Source Code for Several Panic Apps Stolen via HandBrake Malware Attack

In early May, a mirror download server hosting popular Mac transcoder app HandBrake was hacked, and the legitimate version of HandBrake was replaced with a version infected with OSX.PROTON, a remote access trojan giving hackers root-access privileges to a Mac.

In a blog post shared today, Panic Inc. developer and co-founder Steven Frank said he downloaded the infected version of HandBrake, which led to the theft of much of the source code behind Panic's apps. Panic offers several apps, including web editor Coda, FTP app Transmit, SSH client Prompt, and Firewatch, an adventure game.


Hackers accessed Frank's computer through the infected HandBrake software and were able to obtain his usernames and passwords, including login information for Github. Several source code repositories were cloned by the attackers, who have demanded "a large bitcoin ransom" to stop the release of the source code, a ransom Panic does not intend to pay.

While Panic's source code has been stolen, the company says that a careful review of its logs indicates that the theft was the extent of the damage - the hacker did not access customer information or Panic Sync Data.
- There's no indication any customer information was obtained by the attacker.
- Furthermore, there's no indication Panic Sync data was accessed.
- Finally, our web server was not compromised.

(As a reminder, we never store credit card numbers since we process them with Stripe, and all Panic Sync data is encrypted in such a way that even we can't see it.)
According to Panic, the source code for the apps could potentially be used by hackers to create malware-infected builds of the company's apps, so users should be vigilant and download Panic apps only from the company's website or the Mac App Store.

Panic has been in contact with both the FBI and Apple. Apple's security team is "standing by to quickly shut down any stolen/malware-infested versions" of Panic apps that are discovered, while the FBI is actively investigating the attack.

Panic is asking customers to notify the company of any unofficial or cracked versions of Panic apps that are discovered in the wild, as any such content is likely infected with malware.


Discuss this article in our forums

Video Converter ‘Handbrake 1.0’ Released for Mac After 13 Years in Beta

Cross-platform video transcoder Handbrake reached a milestone over the holiday break with the release of version 1.0.0 of the app after over 13 years in beta.

Despite the lengthy beta-test format and the demise of the built-in DVD drive in Apple's Mac line-up, the free open source transcoder has remained the go-to application for converting video files for playback on iOS devices and Apple TVs.

handbrake
The program has stood the test of time thanks to its ease of use, vast array of options for more advanced users, and extensive video format support.

Version 1 brings a raft of new tools to the Mac version of the app, with updated presets for the latest devices and a number of interface improvements and added settings to keep the app relevant and broaden its appeal. The new features include:

- Updated all tooltips
- Added undo/redo support to the graphical interface
- Improved drag and drop support
- Added Open Recent to the File menu
- Added Add Titles to Queue... to the File menu (batch queueing)
- Preview prompts to open in an external application when the internal player does not support the format
- Preview now displays volume and audio/subtitles language selection during playback
- Picture and Filters settings are now part of the main window
- Settings are preserved when selecting a new title (instead of reloading the last selected preset)
- Improved support for importing/exporting comma-separated (.csv) chapter markers
- Queue is now automatically paused when available disk space is low
- When Done action can now be changed directly from the Queue window
- When Done notification is now interactive (reveals the encoded file in Finder)
- Activity Log window is now searchable (press "?"+"f" to activate)
- XQuartz is no longer required for subtitle burn-in
- Updated Sparkle software update library
  - Enabled DSA signature checking for improved security
- Usability improvements
- Miscellaneous bug fixes


Handbrake is a free download available directly from the Handbrake website.

Tag: Handbrake

Discuss this article in our forums