4 ms·
I once saw a google search ad result for a malware version of GNU Cash. It was extremely easy to miss. The website was identical except the Windows download was
by mastax 4y ago
I once saw a google search ad result for a malware version of GNU Cash. It was extremely easy to miss. The website was identical except the Windows download was replaced with malware instead of linking to Sourceforge. The malware installer was signed with a key from a random Taiwanese electronics company (likely stolen). I emailed DigiCert and got the cert revoked. None of the scanners on VirusTotal flagged the installer. A GNU Cash malware wouldn't need to do any typical malware behavior (crypto mining, ransomware) because they could just send off your bank account credentials. Within half an hour of uploading to VirusTotal the website was replaced with a placeholder blog.
- BeefWellington 4y agoYeah, especially with open-source stuff it's been a problem for a while. The GIMP team is regularly targeted this way and has been for years. 2022: https://www.bleepingcomputer.com/news/security/google-ad-for-gimporg-served-info-stealing-malware-via-lookalike-site/ https://www.bleepingcomputer.com/news/security/google-ad-for... 2015: (The SourceForge Fiasco) https://www.gimp.org/news/2015/05/27/gimp-projects-official-statement-on-sourceforges-actions/ https://www.gimp.org/news/2015/05/27/gimp-projects-official-... 2013: https://www.gimpusers.com/forums/gimp-user/15999-adware-malware-in-gimp-windows-distribution https://www.gimpusers.com/forums/gimp-user/15999-adware-malw...