14 ms·
Trojan found in Filezilla downloaded from SourceForge
- deleted 11y ago[deleted]
- jug 11y agoAFAIK this practice (and not on the FileZilla project alone) is why uBlock Origin is blocking SourceForge.
- bigbugbag 11y agoThough ublock origin can use it, it's the ublock badware risks filter list which is blocking sourceforge : https://github.com/gorhill/uBlock/wiki/Badware-risks https://github.com/gorhill/uBlock/wiki/Badware-risks
- gorhill 11y agoYou are linking to uBlock Origin ("uBO") -- that filter list is specific to uBO. The other "uBlock"[1] (abandonware) does not support strict blocking, which is what blocks SourceForge. [1] https://github.com/chrisaljoudi/uBlock https://github.com/chrisaljoudi/uBlock
- bigbugbag 11y agoSorry if I didn't make myself clear, what I was trying to point out is that for ublock origin to block sourceforge the badware risk filter list has to be enabled. Also I suppose this list can used with other blocking software. Oh and gorhill, much much thanks for your time and work on this.
- gnud 11y agoThat's the github project for uBlock Origin.
- chris_wot 11y agoThis has been known about for some time. The Filezilla guys know about it. http://sourceforge.net/blog/devshare-relaunch-power-to-end-users/ http://sourceforge.net/blog/devshare-relaunch-power-to-end-u...
- facepalm 11y agoShouldn't this be a criminal offense?
- chris_wot 11y agoIt's usually hidden in the EULA. Very hidden. It's not just Filezilla or sourceforge doing this. Lenovo do this routinely. They used to bundle something called BrowserGuard, which contains a PUP by Conduit. Conduit have since been partially acquired by another company Perion. I followed that rabbit hole last year, Lenovo point blank refuse to acknowledge it is spyware. And it IS spyware. I created a Perion account to see what they actually had going on. They have an online form you can upload your executable to and it wraps their malware in the form of a toolbar. I tested it by uploading notepad.exe, and sure enough it works quite easily. They capture your location and a whole bunch of data about your computer. They also have remote update facilities built into it. It's pernicious, and the company structure has been designed to make it very hard to determine who owns it. And Lenovo were very happy to use them. Oh, and here is an article that confirms the autoupdate: https://support.lenovo.com/au/en/documents/ht101178 https://support.lenovo.com/au/en/documents/ht101178
- facepalm 11y agoGood to know - I was almost ready to consider Lenovo again after Superfish, but no...
- throwaway7767 11y agoYou should generally not trust preinstalled OSs, regardless of vendor. Most (all?) of them shovel crap in there, often because they get paid to do it. It's sad, but it's just the world we live in. The really scary thing is when vendors put in backdoors or trojans like this at a level below the OS (in UEFI, for example).
- nthcolumn 11y agoPeople are still using SourceForge? :O
- vermilingua 11y agoAs far as the password storage goes, you are not up-to-date. They are stored base64-encoded now. Yes, much better.
- scrollaway 11y agoFTP passwords can't be hashed. The right solution would be to support platform keyrings but ... https://trac.filezilla-project.org/ticket/1373 https://trac.filezilla-project.org/ticket/1373
- joopxiv 11y agoSomeone explained that after he got some malware on his computer and subsequently all his websites were hacked. The response? Once you've got malware on your computer, you've lost already, game over. You need to prevent the infection in the first place. OMFG...
- lmm 11y agoThat's correct though. Even if the passwords weren't stored at all, malware could just install a keylogger and record them when you typed them in.
- joopxiv 11y agoThe fact that there are ways to obtain passwords even when they are not stored unencrypted is not really a reason to make it as easy as possible for malware to get every password on your system.
- DanBC 11y agoNo, you're wrong. If you've run malware on your machine then it's not your machine anymore. This is exactly the thing that Google spent months trying to tell people when it was refusing to include password access to the password list. That extra password does nothing to increase security, and may be counter productive.
- Jonnerz 11y agoIt's done intentionally to make the owners a bit of money. They have direct download links on their website (click show all on download page), avoid the green Sourceforge link.
- huuu 11y agoNope, all links direct to Sourceforge.
- level3 11y agoYes, all the downloads are hosted on Sourceforge, but Jonnerz is pointing out that the additional links come without the Sourceforge wrapper (the links will have "?nowrap" at the end). We all wish FileZilla would just drop Sourceforge completely, but at least the non-wrapped versions are still available.
- Jonnerz 11y agoSorry I meant direct to the FileZilla installer rather than the Sourceforge installer. Both are hosted on Sourceforge.
- scrollaway 11y agoSomething came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt (http://lxqt.org http://lxqt.org). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatingly painful. Email is not fun to deal with. So I'm pitching this to bored devs and entrepreneurs: Help us, and many other projects, by creating a "Github for mailing lists" with a web client featuring a clean high quality UI, easily browsable/linkable archives, etc. Make it open source, make it self-hostable, stuff in enterprise support. Make it quick and easy to create new lists. This model can work. It's not unheard of either (cf. Discourse), but it just hasn't been executed properly yet, or is forum-only and does not support email properly. Right now, the UX of mailing list software is like IRC's. Very raw. If it were made more seamless, more approachable, overall easier, it would have a similar effect as Slack has had on unthreaded-async-topical-conversation. PS: You should change your adblocker to uBlock Origin. It blocks Sourceforge as a malware risk.
- cuillevel3 11y agoDoes http://librelist.com/ http://librelist.com/ match your requirements? "It is a place for FOSS communities to discuss all the things they want without ads, censorship, signup requirements, bundled apps, or requirements that you use any particular email client or service."
- scrollaway 11y agoNot even close. Librelist's UX does not at all match what I describe.
- astrodust 11y agoDoes it install trojans in your binaries?
- 11y ago
- jmnicolas 11y agoNo way I'm supporting this kind of behavior. Can you suggest an alternative to FileZilla ?
- teddyh 11y agoThe problem is not FileZilla, but SourceForge. They do this to all their files.
- kardos 11y agoThat's not quite accurate... FileZilla has opted into the bundle-with-crapware program [1] to make some money. [1] https://news.ycombinator.com/item?id=8849950 https://news.ycombinator.com/item?id=8849950
- luma 11y agoNot only that, but the FileZilla Admin is posting in that thread denying any claim that there is anything wrong with the installer, despite repeated reports from multiple users. FileZilla is maintained by people who want to push spyware to you because it's how they get paid. This isn't an accident.
- maaarghk 11y agoSourceForge are adding the malware but the FileZilla people are acting as if it's not a problem and refusing to help people / accept that there is an actual virus in the executable they link on their site. "It's not our problem, it's SourceForge" - stop f'ing using SourceForge then! Their ambivalence and complicity in distributing this malware is probably the behaviour GP was talking about.
- rmc 11y agoThe problem is that Google still rank SourceForge highly. If Google ranked them down, then they harm would be limited.
- halviti 11y agoI had contacted FileZilla's developer about this back in 2014. He let me know that bundling crapware was "intentional" http://i.imgur.com/AvfDuOA.png http://i.imgur.com/AvfDuOA.png His statement about alternate download links was also incorrect, because I was asking about Filezilla server, which I could not find anywhere but sourceforge.
- nissehulth 11y agoOlder thread about Sourceforge: https://news.ycombinator.com/item?id=9623142 https://news.ycombinator.com/item?id=9623142 Just don't use them.
- halfdan 11y agoAbsolute money quote: "As far as the password storage goes, you are not up-to-date. They are stored base64-encoded now."
- Asbostos 11y agoThere's the argument that if someone has access to the passwords then they've already got enough control over the computer to do whatever other damage they like - like reading them out of memory after they're decrypted. Base64 at least provides some protection against somebody looking at it with their eyes and memorizing them, which is perhaps a more likely scenario - family members, kids, etc.
- redbeard0x0a 11y agoBase64 provides no protection from malware that infects your machine and actively looks for this kind of stuff. Stored passwords from websites, ftp programs, key safes, etc.
- aw3c2 11y ago> 2015-04-20
- agildehaus 11y agoSourceForge and Filezilla are both on their way out, hence their owners desire to monetize their remaining users while they still can. WinSCP is a decent alternative. As is Swish: http://www.swish-sftp.org/ http://www.swish-sftp.org/ https://github.com/alamaison/swish https://github.com/alamaison/swish
- Asbostos 11y agoOn Windows, you don't always need a 3rd party FTP program. Windows Explorer (not IE) already does FTP. Just open any folder and type ftp://example.com into the path bar.
- pmlnr 11y agoOr you type 'ftp' in the command line.
- abcd_f 11y agoIt doesn't come standard, not on all Windows flavours. It's a part of "Core networking utilities" package that used to have some really odd dependencies.
- UnoriginalGuy 11y agoYou're mis-remembering or something... There's no such thing as a "Core Networking Utilities" package on Windows (never has been) and ftp has been a command line tool since at least Windows 95. I don't particularly like the built in FTP command line utility (even with scripts). But it has existed a very long time indeed.
- abcd_f 11y agoDamn, I think you are right. Just checked on W7 and it must've been telnet and/or tftp that I was thinking about. ftp does seem to come standard.
- 11y ago
- DanBC 11y ago> If someone really wanted to download FileZilla and skip the malware do just that. > Then after installation is complete install Malware bytes and Avira. Scan with both and restart the computer. > Then run with ADWcleaner and and remove the infections and restart. should be good from there and enjoy FileZilla. Do people really think this works? I mean, there's no-one on HN who thinks this works, right?
- krylon 11y agoEven if it works, that sounds telling somebody to park their car crashing it into a wall and then scraping off the pieces.
- JupiterMoon 11y agoA depressing number of my friends and family have an absolute trust in their security software and will rely on it to do exactly this.
- kyriakos 11y agoyou can get a clean version from fosshub
- acd 11y agoThere is a safer way install FileZilla through ninite installer or chocolately https://ninite.com/filezilla https://ninite.com/filezilla Chocolatey nuget is similar to Linux package managers but for Windows programs https://chocolatey.org https://chocolatey.org choco install filezilla
- manveru 11y agoPlease don't recommend chocolatey for this reason. While it's excellent, you should probably check the install file first: https://chocolatey.org/packages/filezilla https://chocolatey.org/packages/filezilla (and click "show" on "tools\chocolateyInstall.ps1") You don't see the installer UI, but it still downloads from sourceforge because that's where the executables are stored.
- teh_klev 11y agoUnless ninite is building everything from source where do you think it's getting the installer binaries?
- dublinben 11y agoIt's much easier to simply download the portable version (without malware) from FossHub. http://www.fosshub.com/FileZilla.html http://www.fosshub.com/FileZilla.html
- jokoon 11y agoClicking on the download link ws blocked by ublock origin. Weird.
- ccozan 11y agouBlock Origin indeed blocks the sourceforge URLs. Not a bad idea, I would say. Makes you think twice.
- AdmiralAsshat 11y agoAfter the last Sourceforge malware-bundling debacle (Can't even remember who it was at this point--someone who said Sourceforge seized their repo from them and then repackaged it with malware), gorhill added Sourceforge to the uBlock blacklists. Good riddance, I say.
- kuschku 11y agoIt was the GIMP guys, btw.
- cpach 11y agoAbout two hours ago I pondered installing the Diffuse merge tool[0] on a Windows box. Then I noticed that it was hosted on Sourceforge and thought "nah, not really worth the risk". Now that I see this post I feel even more content that I avoided Sourceforge. [0] hxxp://diffuse.sourceforge.net/
- rogeryu 11y agoThat article is from April. Good to know about it, but is this news?
- brainary 11y agoFirst post on the thread is indeed old, but there are some newer ones.
- morganvachon 11y agoI stopped using Filezilla on Windows a while back, due to this and other issues (passwords stored in plaintext, etc.) and switched to PSFTP and PSCP, which are MIT licensed and offered directly from the developer's page[1]. However, reading this article reminded me that Filezilla was actually still installed on that box, just not in use, so I decided to uninstall it while it was on my mind. Immediately after uninstalling it, it tried to force a shutdown on my computer. The only reason I was able to stop it was because I had a process running in the background that wouldn't terminate and I was given the choice by Windows to force shutdown or cancel. Now, I've only ever installed it from ninite.com[2], so I know it didn't initially have the Sourceforge trojan/adware junk. However, I've since allowed it to download its own updates instead of doing it manually through the Ninite downloader. I've never, ever seen a program I've uninstalled via the Windows Control Panel with the ability to force a shutdown or restart without first notifying me or giving me the option to postpone. I'm starting to think there's something nefarious in Filezilla itself, perhaps in one of those "direct from the developer" updates, not just the Sourceforge wrapper. Another interesting thing is that the built in Filezilla updater will first uninstall the app before reinstalling the updated version, and it never tried to restart or shutdown the computer during those updates, only during uninstallation from the Control Panel. [1] http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html http://www.chiark.greenend.org.uk/~sgtatham/putty/download.h... [2] Ninite strips out any malware or other crap from the installer and only installs the pure program with default settings, in the background, and sources the app directly from the developer's site when possible. It's my go-to tool for essential Windows utilities.
- deleted 11y ago[deleted]
- vels 11y agoDoes this trojan target OSX or Windows (or both) i couldnt see it mentioned anywhere
- deleted 11y ago[deleted]
- jedicoffee 11y ago"While the SourceForge Installer may present third-party offers," Don't worry, it's just an "offer". They're totally not distributing malware via their installer.
- gargalatas 11y agoUnfortunately Filezilla has this trojan for some years now! The trojan send all your identities to a server. This is tested 100%. We had many passwords stolen this way and we are 100% sure that it's filezilla. Just take this test: Try to download the Filezilla and when the download page shows click on the Direct Link. Then compare the two executables, one that downloaded automatically and the one that it downloaded via the direct link. You will see that the direct download is clean but the other has the SF icon and it has a virus!
- blablabla123 11y ago...well not mine anymore, I uninstalled it... ;) It's easy to blame Sourceforge. But Filezilla is not a SourceForge project and they can choose whatever hosting they want. I wonder what else they missed on.
- driverdan 11y agoThat's a pretty serious claim. Do you actually have evidence to prove it was FZ? Just because the SF executable includes spyware doesn't mean it's disclosing passwords.
- gargalatas 11y agoYou are kidding right? And what do you think that spyware does? They steal passwords! Our DC warns us of stolen passwords every time a client is using this exactly "touched" version of FZ. The DC is informed by a security firm and 100% of the situations is the Filezilla that steals them!
- Relys 11y agoYou're 100% sure? I would expect to see registry diffs before/after FileZilla was installed, disassembled code of the subroutine accessing your passwords in the malicious program, and a network packet capture of your data being sent over the wire.
- discreditable 11y agoThe linked thread is from 2015-04-20. SourceForge has been bundling adware with Filezilla since then and continues to do so. Here's a VirusTotal analysis of the current installer: https://www.virustotal.com/en/file/16e0ecda06ed98f835e449e1e3e58959df60703c0262e357f5bcc0c3db9fae97/analysis/1449152400/ https://www.virustotal.com/en/file/16e0ecda06ed98f835e449e1e... If you want clean software you must not install directly from Sourceforge.
- FussyZeus 11y agoRefuse to download anything from SourceForge anymore. Sad too, used to be the best out there back in the day.
- Karunamon 11y agoWhat really gets me is the glib attitude of the FileZilla maintainers to this news. Whether trojan or adware, the "just uncheck the boxes" mindset is rather insulting. Move your stuff off Sourceforge! What the hell is wrong with your people?
- DanBC 11y agoFilezilla opted in to the malware wrapper. They made a concious decision to do this.
- elipsey 11y agoThe Filezilla forum admin in that thread obstinately blames users for "accidentally" accepting a bundeled "offer", when users are clearly warning project admins that the installer is infected with malware. Does sourceforge share revenue from bundeled installs with projects?
- kuschku 11y agoIf you opt-in, they do. Filezilla was one of the first to opt-in. If you say "no, I don’t want you to bundle your installer with my project", they will do so anyway (look at GIMP), and you get nothing.
- elipsey 11y agoso yeah, it seems like there's kind of a conflict of interest here. if there's no way for a user to know whether the project opted in to revenue sharing, then how can they trust the project? in other words, in my view, a project that opts in to revenue sharing with crapware bundlers who are known to sometimes distrubute malware, is behaving unethically. so now i don't trust filezilla dev's in general, even if i get an package signed by my distro or whatever. very dissapointing. worse still, it makes projects that didn't opt in suspect in my view, simply because they are on sourceforge; if i can't find out whether they opted in, how can i know any project isn't taking kickbacks? i really hope i'm missing something here....
- kuschku 11y agoFor your information, currently sourceforge "usually" only bundles the crapware with projects where either the person opted in, or where sourceforge has "seized" the repo. If it bundles crapware, and the maintainer listed on sourceforge.net is sourceforge itself, they didn’t opt in. Otherwise they did.
- robgibbons 11y agoIt's funny, I literally just messaged the maintainer of the Minibian project, politely asking that he move the Minibian project away from Sourceforge, when I saw this post on HN. It's too bad to see Sourceforge ending up like this, after it was so useful years back.
- rietta 11y agoIt would seem that more projects would benefit from running their own free software on their own virtual server infrastructure. A decade ago, there was GNU Mailman and it's still around - http://www.list.org http://www.list.org. Yes, this means that a self-contained project needs the funds for basic hosting and also someone with system admin experience. But that should not be unreachable for major projects.
- jron 11y agoTim Kosse has really tarnished the reputation of FileZilla by ignoring the SourceForge malware problem. Chrome and Firefox should add SourceForge to their malicious site list.
- AJ007 11y agoThere are a few things that could happen: a) Certainly if a site is distributing malware/virus/trojans it needs to be flagged as such -- whether it is intentional or not. b) Sourceforge's policies indicate it they are no longer a trusted source for official files and is probably being ranked far too highly on Google and other search engines. c) If Dice fails to promptly and adequately address the distribution of malicious files for profit the appropriate government agencies should become involved.
- jdeisenberg 11y agoSlightly O/T, but has anyone experienced similar problems with downloads from PortableApps.com? They use SourceForge as well, and I am now hesitant to recommend PortableApps to friends and co-workers.
- rbanffy 11y agoAre we still using FTP?
- CM30 11y agoSo SourceForge has gone from terrible to (somehow) even worse than that. It makes me wonder; why don't we have a good site for Windows programs yet? Ideally, it'd be run by volunteers (not a company with a profit motive), would manually moderate the programs posted them (and remove any adware/spyware/bundled programs by force if necessary) and tell every malware ridden sleazy ad network to sod off. It exists in more niche subject areas. If I look for game making resources, a lot of those sites actually do proper moderation and try and make sure viruses aren't present in uploads. Places like MFGG are pretty good about this. So why don't we have that for software in general? I mean, there's GitHub and package managers, but it's disappointing how this market has no honest people in it.