice on the Audacity homepage, I see it has
evolved in light of feedback, which is good. I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.
Done.
Gale
Post by Martyn Shaw
Some people did download the spurious version, I know because I
knowingly did. I deleted it though.
I don't think we can know how many people did, or how much harm it has
done. More harm to FossHub I suspect, and more to their rep than
ours. I see that it was Vaughan's credentials that were used this
time, another one of us next time I guess. I also saw that 'Cult of
Peggle' apologised to Vaughan on twitter (and mis-represented Buanzo,
I believe), although that appears to have gone now. No way was this
any fault of Vaughan.
I agree with Bill's later post that none of the usual advice would
have caught this, for a user. I don't think I've seen a proposal that
would help with this kind of attack either, somebody pretending that
they are 'one of us'.
TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to make sure you
get the overlap region) it was, so that worried people can check and be
relieved or panic as the case may be. It would also help to make clear what was
done to ensure that nothing slipped by. For example did they do a test run the
day before, and slip in some tiny hole into audacity that they could use to
subvert it in the future? Ie, to reassure people, they need to know lhow
thoroughly the infection was stemmed. They are forgiving and if they see that
you really did do a lot to make sure things are OK now, they will even forgive
a discovery that something slipped by, but if they think that the process
was perfunctory, they will not. The explanation now posted does go part way there.
How sure can you be that other downloads are not at issue? Can you point
people who were damaged to places where they can find out how to recover from
those damages?
The FosHub note seems to say that noone downloaded the damaged version of
Audacity (but did download the Shell). Is that correct? You might ask people
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice, is really
irrelevant to the users. It was not their fault, or their using bad passwords,
if they downloaded or ran an infected version. It may be part of the reason
why the infected version was uploaded but that is in a sense your problem, not
the user's problem. The users need to know that in future your system will be
sufficiently robust, that even if a developer password is compromised, it
will still not
result in the user being damaged.
Also, that link on the main page should state what it is about. Simply
saying "Click here"
without explaining why, is a classic malware tactic. You need to give them a
reason to click there-- telling them why they should. "Audacity Malware
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the past 20
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
I would agree that there should be an item on the main
audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the
2.1.2 is
OK, you can say that, but you have to be upfront and open about it.
(Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily
be a deathknell.
Noone will see the special web page unless they are looking for it, and it
looks like you are hiding the problem. Because of the potentially
disasterous
consequences for someone who downloaded the hacked version, you
really need to
warn them fast. (Do you have logs as to who downloaded it from you?
Can you send out
warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were hit by
hackers yesterday.
Vaughan's credentials were compromised, and a malware
laden upload
placed on our FossHub site. I have put a post about it
on our
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of
audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on
Audacity's home
page,
David.
We are going to be tightening up on security in
conjunction with
FossHub. Some of the work we do for this will have an
impact on
schedule for 2.1.3. We need to make it much harder for
a hacker to
place a bad download there. We also need to make it
easier for
users to
check and for us to be alerted to problems. As RM for
2.1.3 I am
making
signing of the windows installer an essential, not an
optional for
2.1.3. We need additionally to show the 'signed by'
name on the
download page. Hackers could easily sign with some
other plausible
looking credentials, so we need to guard against that.
Upping
security
will take us some time. I am estimating that getting
the signing
properly and securely sorted out will add a month to our
2.1.3
release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Bill Unruh
2016-08-04 18:26:12 UTC
Permalink
Fair enough, but damage limitation is probably not a good time to start doing
a "facebook awareness campaign". At the very least, there should be an
alternative place where the same material could be looked at.

Note what little I saw of the facebook page really did not seem to me to offer
much help to someone desperately wondering how to recover from a broken MBR
and an unbootable machine (don't reboot is not useful for someone who already
has rebooted). The first many probably realised something was wrong was
when they switched on their machine the next morning. If they were
lucky they had another place to access the web. And putting obstacles in their
way (Facebook signup, or whatever) is probably not helpful.



William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____ ***@physics.ubc.ca
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by Gale Andrews
Hi Bill U,
I did consider linking directly to the search result, but I thought
there was benefit too in making users aware of our Facebook
page. That is likely to evolve as the primary place to deliver
news and urgent announcements.
I did see the problem with the Facebook message but having
said "Not now" the message stops at the bottom of the page
for me. Also it is possible that there will be replies to that
Facebook post that could be worth reading.
Gale
Post by Bill Unruh
Looks good. One problem. The "More help here" pointer goes to Facebook. Some of
us do not belong to Facebook, and putting an extra obstacle in the way of
getting help is not a great idea in my opinion, even if only for some people.
That facebook post needs to be duplicated in a format that we know they can
read-- Since they are reading http we know they can read that.
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by James Crook
Post by Martyn Shaw
Hi
Thanks to all for the notice on the Audacity homepage, I see it has
evolved in light of feedback, which is good. I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.
Done.
Gale
Post by Martyn Shaw
Some people did download the spurious version, I know because I
knowingly did. I deleted it though.
I don't think we can know how many people did, or how much harm it has
done. More harm to FossHub I suspect, and more to their rep than
ours. I see that it was Vaughan's credentials that were used this
time, another one of us next time I guess. I also saw that 'Cult of
Peggle' apologised to Vaughan on twitter (and mis-represented Buanzo,
I believe), although that appears to have gone now. No way was this
any fault of Vaughan.
I agree with Bill's later post that none of the usual advice would
have caught this, for a user. I don't think I've seen a proposal that
would help with this kind of attack either, somebody pretending that
they are 'one of us'.
TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to make sure you
get the overlap region) it was, so that worried people can check and be
relieved or panic as the case may be. It would also help to make clear what was
done to ensure that nothing slipped by. For example did they do a test run the
day before, and slip in some tiny hole into audacity that they could use to
subvert it in the future? Ie, to reassure people, they need to know lhow
thoroughly the infection was stemmed. They are forgiving and if they see that
you really did do a lot to make sure things are OK now, they will even forgive
a discovery that something slipped by, but if they think that the process
was perfunctory, they will not. The explanation now posted does go part way
there.
How sure can you be that other downloads are not at issue? Can you point
people who were damaged to places where they can find out how to recover from
those damages?
The FosHub note seems to say that noone downloaded the damaged version of
Audacity (but did download the Shell). Is that correct? You might ask people
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice, is really
irrelevant to the users. It was not their fault, or their using bad passwords,
if they downloaded or ran an infected version. It may be part of the reason
why the infected version was uploaded but that is in a sense your problem, not
the user's problem. The users need to know that in future your system will be
sufficiently robust, that even if a developer password is compromised, it
will still not
result in the user being damaged.
Also, that link on the main page should state what it is about. Simply
saying "Click here"
without explaining why, is a classic malware tactic. You need to give them a
reason to click there-- telling them why they should. "Audacity Malware
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the past 20
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
I would agree that there should be an item on the main
audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the
2.1.2 is
OK, you can say that, but you have to be upfront and open about it.
(Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily
be a deathknell.
Noone will see the special web page unless they are looking for it,
and it
looks like you are hiding the problem. Because of the potentially
disasterous
consequences for someone who downloaded the hacked version, you
really need to
warn them fast. (Do you have logs as to who downloaded it from you?
Can you send out
warnings?)
And are you really really sure that you got all the malware-- that
they did
not sneak in some hidden treasure elesewhere than the obvious?
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were hit by
hackers yesterday.
Vaughan's credentials were compromised, and a malware
laden upload
placed on our FossHub site. I have put a post about it
on our
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of
audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on
Audacity's home
page,
David.
We are going to be tightening up on security in
conjunction with
FossHub. Some of the work we do for this will have an
impact on
schedule for 2.1.3. We need to make it much harder for
a hacker to
place a bad download there. We also need to make it
easier for
users to
check and for us to be alerted to problems. As RM for
2.1.3 I am
making
signing of the windows installer an essential, not an
optional for
2.1.3. We need additionally to show the 'signed by'
name on the
download page. Hackers could easily sign with some
other plausible
looking credentials, so we need to guard against that.
Upping
security
will take us some time. I am estimating that getting
the signing
properly and securely sorted out will add a month to our
2.1.3
release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Arturo 'Buanzo' Busleiman
2016-08-04 18:33:23 UTC
Permalink
Bill, feel free to redact all you want. We'll put it online if the team
accepts it.
Post by Bill Unruh
Fair enough, but damage limitation is probably not a good time to start doing
a "facebook awareness campaign". At the very least, there should be an
alternative place where the same material could be looked at.
Note what little I saw of the facebook page really did not seem to me to offer
much help to someone desperately wondering how to recover from a broken MBR
and an unbootable machine (don't reboot is not useful for someone who already
has rebooted). The first many probably realised something was wrong was
when they switched on their machine the next morning. If they were
lucky they had another place to access the web. And putting obstacles in their
way (Facebook signup, or whatever) is probably not helpful.
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by Gale Andrews
Hi Bill U,
I did consider linking directly to the search result, but I thought
there was benefit too in making users aware of our Facebook
page. That is likely to evolve as the primary place to deliver
news and urgent announcements.
I did see the problem with the Facebook message but having
said "Not now" the message stops at the bottom of the page
for me. Also it is possible that there will be replies to that
Facebook post that could be worth reading.
Gale
Post by Bill Unruh
Looks good. One problem. The "More help here" pointer goes to Facebook.
Some of
Post by Gale Andrews
Post by Bill Unruh
us do not belong to Facebook, and putting an extra obstacle in the way
of
Post by Gale Andrews
Post by Bill Unruh
getting help is not a great idea in my opinion, even if only for some
people.
Post by Gale Andrews
Post by Bill Unruh
That facebook post needs to be duplicated in a format that we know they
can
Post by Gale Andrews
Post by Bill Unruh
read-- Since they are reading http we know they can read that.
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Hi
Thanks to all for the notice on the Audacity homepage, I see it has
evolved in light of feedback, which is good. I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.
Done.
Gale
Post by Martyn Shaw
Some people did download the spurious version, I know because I
knowingly did. I deleted it though.
I don't think we can know how many people did, or how much harm it has
done. More harm to FossHub I suspect, and more to their rep than
ours. I see that it was Vaughan's credentials that were used this
time, another one of us next time I guess. I also saw that 'Cult of
Peggle' apologised to Vaughan on twitter (and mis-represented Buanzo,
I believe), although that appears to have gone now. No way was this
any fault of Vaughan.
I agree with Bill's later post that none of the usual advice would
have caught this, for a user. I don't think I've seen a proposal that
would help with this kind of attack either, somebody pretending that
they are 'one of us'.
TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to
make sure
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
you
get the overlap region) it was, so that worried people can check
and be
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
relieved or panic as the case may be. It would also help to make
clear what
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
was
done to ensure that nothing slipped by. For example did they do a
test run
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
the
day before, and slip in some tiny hole into audacity that they
could use to
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
subvert it in the future? Ie, to reassure people, they need to know
lhow
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
thoroughly the infection was stemmed. They are forgiving and if
they see
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
that
you really did do a lot to make sure things are OK now, they will
even
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
forgive
a discovery that something slipped by, but if they think that the
process
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
was perfunctory, they will not. The explanation now posted does go
part way
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
there.
How sure can you be that other downloads are not at issue? Can you
point
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
people who were damaged to places where they can find out how to
recover
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
from
those damages?
The FosHub note seems to say that noone downloaded the damaged
version of
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Audacity (but did download the Shell). Is that correct? You might
ask people
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice,
is
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
really
irrelevant to the users. It was not their fault, or their using bad
passwords,
if they downloaded or ran an infected version. It may be part of
the reason
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
why the infected version was uploaded but that is in a sense your
problem,
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
not
the user's problem. The users need to know that in future your
system will
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
be
sufficiently robust, that even if a developer password is
compromised, it
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
will still not
result in the user being damaged.
Also, that link on the main page should state what it is about.
Simply
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
saying "Click here"
without explaining why, is a classic malware tactic. You need to
give them a
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
reason to click there-- telling them why they should. "Audacity
Malware
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the
past 20
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side
menu.
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
I would agree that there should be an item on the main
audacitytam.org site,
and on the audacityteam.org/download site. If you are sure
that the
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.2 is
OK, you can say that, but you have to be upfront and open
about it.
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
(Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the
Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can
easily
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
be a deathknell.
Noone will see the special web page unless they are looking
for it,
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
and it
looks like you are hiding the problem. Because of the
potentially
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
disasterous
consequences for someone who downloaded the hacked version,
you
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
really need to
warn them fast. (Do you have logs as to who downloaded it
from you?
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Can you send out
warnings?)
And are you really really sure that you got all the
malware-- that
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
they did
not sneak in some hidden treasure elesewhere than the
obvious?
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were hit by
hackers yesterday.
Vaughan's credentials were compromised, and a
malware
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
laden upload
placed on our FossHub site. I have put a post
about it
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
on our
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked
versions of
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on
Audacity's home
page,
David.
We are going to be tightening up on security in
conjunction with
FossHub. Some of the work we do for this will
have an
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
impact on
schedule for 2.1.3. We need to make it much
harder for
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
a hacker to
place a bad download there. We also need to
make it
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
easier for
users to
check and for us to be alerted to problems. As
RM for
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3 I am
making
signing of the windows installer an essential,
not an
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
optional for
2.1.3. We need additionally to show the 'signed
by'
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
name on the
download page. Hackers could easily sign with
some
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
other plausible
looking credentials, so we need to guard against
that.
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Upping
security
will take us some time. I am estimating that
getting
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
the signing
properly and securely sorted out will add a
month to our
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3
release
schedule - and it is not the only measure we
need to
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
take.
--James
------------------------------------------------------------
------------------
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------
------------------
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------
------------------
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------
------------------
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
Post by Gale Andrews
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------
------------------
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
Post by Martyn Shaw
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------
------------------
Post by Gale Andrews
Post by Bill Unruh
Post by James Crook
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------
------------------
Post by Gale Andrews
Post by Bill Unruh
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------
------------------
Post by Gale Andrews
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------
------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Bill Unruh
2016-08-04 19:27:55 UTC
Permalink
Two problems. I know nothing about Windows, and thus cannot test the advice.
And from what I have seen the recovery procedures demand that you have
installation media available ( and most laptops/computers with Windows these
days do not have installation media)

Thus, the Youtube video
http://youtu.be/DD9CvHVU7B4
which is for Windows 8/8.1 is pretty poor for any newbie. The crucial bits are about 10
seconds out of 5 min, is punctuated with mistyping, with mouse cursor all over
the place and very very fast
clicking of who knows what unless you watch is very closely. I have no idea if
this works for any but Windows 8, and in particular Windows 10.

As I see what he does, first you have to put in an installation disk (or usb I
assume), click on Next when the language screen comes up, Click on Recover on
the lower left on the next screen (not Install), Then click on Troubleshoot,
Advanced Option, Use Command Prompt. Then type onto the command line
bootrec /fixmbr
and hit Return/Enter. Then dismiss the widow by clicking on the x on the top
right of the window. You now should get a scree which again has the two options Troubleshoot
and Turn Off your PC. Click on Troubleshoot then Advanced Options then StartupRepair
and the system should boot up into Windows.

Does this work on other editions of Windows? What is the procedure for
Windows 10? or Windows XP, or...?


The other site
http://www.classicshell.net/forum/viewtopic.php?f=12&t=6434&p=28007#p28007

assumes that you have a Mint linux installation disk/usb, AND a Windows
installation disk/usb. Vitually noone will have both of those.

But I guess it is better than nothing, and it still leaves Windows 10 people
out in the cold.


So, how much of the above do you want to put onto the audacity site? But it
needs something like that to give the poor suckers who got hit some sort of
hope that everything is not lost, and audacity is trying to help.

Does anyone have any idea how many times audacity was downloaded during the
crucial time period?
Bill, feel free to redact all you want. We'll put it online if the team accepts it.
Fair enough, but damage limitation is probably not a good time  to start doing
a "facebook awareness campaign". At the very least, there should be an
alternative place where the same material could be looked at.
Note what little I saw of the facebook page really did not seem to me to offer
much help to someone desperately wondering how to recover from a broken MBR
and an unbootable machine (don't reboot is not useful for someone who already
has rebooted).  The first many probably realised something was wrong was
when they switched on their machine the next morning. If they were
lucky they had another place to access the web. And putting obstacles in their
way (Facebook signup, or whatever) is probably not helpful.
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by Gale Andrews
Hi Bill U,
I did consider linking directly to the search result, but I thought
there was benefit too in making users aware of our Facebook
page. That is likely to evolve as the primary place to deliver
news and urgent announcements.
I did see the problem with the Facebook message but having
said "Not now" the message stops at the bottom of the page
for me. Also it is possible that there will be replies to that
Facebook post that could be worth reading.
Gale
Post by Bill Unruh
Looks good. One problem. The "More help here" pointer goes to Facebook. Some of
us do not belong to Facebook, and putting an extra obstacle in the way of
getting help is not a great idea in my opinion, even if only for some people.
That facebook post needs to be duplicated in a format that we know they can
read-- Since they are reading http we know they can read that.
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
Post by James Crook
Post by Martyn Shaw
Hi
Thanks to all for the notice on the Audacity homepage, I see it has
evolved in light of feedback, which is good.  I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.
Done.
Gale
Post by Martyn Shaw
Some people did download the spurious version, I know because I
knowingly did.  I deleted it though.
I don't think we can know how many people did, or how much harm it has
done.  More harm to FossHub I suspect, and more to their rep than
ours.  I see that it was Vaughan's credentials that were used this
time, another one of us next time I guess.  I also saw that 'Cult of
Peggle' apologised to Vaughan on twitter (and mis-represented Buanzo,
I believe), although that appears to have gone now.  No way was this
any fault of Vaughan.
I agree with Bill's later post that none of the usual advice would
have caught this, for a user.  I don't think I've seen a proposal that
would help with this kind of attack either, somebody pretending that
they are 'one of us'.
TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained more
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5 to make sure
you
get the overlap region) it was, so that worried people can check and be
relieved or panic as the case may be. It would also help to make clear what
was
done to ensure that nothing slipped by. For example did they do a test run
the
day before, and slip in some tiny hole into audacity that they could use to
subvert it in the future? Ie, to reassure people, they need to know lhow
thoroughly the infection was stemmed. They are forgiving and if they see
that
you really did do a lot to make sure things are OK now, they will even
forgive
a discovery that something slipped by, but if they think that the process
was perfunctory, they will not.  The explanation now posted does go part way
there.
How sure can you be that other downloads are not at issue? Can you point
people who were damaged to places where they can find out how to recover
from
those damages?
The FosHub note seems to say that noone downloaded the damaged version of
Audacity (but did download the Shell). Is that correct? You might ask people
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good advice, is
really
irrelevant to the users. It was not their fault, or their using bad
passwords,
if they downloaded or ran an infected version. It may be part of the reason
why the infected version was uploaded but that is in a sense your problem,
not
the user's problem. The users need to know that in future your system will
be
sufficiently robust, that even if a developer password is compromised, it
will still not
result in the user  being damaged.
Also, that link on the main page should state what it is about. Simply
saying "Click here"
without explaining why, is a classic malware tactic. You need to give them a
reason to click there-- telling them why they should. "Audacity Malware
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page. Is that
visible enough? We have no interest in
hiding a security incident. I have worked with IT security for the past 20
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
       But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
       The link is right there, on the "RECENT POSTS". Left side menu.
       I would agree that there should be an item on the main
audacitytam.org site,
       and on the audacityteam.org/download site. If you are sure that the
2.1.2 is
       OK, you can say that, but you have to be upfront and open about it.
(Johson and
       Johanson re poisoned tylenol, Maple foods in Canada re the
Lysteria). Not
       being upfront (eg Blackberry-- it took 4 days for them ) can easily
be a deathknell.
       Noone will see the special web page unless they are looking for it,
and it
       looks like you are hiding the problem. Because of the potentially
disasterous
       consequences for someone who downloaded the hacked version, you
really need to
       warn them fast. (Do you have logs as to who downloaded it from you?
Can you send out
       warnings?)
       And are you really really sure that you got all the malware-- that
they did
       not sneak in some hidden treasure elesewhere than the obvious?
+1(604)822-3273
+1(604)822-5324
       UBC, Vancouver,BC _|_ Program in Cosmology |____
       Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
             On Wed, Aug 3, 2016 at 10:26 AM, James Crook
                   Many of you will already know that we were hit by
hackers yesterday.
                   Vaughan's credentials were compromised, and a malware
laden upload
                   placed on our FossHub site.  I have put a post about it
on our
                   http://www.audacityteam.org/hacked-download/
             I can't see this from Audacity's home page.
             Info that I found by googling said that the hacked versions of
audacity
             and classic shell overwrite the MBR.
             Is that the case?
             If so, there needs to be a clear warning about this on
Audacity's home
             page,
             David.
                   We are going to be tightening up on security in
conjunction with
                   FossHub.  Some of the work we do for this will have an
impact on
                   schedule for 2.1.3.  We need to make it much harder for
a hacker to
                   place a bad download there.  We also need to make it
easier for
             users to
                   check and for us to be alerted to problems.  As RM for
2.1.3 I am
             making
                   signing of the windows installer an essential, not an
optional for
                   2.1.3.  We need additionally to show the 'signed by'
name on the
                   download page.  Hackers could easily sign with some
other plausible
                   looking credentials, so we need to guard against that.
Upping
             security
                   will take us some time.  I am estimating that getting
the signing
                   properly and securely sorted out will add a month to our
2.1.3
             release
                   schedule - and it is not the only measure we need to
take.
                   --James
------------------------------------------------------------------------------
                   _______________________________________________
                   audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Gale Andrews
2016-08-04 22:15:50 UTC
Permalink
Bill U,

You can obtain installation media for Windows 8.1 and 10 direct
from Microsoft (also Windows 7 SP1 if you have a non-OEM licence
key).

There are other tools that let you download a Windows 7 or later
ISO legally from Microsoft. There are also third-party downloadable
recovery media that you can burn to CD or save to a USB stick that
let you get at a command prompt. The recovery media are small
and probably the best solution.

If any user needs direct help with this problem (none so far) there
are people on Audacity Team who are fully competent to offer help.



Gale
Post by Bill Unruh
Two problems. I know nothing about Windows, and thus cannot test the advice.
And from what I have seen the recovery procedures demand that you have
installation media available ( and most laptops/computers with Windows these
days do not have installation media)
Thus, the Youtube video
http://youtu.be/DD9CvHVU7B4
which is for Windows 8/8.1 is pretty poor for any newbie. The crucial bits are about 10
seconds out of 5 min, is punctuated with mistyping, with mouse cursor all over
the place and very very fast
clicking of who knows what unless you watch is very closely. I have no idea if
this works for any but Windows 8, and in particular Windows 10.
As I see what he does, first you have to put in an installation disk (or usb I
assume), click on Next when the language screen comes up, Click on Recover on
the lower left on the next screen (not Install), Then click on Troubleshoot,
Advanced Option, Use Command Prompt. Then type onto the command line
bootrec /fixmbr
and hit Return/Enter. Then dismiss the widow by clicking on the x on the top
right of the window. You now should get a scree which again has the two
options Troubleshoot
and Turn Off your PC. Click on Troubleshoot then Advanced Options then StartupRepair
and the system should boot up into Windows.
Does this work on other editions of Windows? What is the procedure for
Windows 10? or Windows XP, or...?
The other site
http://www.classicshell.net/forum/viewtopic.php?f=12&t=6434&p=28007#p28007
assumes that you have a Mint linux installation disk/usb, AND a Windows
installation disk/usb. Vitually noone will have both of those.
But I guess it is better than nothing, and it still leaves Windows 10 people
out in the cold.
So, how much of the above do you want to put onto the audacity site? But it
needs something like that to give the poor suckers who got hit some sort of
hope that everything is not lost, and audacity is trying to help.
Does anyone have any idea how many times audacity was downloaded during the
crucial time period?
Bill, feel free to redact all you want. We'll put it online if the team accepts it.
Fair enough, but damage limitation is probably not a good time to start doing
a "facebook awareness campaign". At the very least, there should be an
alternative place where the same material could be looked at.
Note what little I saw of the facebook page really did not seem to me to offer
much help to someone desperately wondering how to recover from a broken MBR
and an unbootable machine (don't reboot is not useful for someone who already
has rebooted). The first many probably realised something was wrong was
when they switched on their machine the next morning. If they were
lucky they had another place to access the web. And putting obstacles in their
way (Facebook signup, or whatever) is probably not helpful.
+1(604)822-3273
+1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
Post by Gale Andrews
Hi Bill U,
I did consider linking directly to the search result, but I
thought
Post by Gale Andrews
there was benefit too in making users aware of our Facebook
page. That is likely to evolve as the primary place to deliver
news and urgent announcements.
I did see the problem with the Facebook message but having
said "Not now" the message stops at the bottom of the page
for me. Also it is possible that there will be replies to that
Facebook post that could be worth reading.
Gale
Post by Bill Unruh
Looks good. One problem. The "More help here" pointer goes to
Facebook. Some of
Post by Gale Andrews
Post by Bill Unruh
us do not belong to Facebook, and putting an extra obstacle in
the way of
Post by Gale Andrews
Post by Bill Unruh
getting help is not a great idea in my opinion, even if only for
some people.
Post by Gale Andrews
Post by Bill Unruh
That facebook post needs to be duplicated in a format that we
know they can
Post by Gale Andrews
Post by Bill Unruh
read-- Since they are reading http we know they can read that.
+1(604)822-3273
+1(604)822-5324
Post by Gale Andrews
Post by Bill Unruh
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Hi
Thanks to all for the notice on the Audacity homepage, I see it
has
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
evolved in light of feedback, which is good. I also see it on
http://www.audacityteam.org/download/
but not on
http://www.audacityteam.org/download/windows/
perhaps it should be.
Done.
Gale
Post by Martyn Shaw
Some people did download the spurious version, I know because I
knowingly did. I deleted it though.
I don't think we can know how many people did, or how much harm
it has
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
done. More harm to FossHub I suspect, and more to their rep
than
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
ours. I see that it was Vaughan's credentials that were used
this
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
time, another one of us next time I guess. I also saw that
'Cult of
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Peggle' apologised to Vaughan on twitter (and mis-represented
Buanzo,
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
I believe), although that appears to have gone now. No way was
this
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
any fault of Vaughan.
I agree with Bill's later post that none of the usual advice
would
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
have caught this, for a user. I don't think I've seen a
proposal that
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
would help with this kind of attack either, somebody pretending
that
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
they are 'one of us'.
TTFN
Martyn
Post by Gale Andrews
As far as I know, nothing like as many bad Audacity downloads
got out as bad Classic Shell downloads.
But I agree with Bill's sentiments completely. I explained
more
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
at the top of the Home and Download pages.
Someone can edit further if they wish.
Gale
Post by Bill Unruh
Great. It would help to list which three hours (or make it 5
to make sure
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
you
get the overlap region) it was, so that worried people can
check and be
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
relieved or panic as the case may be. It would also help to
make clear what
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
was
done to ensure that nothing slipped by. For example did they
do a test run
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
the
day before, and slip in some tiny hole into audacity that
they could use to
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
subvert it in the future? Ie, to reassure people, they need
to know lhow
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
thoroughly the infection was stemmed. They are forgiving and
if they see
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
that
you really did do a lot to make sure things are OK now, they
will even
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
forgive
a discovery that something slipped by, but if they think that
the process
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
was perfunctory, they will not. The explanation now posted
does go part way
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
there.
How sure can you be that other downloads are not at issue?
Can you point
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
people who were damaged to places where they can find out how
to recover
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
from
those damages?
The FosHub note seems to say that noone downloaded the
damaged version of
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Audacity (but did download the Shell). Is that correct? You
might ask people
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
to notify you if they did download on Aug 2.
The "use different passwords" advice, though certainly good
advice, is
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
really
irrelevant to the users. It was not their fault, or their
using bad
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
passwords,
if they downloaded or ran an infected version. It may be part
of the reason
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
why the infected version was uploaded but that is in a sense
your problem,
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
not
the user's problem. The users need to know that in future
your system will
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
be
sufficiently robust, that even if a developer password is
compromised, it
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
will still not
result in the user being damaged.
Also, that link on the main page should state what it is
about. Simply
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
saying "Click here"
without explaining why, is a classic malware tactic. You need
to give them a
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
reason to click there-- telling them why they should.
"Audacity Malware
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Compromise on FosHub Aug 2. Please click here for more
information" or something like that.
Post by Arturo 'Buanzo' Busleiman
There. Added a very prominent link on top of the main page.
Is that
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
visible enough? We have no interest in
hiding a security incident. I have worked with IT security
for the past 20
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
years, and I *HATE* security
through obscurity and FUD.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
But I will move it to front-page for this week.
On Wed, Aug 3, 2016 at 9:06 AM, Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left
side menu.
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
On Wed, Aug 3, 2016 at 8:50 AM, Bill Unruh
I would agree that there should be an item on the main
audacitytam.org site,
and on the audacityteam.org/download site. If you are
sure that the
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.2 is
OK, you can say that, but you have to be upfront and
open about it.
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
(Johson and
Johanson re poisoned tylenol, Maple foods in Canada re
the
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them
) can easily
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
be a deathknell.
Noone will see the special web page unless they are
looking for it,
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
and it
looks like you are hiding the problem. Because of the
potentially
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
disasterous
consequences for someone who downloaded the hacked
version, you
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
really need to
warn them fast. (Do you have logs as to who downloaded
it from you?
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Can you send out
warnings?)
And are you really really sure that you got all the
malware-- that
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
they did
not sneak in some hidden treasure elesewhere than the
obvious?
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
+1(604)822-3273
+1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook
Many of you will already know that we were
hit by
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
hackers yesterday.
Vaughan's credentials were compromised,
and a malware
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
laden upload
placed on our FossHub site. I have put a
post about it
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
on our
http://www.audacityteam.org/hacked-download/
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
I can't see this from Audacity's home page.
Info that I found by googling said that the
hacked versions of
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
audacity
and classic shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about
this on
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Audacity's home
page,
David.
We are going to be tightening up on
security in
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
conjunction with
FossHub. Some of the work we do for this
will have an
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
impact on
schedule for 2.1.3. We need to make it
much harder for
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
a hacker to
place a bad download there. We also need
to make it
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
easier for
users to
check and for us to be alerted to
problems. As RM for
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3 I am
making
signing of the windows installer an
essential, not an
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
optional for
2.1.3. We need additionally to show the
'signed by'
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
name on the
download page. Hackers could easily sign
with some
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
other plausible
looking credentials, so we need to guard
against that.
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
Upping
security
will take us some time. I am estimating
that getting
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
the signing
properly and securely sorted out will add
a month to our
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
2.1.3
release
schedule - and it is not the only measure
we need to
Post by Gale Andrews
Post by Bill Unruh
Post by Martyn Shaw
Post by Gale Andrews
Post by Bill Unruh
Post by Arturo 'Buanzo' Busleiman
take.
--James
------------------------------------------------------------------------------
FossHub
2016-08-06 00:09:56 UTC
Permalink
@Bill Unruh - you and Mr. Gale Andrews were correct regarding FossHub text
from the front page "No adware, No spyware, No bundles, No malware, Fast
downloads, Free services and a single ad." which was replaced yesterday with
"FossHub experienced a security breach on 2nd August. Services were stopped
and restored on 3rd August. Our public statement can be read on reddit." and
we provided the link:
https://www.reddit.com/r/sysadmin/comments/4vzovk/fosshub_statement_regarding_2nd_august_security/

Let me explain *why* we didn't do this from the start. As Buanzo said, we
were more focused on security than PR.

However, the real reason is that we stopped almost everything to our backup
server. We closed ports, we closed the editable interface, everything was
shut down. It was a critical step that we had to take to eliminate other
potential issues.

I apologize that we didn't made the text change earlier, it was also our
wish.



--
View this message in context: http://audacity.238276.n2.nabble.com/Hacked-Download-Impact-on-Development-tp7575432p7575467.html
Sent from the audacity-devel mailing list archive at Nabble.com.

------------------------------------------------------------------------------
Vaughan Johnson
2016-08-08 04:01:04 UTC
Permalink
James: "Vaughan's credentials were compromised"


Not sure that's true, but just close my FH acct. I'm happy with that as
part of the xfr of "Treasurer". Thx.

-- V
Post by FossHub
@Bill Unruh - you and Mr. Gale Andrews were correct regarding FossHub text
from the front page "No adware, No spyware, No bundles, No malware, Fast
downloads, Free services and a single ad." which was replaced yesterday with
"FossHub experienced a security breach on 2nd August. Services were stopped
and restored on 3rd August. Our public statement can be read on reddit." and
https://www.reddit.com/r/sysadmin/comments/4vzovk/
fosshub_statement_regarding_2nd_august_security/
Let me explain *why* we didn't do this from the start. As Buanzo said, we
were more focused on security than PR.
However, the real reason is that we stopped almost everything to our backup
server. We closed ports, we closed the editable interface, everything was
shut down. It was a critical step that we had to take to eliminate other
potential issues.
I apologize that we didn't made the text change earlier, it was also our
wish.
--
View this message in context: http://audacity.238276.n2.
nabble.com/Hacked-Download-Impact-on-Development-tp7575432p7575467.html
Sent from the audacity-devel mailing list archive at Nabble.com.
------------------------------------------------------------
------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Vaughan Johnson
2016-08-08 04:02:11 UTC
Permalink
And btw, that's a team@ decision, not audacity-devel announcement, James.
-- V
Post by Vaughan Johnson
James: "Vaughan's credentials were compromised"
Not sure that's true, but just close my FH acct. I'm happy with that as
part of the xfr of "Treasurer". Thx.
-- V
Post by FossHub
@Bill Unruh - you and Mr. Gale Andrews were correct regarding FossHub text
from the front page "No adware, No spyware, No bundles, No malware, Fast
downloads, Free services and a single ad." which was replaced yesterday with
"FossHub experienced a security breach on 2nd August. Services were stopped
and restored on 3rd August. Our public statement can be read on reddit." and
https://www.reddit.com/r/sysadmin/comments/4vzovk/fosshub_
statement_regarding_2nd_august_security/
Let me explain *why* we didn't do this from the start. As Buanzo said, we
were more focused on security than PR.
However, the real reason is that we stopped almost everything to our backup
server. We closed ports, we closed the editable interface, everything was
shut down. It was a critical step that we had to take to eliminate other
potential issues.
I apologize that we didn't made the text change earlier, it was also our
wish.
--
View this message in context: http://audacity.238276.n2.nabb
le.com/Hacked-Download-Impact-on-Development-tp7575432p7575467.html
Sent from the audacity-devel mailing list archive at Nabble.com.
------------------------------------------------------------
------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Vaughan Johnson
2016-08-08 09:37:39 UTC
Permalink
hi. i heard back from Sam that it was not my fault, and yes he will just
close my acct. -- V
-- V
Post by Vaughan Johnson
James: "Vaughan's credentials were compromised"
Not sure that's true, but just close my FH acct. I'm happy with that as
part of the xfr of "Treasurer". Thx.
-- V
Post by FossHub
@Bill Unruh - you and Mr. Gale Andrews were correct regarding FossHub text
from the front page "No adware, No spyware, No bundles, No malware, Fast
downloads, Free services and a single ad." which was replaced yesterday with
"FossHub experienced a security breach on 2nd August. Services were stopped
and restored on 3rd August. Our public statement can be read on reddit." and
https://www.reddit.com/r/sysadmin/comments/4vzovk/fosshub_st
atement_regarding_2nd_august_security/
Let me explain *why* we didn't do this from the start. As Buanzo said, we
were more focused on security than PR.
However, the real reason is that we stopped almost everything to our backup
server. We closed ports, we closed the editable interface, everything was
shut down. It was a critical step that we had to take to eliminate other
potential issues.
I apologize that we didn't made the text change earlier, it was also our
wish.
--
View this message in context: http://audacity.238276.n2.nabb
le.com/Hacked-Download-Impact-on-Development-tp7575432p7575467.html
Sent from the audacity-devel mailing list archive at Nabble.com.
------------------------------------------------------------
------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Chris Share
2016-08-03 23:39:01 UTC
Permalink
I'd have to agree with the comments below. Why suggest to users to "use different passwords" when this wouldn't have made any difference in this case?
Personally I think that users would like to know how the developer password was compromised in the first place.
Just my 2c.
Cheers!



The "use different passwords" advice, though certainly good advice, is really
irrelevant to the users. It was not their fault, or their using bad passwords,
if they downloaded or ran an infected version. It may be part of the reason
why the infected version was uploaded but that is in a sense your problem, not
the user's problem. The users need to know that in future your system will be
sufficiently robust, that even if a developer password is compromised, it will still not
result in the user  being damaged.
Bill Unruh
2016-08-03 12:35:10 UTC
Permalink
iSorry, that is not sufficient. It needs to be obvious to anyone coming to
that page or to the downloads page, not burried in tiny type amongst a lot of
other stuff almost noone will look at. Ie, it needs to be in a big banner at
the top of the page which noone can miss.
Post by Arturo 'Buanzo' Busleiman
The link is right there, on the "RECENT POSTS". Left side menu.
I would agree that there should be an item on the main audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the 2.1.2 is
OK, you can say that, but you have to be upfront and open about it. (Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily be a deathknell. Noone will
see the special web page unless they are looking for it, and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you really need to
warn them fast. (Do you have logs as to who downloaded it from you? Can you send out warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
William G. Unruh __| Canadian Institute for|____ Tel: +1(604)822-3273
Physics&Astronomy _|___ Advanced Research _|____ Fax: +1(604)822-5324
Canada V6T 1Z1 ____|____ and Gravity ______|_ www.theory.physics.ubc.ca/
      Many of you will already know that we were hit by hackers yesterday.
      Vaughan's credentials were compromised, and a malware laden upload
      http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions of audacity and classic
shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home page,
David. 
      We are going to be tightening up on security in conjunction with
      FossHub.  Some of the work we do for this will have an impact on
      schedule for 2.1.3.  We need to make it much harder for a hacker to
      place a bad download there.  We also need to make it easier for users to
      check and for us to be alerted to problems.  As RM for 2.1.3 I am making
      signing of the windows installer an essential, not an optional for
      2.1.3.  We need additionally to show the 'signed by' name on the
      download page.  Hackers could easily sign with some other plausible
      looking credentials, so we need to guard against that.  Upping security
      will take us some time.  I am estimating that getting the signing
      properly and securely sorted out will add a month to our 2.1.3 release
      schedule - and it is not the only measure we need to take.
      --James
      ------------------------------------------------------------------------------
      _______________________________________________
      audacity-devel mailing list
      https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Arturo 'Buanzo' Busleiman
2016-08-03 12:51:43 UTC
Permalink
Added link notice on Downloads. Will work on the banner later (or if
someone else on Team can).
Post by Bill Unruh
iSorry, that is not sufficient. It needs to be obvious to anyone coming to
that page or to the downloads page, not burried in tiny type amongst a lot of
other stuff almost noone will look at. Ie, it needs to be in a big banner at
the top of the page which noone can miss.
The link is right there, on the "RECENT POSTS". Left side menu.
Post by Bill Unruh
I would agree that there should be an item on the main
audacitytam.org site,
and on the audacityteam.org/download site. If you are sure that the 2.1.2 is
OK, you can say that, but you have to be upfront and open about it. (Johson and
Johanson re poisoned tylenol, Maple foods in Canada re the Lysteria). Not
being upfront (eg Blackberry-- it took 4 days for them ) can easily
be a deathknell. Noone will
see the special web page unless they are looking for it, and it
looks like you are hiding the problem. Because of the potentially disasterous
consequences for someone who downloaded the hacked version, you really need to
warn them fast. (Do you have logs as to who downloaded it from you?
Can you send out warnings?)
And are you really really sure that you got all the malware-- that they did
not sneak in some hidden treasure elesewhere than the obvious?
+1(604)822-3273
+1(604)822-5324
UBC, Vancouver,BC _|_ Program in Cosmology |____
Canada V6T 1Z1 ____|____ and Gravity ______|_
www.theory.physics.ubc.ca/
On Wed, Aug 3, 2016 at 10:26 AM, James Crook <
Many of you will already know that we were hit by hackers yesterday.
Vaughan's credentials were compromised, and a malware laden upload
http://www.audacityteam.org/hacked-download/
I can't see this from Audacity's home page.
Info that I found by googling said that the hacked versions
of audacity and classic
shell overwrite the MBR.
Is that the case?
If so, there needs to be a clear warning about this on Audacity's home page,
David.
We are going to be tightening up on security in conjunction with
FossHub. Some of the work we do for this will have an impact on
schedule for 2.1.3. We need to make it much harder for a hacker to
place a bad download there. We also need to make it
easier for users to
check and for us to be alerted to problems. As RM for
2.1.3 I am making
signing of the windows installer an essential, not an optional for
2.1.3. We need additionally to show the 'signed by' name on the
download page. Hackers could easily sign with some other plausible
looking credentials, so we need to guard against that.
Upping security
will take us some time. I am estimating that getting the signing
properly and securely sorted out will add a month to our 2.1.3 release
schedule - and it is not the only measure we need to take.
--James
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
Bill Unruh
2016-08-03 22:48:54 UTC
Permalink
www.fosshub.com has nothing on their web site about the compromise. In fact
their banner still states "No malware".
I regard that as irresponsible.

Note that in the softpedia post linked at the bottom of the Audacity page there is a
pointer to how to recover from the MBR replacement. Audacity itself should
probably put those links prominently on the audacity site, just in case anyone
actually did get hurt by the Audacity hack. (Lots got hurt by the ClassicShell hack).
Just saying "sorry" is really not enough.

Giving some pointers as to how to recover might help.

http://www.classicshell.net/forum/viewtopic.php?f=12&t=6434&p=28007

and






Antivirus software would not have caught this, AFAIK. Using different
passwords on different sites would not have caught this. Firewalls would not
have caught this. I doubt that virustotal.com wouldhave caught this. Being
careful of deceptive advertising (unless you argue that Fosshub's "No Malware"
is deceptive advertising) would not have caught it. Ie, all the advice that is
given on Audacity's web page, while good advice, would have been useless in this
case and would not have protected the user and it comes dangerously close
to blaming the user.


W Unruh

------------------------------------------------------------------------------
Loading...