Handbrake Developers Issue Mac Security Warning After Mirror Download Server Hack

by

HandbrakeThe developers of open source video transcoder app Handbrake have issued a security warning to Mac users after a mirror download server hosting the software was hacked.

The alert was issued on Saturday after it was discovered that the original HandBrake-1.0.7.dmg installer file on mirror server download.handbrake.fr had been replaced by a malicious file.

The affected server has been shut down for investigation, but developers are warning that users who downloaded the software from the server between 14:30 UTC May 2 and 11:00 UTC May 6 have a 50/50 chance of their system being infected by a trojan. "If you see a process called 'Activity_agent' in the OS X Activity Monitor application, you are infected," read the alert.

To remove the malware from an infected computer, users need to open up the Terminal application and run the following commands:

  • launchctl unload ~/Library/LaunchAgents/fr.handbrake.activity_agent.plist
  • rm -rf ~/Library/RenderFiles/activity_agent.app
  • if ~/Library/VideoFrameworks/ contains proton.zip, remove the folder

Users should then remove any installs of the Handbrake.app they have on their system. As an extra security recommendation, users should also change all the passwords that may reside in their OSX KeyChain or in any browser password stores.

The malware in question is a new variant of OSX.PROTON, a Mac-based remote access trojan that gives the attacker root-access privileges. Apple updated its macOS security software XProtect in February to defend against the original Proton malware. Apple initiated the process to update its XProtect definitions on Saturday and the update should already be rolling out to machines silently and automatically.

Handbrake users should note that the primary download mirror and the Handbrake website were unaffected by the hack. Downloads via the application's built-in updater with 1.0 and later are also unaffected, since these are verified by a DSA Signature and won't install if they don't pass. However, users with Handbrake 0.10.5 and earlier who used the application's built-in updater should check their system, as these versions don't have the verification feature.

For reference, HandBrake.dmg files with the following checksums are infected:
SHA1: 0935a43ca90c6c419a49e4f8f1d75e68cd70b274 / SHA256: 013623e5e50449bbdf6943549d8224a122aa6c42bd3300a1bd2b743b01ae6793

(Thanks, Alfonso!)

Top Rated Comments

Quu Avatar
46 months ago
These developers really need to setup a deamon of sorts which tests the SHA1 hash of these binaries every few hours or release their wares on the App Store.
Score: 7 Votes (Like | Disagree)
loby Avatar
46 months ago

The app is one of the best out there. I use it almost daily.

This is a great app and I too use it quite often.

It amazes me how people quickly complain and comment negatively on an open source "free" software that they don't have to pay anything for. Give them a break. This is not apple with unlimited resources and employees with high paying salaries who are expected to have everything protected and secure and perfect. They don't get paid. They were quick to reveal the issue and not hide anything.

Complainers either don't write code, or if you do, you are doing it for money. They are not. Those who use their software appreciate their hard work and appreciate their honesty to reveal the issue quickly and not hide anything so we can fix the issue on our side. This stuff happens occasionally. If you paid for the software, then "yeah"..complain. They have limited resources, so give them a break as they work hard to resolve the issue. I am sure someone had no sleep trying to quickly fix the problem and then have to go to their day job after, just to fix a free program that they offer to the world to use.

Appreciate the open source community that gives us a great program. Thanks for informing us right away so we can protect our systems and continue to use handbrake.
Score: 5 Votes (Like | Disagree)
Quu Avatar
46 months ago

Isn't Apple's code signing supposed to protect against this? Or are they not signing their builds? Or did their key get stolen?
[doublepost=1494153907][/doublepost]
No need for that exactly. Registered Mac developers can sign their code and distribute it anywhere. Most seem to do that.

That isn't secure enough because any developer can register for $99 (and the malware authors do too) then they just re-sign their new binary with the bought certificate and as-long as no one notices it will fly under the radar.

The developers themselves need to maintain hashes are correct.
Score: 5 Votes (Like | Disagree)
bladerunner2000 Avatar
46 months ago

Guess it's an indication that using the tool won't make any sense either... fair game.

The app is one of the best out there. I use it almost daily.
Score: 4 Votes (Like | Disagree)
Gannet Avatar
46 months ago
Handbrake is an excellent program that has served me well over the years and I have great respect for the developers. Security slip-ups can happen to anyone and I'm sure they will take the necessary measures to improve this for future.

That said, I'm posting because I nearly got caught by this. I download Handbrake last week and was surprised to see a dialog on launch asking me to enter my password to "install additional codecs". As a longtime Handbrake user I was certain that this was *not* normal, so I declined. Shortly afterword I was shown another dialog, independent from Handbrake, purporting to be from the system "Network Configuration" which needed my password to "update DHCP settings". As this was also something I was unfamiliar with, I again declined but the dialog immediately reappeared upon clicking cancel and I had to restart the computer to make it go away. So yeah, if you see any suspicious password dialogs, do NOT enter your password.

Attachment Image
Score: 4 Votes (Like | Disagree)
cashinstinct Avatar
46 months ago
Many developpers would have simply not said anything.

I applaud them for telling it like it is, and finding solutions.

Pretty sure many apps are affected by such issues, but either they don't find out / don't say to their users.
Score: 4 Votes (Like | Disagree)

Top Stories

0 Deals Hero

Black Friday 2020: Best Apple Deals to Plan For

Saturday November 21, 2020 10:00 am PST by
In the lead-up to Black Friday next week, we've been putting a spotlight on the best deals coming from various retailers like Best Buy and Walmart. In an effort to further prepare our readers for the best Black Friday deals, we're breaking down what we think should be on your radar for Black Friday in 2020. Note: MacRumors is an affiliate partner with some of these vendors. When you click a...
m1 mac mini vignette

Apple Lists M1-Based Mac Mini Logic Boards With 10 Gigabit Ethernet in Internal Parts Ordering System

Friday November 20, 2020 9:32 am PST by
While the new Mac mini with the M1 chip is only available with Gigabit Ethernet, Apple has listed multiple M1-based Mac mini logic boards with 10 Gigabit Ethernet in an internal parts list for Apple Authorized Service Providers. For every Mac mini logic board with Gigabit Ethernet in the parts list, obtained by MacRumors, there is a corresponding logic board with 10 Gigabit Ethernet:...
new m1 chip

Craig Federighi: Native Windows on M1 Macs is 'Really up to Microsoft'

Friday November 20, 2020 11:57 am PST by
Following the release of the M1 Macs Apple executives have been doing interviews with a range of publications, and today, Ars Technica published another interview with software engineering chief Craig Federighi, hardware technologies lead Johny Srouji, and marketing VP Greg Joswiak. Much of the interview focuses on topics that the three have already covered in prior discussions, but there is ...
14

Apple Releases iOS 14.2.1 With Fix for Text Message Bug and iPhone 12 Mini Lock Screen Issues

Thursday November 19, 2020 10:16 am PST by
Apple today released iOS 14.2.1, a bug fix update that comes two weeks after the launch of iOS 14.2 and is available for Apple's new iPhone 12 models. The iOS 14.2.1 update can be downloaded for free and it is available on all eligible devices over-the-air in the Settings app. To access the new software, go to Settings > General > Software Update. According to Apple's release notes, iOS...
Walmart November Deals Hero

Black Friday Spotlight: Walmart Will Have AirPods Pro Down to Lowest Price of $169, and More Apple Deals

Thursday November 19, 2020 8:05 am PST by
We've been tracking early Black Friday deals in our dedicated Black Friday Roundup, and in an effort to prepare our readers for the big shopping event we're highlighting sales store-by-store in the lead-up to November 27. Note: MacRumors is an affiliate partner with Walmart. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Next ...
apple leather sleeve

Leather Sleeve for iPhone 12 Models Now Available From Apple

Friday November 20, 2020 12:16 pm PST by
Apple today began selling the Leather Sleeve for the new iPhone 12 models, with the accessory having first been announced alongside the updated iPhones in October. Priced at $129, the Leather Sleeve is not a case and is designed to be removed when the iPhone is in use. It features a cutout at the front that displays the time, and it comes with a matching leather strap. According to Apple, it ...
iOS14AntitrackFacebookSadfeature

Apple Confirms Commitment to App Tracking Transparency in Letter Condemning Facebook's Data Collection [Updated]

Thursday November 19, 2020 11:58 am PST by
Apple in iOS 14 is planning to introduce a new App Tracking Transparency feature that will let users know when companies want to track them across apps and website. Following outcry from developers like Facebook and ad networks unprepared for the change, Apple delayed the implementation of the anti-tracking functionality until early 2021. Eight civil society organizations recently sent a...
maxresdefault

CrossOver Allows x86 Windows Apps to Run on Apple M1 Macs

Wednesday November 18, 2020 6:07 pm PST by
Codeweavers posted a blog post and video tonight showing off CrossOver running on an Apple M1 MacBook Air. This video shows Team Fortress 2 running on a new M1 MacBook Air: CrossOver is software (based on Wine Project) that runs Microsoft Windows apps on the Mac by translating Windows APIs into their Mac equivalents. The Codeweavers team was able to run the current version of CrossOver on...
macbookpro13large

Apple Offers Instructions on What to Do if macOS Big Sur Causes Installation Errors on 2013 and 2014 MacBook Pro

Thursday November 19, 2020 6:12 pm PST by
Following the release of macOS Big Sur last week, a number of 2013 and 2014 MacBook Pro owners found that the update bricked their machines. Affected users saw their Macs get stuck displaying a black screen after attempting to install the new software. Apple has now addressed this issue in a new support document that provides instructions on what to do if macOS Big Sur can't be installed on...
128gb m1 macbook air education cropped

$799 M1 MacBook Air With 128GB Storage for Education Institutions Spotted Online

Friday November 20, 2020 5:15 am PST by
A new configuration of the M1 MacBook Air with 128GB of storage and a lower $799 price has today been spotted on Apple's U.S. Education Institution Hardware and Software Price List. The M1 MacBook Air is only available with 256GB, 512GB, 1TB, or 2TB of storage. There is currently no 128GB configuration on the Apple Store. However, Reddit user "u/dduci97" noticed that Apple has listed...