6 ms·

Is yt-dlp/yt-dlp compromised?

78 points by forensicnoob 2y ago

forensicnoob 2y ago
The last linux binaries ( yt-dlp_linux ) are contacting tor exit nodes and attempting to shutdown syslog starting from release 2024.10.22 according to virustotal. 3f6ab524d899f39ef46004a9db1f09ac8983aa5bd96243c417edf7c0c00627d7 yt-dlp_linux 2024.11.04 dcca6afb6ac9770d4d3425c35e415f4a8fc69b626c60f12ca899bfc05f6a72fc yt-dlp_linux 2024.10.22
- that_lurker 2y ago
  When did it do that? yt-dlp uses .onion addresses for some of the sites.
  - perihelions 2y ago
    That's not described in the documentation. Does it do that automatically or does it ask for a user action first?
- deleted 2y ago
  [deleted]
- phantomathkg 2y ago
  VirusTotal said it is ok? https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9db1f09ac8983aa5bd96243c417edf7c0c00627d7 https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9...
  - diggan 2y ago
    The only thing VirusTotal would tell you about, is already known patterns of virus/malware. If there is a novel/different way of doing something, and/or it hasn't been noticed by the AVs they're collaborating with, you'll end up with everything green. PoC Rust program that takes the contents of .npmrc and uploads it to a random IP (DONT RUN THIS! It'll steal your npm authentication token): https://gist.github.com/victorb/adf0ac8b7ada8d5a4982462e24e88265 https://gist.github.com/victorb/adf0ac8b7ada8d5a4982462e24e8... "No security vendors flagged this file as malicious" = https://www.virustotal.com/gui/file/b99b86a5ce3aa24b39ec53dd90594cbba85723851fadc0d393cca5caae671c8b https://www.virustotal.com/gui/file/b99b86a5ce3aa24b39ec53dd... But clearly, it is malicious :)
    - littlestymaar 2y ago
      I don't understand, the op claims the alert came from Virustotal.
  - forensicnoob 2y ago
    Look at other tabs https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9db1f09ac8983aa5bd96243c417edf7c0c00627d7/behavior https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9... at the bottom you can see the commands that looks like the program trying to delete down syslogs. Look also in the relations tab that shows some tor nodes.
    - blueflow 2y ago
      This is not "shutting down" rsyslog. The kill command sends a SIGHUP to rsyslog, which causes it to reopen its log files - what you are seeing is a normal logrotation, not an attempt to terminate the process. I suspect virustotal did the check in a container with a logrotation job still running, and it happened to run right in the moment when yt-dlp was being tested.
    - viraptor 2y ago
      I don't see anything trying to delete syslogs. There's a line for reloading new configuration (kill -HUP ...) - is that what you meant?
    - Faaak 2y ago
      You mean this `systemctl kill -s HUP rsyslog.service` ? This just tells syslog to reload itself
      - FergusArgyll 2y ago
        Why would yt-dlp tell syslog to reload?
        netsharc 2y ago
        It seems VirusTotal spins up a virtual machine/container to run the program, and monitors what happens inside that environment. And it further seems that during that time syslog (or something else, probably the distribution) reloaded itself. And some other process tried to connect to the TOR IPs. And since we're all amateurs here who don't understand what VirusTotal is doing, some of us think "ZOMG yt-dlp compromised?!?". If you look at the process tree, the process that reloaded rsyslog wasn't spawned from the yt-dlp_linux process.
  - 0x00cl 2y ago
    I think he might be talking about the "relations" tab. You can see the "Contacted IP addresses" section that claims to be "contacted IPs by the file uploaded to virus total". If you click the IP some will have detections and flagged as bad or criminal. https://www.virustotal.com/gui/file/dcca6afb6ac9770d4d3425c35e415f4a8fc69b626c60f12ca899bfc05f6a72fc/relations https://www.virustotal.com/gui/file/dcca6afb6ac9770d4d3425c3... Says it contacted 45.66.35.11 and you can see its a tor relay https://metrics.torproject.org/rs.html#details/7EA6EAD6FD83083C538F44038BBFA077587DD755 https://metrics.torproject.org/rs.html#details/7EA6EAD6FD830... Though haven't looked at how yt-dlp works, I'd guess yt-dlp might attempt to use tor network in case some IP or network is blocked and can't reach a server.
    - blueflow 2y ago
      Its not just a tor relay, it is one of the directory servers: https://metrics.torproject.org/rs.html#search/flag:authority https://metrics.torproject.org/rs.html#search/flag:authority
- stogot 2y ago
  Did you open an issues on their GitHub page?
  - wis 2y ago
    FWIW, It appears one of the people who saw this post asked in a comment in an issue on GitHub [1]: > @seproDev unrelated, but what you think about https://news.ycombinator.com/item?id=42040600 .. and one of the main maintainers (ranked #14th by #commits, but a recently active maintainer) replied the following: > False positive in virus total. Calling yt-dlp without any arguments makes no web requests. > To expand a bit more. Our releases are built with github runners and they report back the sha hash during build. https://github.com/yt-dlp/yt-dlp/actions/runs/11656153929 for the release from yesterday > You can see the commit that was built, what we merged in the last couple days, and the hash of the resulting files to check against the files in the release section. > Those network requests are likely just other processes on the machine. I remember windows executable would regularly show microsoft servers in the "connections made" list due to windows update and telemetry still running. [1] https://github.com/yt-dlp/yt-dlp/issues/11451#issuecomment-2454573996 https://github.com/yt-dlp/yt-dlp/issues/11451#issuecomment-2...
    - dqv 2y ago
      Can you link to the issue?
      - wis 2y ago
        Sure: https://github.com/yt-dlp/yt-dlp/issues/11451#issuecomment-2454573996 https://github.com/yt-dlp/yt-dlp/issues/11451#issuecomment-2... I edited my reply too. Edit: I'd caution against spamming the maintainers though (not caution you specifically), the possibility of that happening is what swayed me to not post the link originally.
        dqv 2y ago
        Ah yeah that makes sense. I just wanted to confirm it because I couldn't really find anything when I was searching.
- YetAnotherNick 2y ago
  Source?
- midtake 2y ago
  Can you produce some evidence, even a screenshot? It would be helpful.
- Johnnynator 2y ago
  There is nothing about stopping/killing rsyslog in thst virustotal output. `kill -s HUP` sends SIGHUP to a process (read rsyslogd(8) to know how it interprets HUP). It seems like virustotal also records unrelated processes running on that host, logrotation is a normal thing.
- datadeft 2y ago
  Is it using Tor to download content? (The second part of your comment was just normal log rotation as it turns out)
- 3np 2y ago
  If all you have is results from VirusTotal, this is a nothingburger. Dig into what those calls actually are before you cry wolf.
  - Latty 2y ago
    It's not crying wolf to ask the question (yes, leading questions can be used that way, but they are clearly asking here, not trying to imply), they presented the thing that concerned them to get eyes on it and find out if it was a problem, that seems reasonable.
    - blueflow 2y ago
      That would make it our job to teach OP critical thinking.
    - seba_dos1 2y ago
      This is a news aggregator, not a help desk. It's perfectly fair to characterize submitting such entry as "crying wolf", even when it's formulated as a question. When I browse my RSS feed from HN, I expect the items to have at least some minimal substance.
  - api 2y ago
    VirusTotal seems to be generating more false positives lately. Seems like they’re adding some poorly written heuristics. We’ve seen problems with false reports of things being infected like our own products.
nsteel 2y ago
Wouldn't it make more sense to create an issue on their GitHub repo about this?
- Imustaskforhelp 2y ago
  agreed , not sure why they think that ycombinator cares more than their official github repo page
  - diggan 2y ago
    If you believe their GitHub org/accounts to be compromised, it kind of makes sense to verify if that's true or not outside of GitHub. With that said, wouldn't hurt with a GitHub issue regardless.
never_inline 2y ago
What does this mean for `pip` wheel? I only see source files in the wheel.
perihelions 2y ago
(This green-account poster and post were auto-flagged as spam, but I've spent a [vouch] on them. Be aware that the reply comments they are writing in this thread are also hidden by default).
- DevX101 2y ago
  What's [vouch]?
  - teraflop 2y ago
    See https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html > If you see a [dead] post that shouldn't be dead, you can vouch for it. Click on its timestamp to go to its page, then click 'vouch' at the top. When enough users do this, the post is restored. There's a small karma threshold before vouch links appear.
  - ndr 2y ago
    https://github.com/minimaxir/hacker-news-undocumented?tab=readme-ov-file#flaggingvouching https://github.com/minimaxir/hacker-news-undocumented?tab=re...
- deleted 2y ago
  [deleted]
chungus 2y ago
I use this daily, and let it use browser cookies. So I hope it's not.
deleted 2y ago
[deleted]

78 points by forensicnoob 2y ago

The last linux binaries ( yt-dlp_linux ) are contacting tor exit nodes and attempting to shutdown syslog starting from release 2024.10.22 according to virustotal. 3f6ab524d899f39ef46004a9db1f09ac8983aa5bd96243c417edf7c0c00627d7 yt-dlp_linux 2024.11.04 dcca6afb6ac9770d4d3425c35e415f4a8fc69b626c60f12ca899bfc05f6a72fc yt-dlp_linux 2024.10.22

that_lurker 2y ago
When did it do that? yt-dlp uses .onion addresses for some of the sites.
- perihelions 2y ago
  That's not described in the documentation. Does it do that automatically or does it ask for a user action first?
deleted 2y ago
[deleted]
phantomathkg 2y ago
VirusTotal said it is ok? https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9db1f09ac8983aa5bd96243c417edf7c0c00627d7 https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9...
- diggan 2y ago
  The only thing VirusTotal would tell you about, is already known patterns of virus/malware. If there is a novel/different way of doing something, and/or it hasn't been noticed by the AVs they're collaborating with, you'll end up with everything green. PoC Rust program that takes the contents of .npmrc and uploads it to a random IP (DONT RUN THIS! It'll steal your npm authentication token): https://gist.github.com/victorb/adf0ac8b7ada8d5a4982462e24e88265 https://gist.github.com/victorb/adf0ac8b7ada8d5a4982462e24e8... "No security vendors flagged this file as malicious" = https://www.virustotal.com/gui/file/b99b86a5ce3aa24b39ec53dd90594cbba85723851fadc0d393cca5caae671c8b https://www.virustotal.com/gui/file/b99b86a5ce3aa24b39ec53dd... But clearly, it is malicious :)
  - littlestymaar 2y ago
    I don't understand, the op claims the alert came from Virustotal.
- forensicnoob 2y ago
  Look at other tabs https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9db1f09ac8983aa5bd96243c417edf7c0c00627d7/behavior https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9... at the bottom you can see the commands that looks like the program trying to delete down syslogs. Look also in the relations tab that shows some tor nodes.
  - blueflow 2y ago
    This is not "shutting down" rsyslog. The kill command sends a SIGHUP to rsyslog, which causes it to reopen its log files - what you are seeing is a normal logrotation, not an attempt to terminate the process. I suspect virustotal did the check in a container with a logrotation job still running, and it happened to run right in the moment when yt-dlp was being tested.
  - viraptor 2y ago
    I don't see anything trying to delete syslogs. There's a line for reloading new configuration (kill -HUP ...) - is that what you meant?
  - Faaak 2y ago
    You mean this `systemctl kill -s HUP rsyslog.service` ? This just tells syslog to reload itself
    - FergusArgyll 2y ago
      Why would yt-dlp tell syslog to reload?
      - netsharc 2y ago
        It seems VirusTotal spins up a virtual machine/container to run the program, and monitors what happens inside that environment. And it further seems that during that time syslog (or something else, probably the distribution) reloaded itself. And some other process tried to connect to the TOR IPs. And since we're all amateurs here who don't understand what VirusTotal is doing, some of us think "ZOMG yt-dlp compromised?!?". If you look at the process tree, the process that reloaded rsyslog wasn't spawned from the yt-dlp_linux process.
- 0x00cl 2y ago
  I think he might be talking about the "relations" tab. You can see the "Contacted IP addresses" section that claims to be "contacted IPs by the file uploaded to virus total". If you click the IP some will have detections and flagged as bad or criminal. https://www.virustotal.com/gui/file/dcca6afb6ac9770d4d3425c35e415f4a8fc69b626c60f12ca899bfc05f6a72fc/relations https://www.virustotal.com/gui/file/dcca6afb6ac9770d4d3425c3... Says it contacted 45.66.35.11 and you can see its a tor relay https://metrics.torproject.org/rs.html#details/7EA6EAD6FD83083C538F44038BBFA077587DD755 https://metrics.torproject.org/rs.html#details/7EA6EAD6FD830... Though haven't looked at how yt-dlp works, I'd guess yt-dlp might attempt to use tor network in case some IP or network is blocked and can't reach a server.
  - blueflow 2y ago
    Its not just a tor relay, it is one of the directory servers: https://metrics.torproject.org/rs.html#search/flag:authority https://metrics.torproject.org/rs.html#search/flag:authority
stogot 2y ago
Did you open an issues on their GitHub page?
- wis 2y ago
  FWIW, It appears one of the people who saw this post asked in a comment in an issue on GitHub [1]: > @seproDev unrelated, but what you think about https://news.ycombinator.com/item?id=42040600 .. and one of the main maintainers (ranked #14th by #commits, but a recently active maintainer) replied the following: > False positive in virus total. Calling yt-dlp without any arguments makes no web requests. > To expand a bit more. Our releases are built with github runners and they report back the sha hash during build. https://github.com/yt-dlp/yt-dlp/actions/runs/11656153929 for the release from yesterday > You can see the commit that was built, what we merged in the last couple days, and the hash of the resulting files to check against the files in the release section. > Those network requests are likely just other processes on the machine. I remember windows executable would regularly show microsoft servers in the "connections made" list due to windows update and telemetry still running. [1] https://github.com/yt-dlp/yt-dlp/issues/11451#issuecomment-2454573996 https://github.com/yt-dlp/yt-dlp/issues/11451#issuecomment-2...
  - dqv 2y ago
    Can you link to the issue?
    - wis 2y ago
      Sure: https://github.com/yt-dlp/yt-dlp/issues/11451#issuecomment-2454573996 https://github.com/yt-dlp/yt-dlp/issues/11451#issuecomment-2... I edited my reply too. Edit: I'd caution against spamming the maintainers though (not caution you specifically), the possibility of that happening is what swayed me to not post the link originally.
      - dqv 2y ago
        Ah yeah that makes sense. I just wanted to confirm it because I couldn't really find anything when I was searching.
YetAnotherNick 2y ago
Source?
midtake 2y ago
Can you produce some evidence, even a screenshot? It would be helpful.
Johnnynator 2y ago
There is nothing about stopping/killing rsyslog in thst virustotal output. `kill -s HUP` sends SIGHUP to a process (read rsyslogd(8) to know how it interprets HUP). It seems like virustotal also records unrelated processes running on that host, logrotation is a normal thing.
datadeft 2y ago
Is it using Tor to download content? (The second part of your comment was just normal log rotation as it turns out)
3np 2y ago
If all you have is results from VirusTotal, this is a nothingburger. Dig into what those calls actually are before you cry wolf.
- Latty 2y ago
  It's not crying wolf to ask the question (yes, leading questions can be used that way, but they are clearly asking here, not trying to imply), they presented the thing that concerned them to get eyes on it and find out if it was a problem, that seems reasonable.
  - blueflow 2y ago
    That would make it our job to teach OP critical thinking.
  - seba_dos1 2y ago
    This is a news aggregator, not a help desk. It's perfectly fair to characterize submitting such entry as "crying wolf", even when it's formulated as a question. When I browse my RSS feed from HN, I expect the items to have at least some minimal substance.
- api 2y ago
  VirusTotal seems to be generating more false positives lately. Seems like they’re adding some poorly written heuristics. We’ve seen problems with false reports of things being infected like our own products.

nsteel 2y ago

Wouldn't it make more sense to create an issue on their GitHub repo about this?

Imustaskforhelp 2y ago
agreed , not sure why they think that ycombinator cares more than their official github repo page
- diggan 2y ago
  If you believe their GitHub org/accounts to be compromised, it kind of makes sense to verify if that's true or not outside of GitHub. With that said, wouldn't hurt with a GitHub issue regardless.

never_inline 2y ago

What does this mean for `pip` wheel? I only see source files in the wheel.

perihelions 2y ago

(This green-account poster and post were auto-flagged as spam, but I've spent a [vouch] on them. Be aware that the reply comments they are writing in this thread are also hidden by default).

DevX101 2y ago
What's [vouch]?
- teraflop 2y ago
  See https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html > If you see a [dead] post that shouldn't be dead, you can vouch for it. Click on its timestamp to go to its page, then click 'vouch' at the top. When enough users do this, the post is restored. There's a small karma threshold before vouch links appear.
- ndr 2y ago
  https://github.com/minimaxir/hacker-news-undocumented?tab=readme-ov-file#flaggingvouching https://github.com/minimaxir/hacker-news-undocumented?tab=re...
deleted 2y ago
[deleted]

chungus 2y ago

I use this daily, and let it use browser cookies. So I hope it's not.

deleted 2y ago

[deleted]