5 ms·

Hackers breach JDownloader's website to serve malware-laced downloads

119 points by bundie 5mo ago

bundie 5mo ago
u/rubi2333 uploaded the malicious files to virustotal.com JDownloader2Setup_windows-amd64_v1_8_0_482.exe: https://www.virustotal.com/gui/file/5a6636ce490789d7f26aaa86e50bd65c7330f8e6a7c32418740c1d009fb12ef3 https://www.virustotal.com/gui/file/5a6636ce490789d7f26aaa86... JDownloader2Setup_windows-amd64_v11_0_30.exe: https://www.virustotal.com/gui/file/fb1e3fe4d18927ff82cffb3f82a0b4ffb7280c85db5a8a8b6f6a1ac30a7e7ed9 https://www.virustotal.com/gui/file/fb1e3fe4d18927ff82cffb3f... JDownloader2Setup_windows-amd64_v17_0_18.exe: https://www.virustotal.com/gui/file/04cb9f0bca6e0e4ed30bc92726590724bf60938440b3825252657d1b3af45495 https://www.virustotal.com/gui/file/04cb9f0bca6e0e4ed30bc927... JDownloader2Setup_windows-amd64_v21_0_10.exe: https://www.virustotal.com/gui/file/32891c0080442bf0a0c5658ada2c3845435b4e09b114599a516248723aad7805 https://www.virustotal.com/gui/file/32891c0080442bf0a0c5658a... JDownloader2Setup_windows-x86_v1_8_0_472.exe: https://www.virustotal.com/gui/file/4ff7eec9e69b6008b77de1b6e5c0d18aa717f625458d80da610cb170c784e97c https://www.virustotal.com/gui/file/4ff7eec9e69b6008b77de1b6... JDownloader2Setup_windows-x86_v11_0_29.exe: https://www.virustotal.com/gui/file/de8b2bdfc61d63585329b8cfca2a012476b46387435410b995aeae5b502bd95e https://www.virustotal.com/gui/file/de8b2bdfc61d63585329b8cf... JDownloader2Setup_windows-x86_v17_0_17.exe: https://www.virustotal.com/gui/file/e4a20f746b7dd19b8d9601b884e67c8166ea9676b917adea6833b695ba13de16 https://www.virustotal.com/gui/file/e4a20f746b7dd19b8d9601b8... JDownloader2Setup_unix_nojre.sh: https://www.virustotal.com/gui/file/6d975c05ef7a164707fa359284a31bfe0b1681fe0319819cb9e2c4eec2a1a8af https://www.virustotal.com/gui/file/6d975c05ef7a164707fa3592...
- salomonk_mur 5mo ago
  What? How would you know it was them?
  - Retr0id 5mo ago
    Comparing the hashes would be one way
Our_Benefactors 5mo ago
I’ve never run into a program that manages to disregard as many UX best practices as Jdownloader. It has more maddening features than I can count. Even stuff like sorting a column by date doesn’t work how you would want it to, because it applies some “package grouping”. It’s the epitome of nonsensical defaults, features that maybe 1% of the user base would want and care about but toggled on by default.
Existing4190 5mo ago
> As there has been a question about updates. Those are not compromised, different infra, protected by end-2-end digital signature. Phew! From: https://old.reddit.com/r/jdownloader/comments/1t6goqe/is_the_website_hacked/okhg2ur/ https://old.reddit.com/r/jdownloader/comments/1t6goqe/is_the...
kristofferR 5mo ago
What's new? Hasn't JDownloader already served malware with the default installer for years, you had to use specific adware-free installers to avoid it? https://board.jdownloader.org/showthread.php?t=54725 https://board.jdownloader.org/showthread.php?t=54725
- Cider9986 5mo ago
  Here is a guide to debloat JDownloader (https://claraiscute.neocities.org/Guides/jdownloader2/ https://claraiscute.neocities.org/Guides/jdownloader2/) dark theme (https://github.com/moktavizen/material-darker-jdownloader https://github.com/moktavizen/material-darker-jdownloader)
  - dopa42365 5mo ago
    Years ago I made my own "dark-ish mode" for it and holy hell, so annoying having to change 50 different more or less accurately labeled and named color settings that only take affect after restarting the program.
RandomGerm4n 5mo ago
I wish there was finally a decent alternative to this junk. JDownloader pretends to be GPL, but parts of it are closed source. Plus, the Windows installer on the official site is a gamble, and you can only find a clean installer in the forum. The developers claim it’s "just adware", but since it’s a web-based installer, different things are offered depending on your IP address. Some of these install themselves even if you decline them, and some also contain real malware. It was actually to be expected that they wouldn't secure their website properly and that someone else would end up spreading malware as a result. The only reason to still use this software is that it works with every obscure filehoster out there. Alternatives like pyload are much less effective at bypassing all the security measures these sites put in place to block download managers. It also lets you download videos from streaming sites that other tools like yt-dlp refuse to support.
- papichulo2023 5mo ago
  Agree, I removed it from my selfhosted apps because for some reason it always has high cpu usage even when no downloading anything.
- skrebbel 5mo ago
  Protip, modern browsers (IE6 and later) have a built-in parallel download feature!
  - Lammy 5mo ago
    That's not why people use JDownloader. There are plugins for every popular file-sharing site that automate navigating download pages, handling countdown timers, and pausing for ratelimits.
- Lammy 5mo ago
  > you can only find a clean installer in the forum `winget install AppWork.JDownloader` Built in to Windows since Windows 10 v1809 :)
- _aavaa_ 5mo ago
  Were’s the AI rewrite when you need it.
raphinou 5mo ago
When will we finally sign artifacts? I'm not only complaining, I also work on a solution (asfaload) that I want easy to use. As it is multisig, such platform breaches become impossible. Below is the doc of the CLI, i'm looking for testers and challengers of the solution! https://asfaload.com/doc/ https://asfaload.com/doc/
nticompass 5mo ago
I remember using download managers back in the day, and by "back in the day" I mean dial-up (and maybe early DSL). I liked being able to pause downloads and possibly split them up using multiple connections. Nowadays, are download managers even needed anymore? At least for me, the internet is fast enough that I don't need a separate download manager, plus browsers support the pausing (and maybe multiple connections?) feature already. I'm just curious why someone would need to use JDownloader. EDIT: I hadn't thought about "warez" sites in a while and sites like megaupload where you had to wait for a timer. Those are totally "valid" uses for a downloader like this, thanks.
- rvnx 5mo ago
  [dead]
- garyfirestorm 5mo ago
  The ‘scene’ or warez sites are still up and running. Sharing cracked softwares, movies shows etc. through file hosting services. If say you wanted a Blu-ray movie with Dolby atmos sizing near 10 gig. Then you’d queue the file sharing site download links in jdownloader and let it automatically manage these downloads for you.
  - parhamn 5mo ago
    This sent me down memory lane, what happened to warez-bb!
  - nticompass 5mo ago
    I guess it's been a while since I used those type of sites. I admit that I used to, and I do remember those sites like megaupload or whatever that had a timer.
  - zamadatix 5mo ago
    [dead]
  - Havoc 5mo ago
    Very much doubt scene is using downloaders these days. ftp for the groups and torrent/usenet for the plebs
hereme888 5mo ago
Wasn't Jdownloader known in the past for bundling adware?
kanemcgrath 5mo ago
I am always worried that popular software like this is getting compromised. But what about all the smaller stuff? I download and run a bunch of small programs, especially for game modding. Do the small tools not have the same risk because of their smaller scale invites less dedicated attacks? or do they get compromised and fly completely under the radar?

119 points by bundie 5mo ago

u/rubi2333 uploaded the malicious files to virustotal.com JDownloader2Setup_windows-amd64_v1_8_0_482.exe: https://www.virustotal.com/gui/file/5a6636ce490789d7f26aaa86e50bd65c7330f8e6a7c32418740c1d009fb12ef3 https://www.virustotal.com/gui/file/5a6636ce490789d7f26aaa86... JDownloader2Setup_windows-amd64_v11_0_30.exe: https://www.virustotal.com/gui/file/fb1e3fe4d18927ff82cffb3f82a0b4ffb7280c85db5a8a8b6f6a1ac30a7e7ed9 https://www.virustotal.com/gui/file/fb1e3fe4d18927ff82cffb3f... JDownloader2Setup_windows-amd64_v17_0_18.exe: https://www.virustotal.com/gui/file/04cb9f0bca6e0e4ed30bc92726590724bf60938440b3825252657d1b3af45495 https://www.virustotal.com/gui/file/04cb9f0bca6e0e4ed30bc927... JDownloader2Setup_windows-amd64_v21_0_10.exe: https://www.virustotal.com/gui/file/32891c0080442bf0a0c5658ada2c3845435b4e09b114599a516248723aad7805 https://www.virustotal.com/gui/file/32891c0080442bf0a0c5658a... JDownloader2Setup_windows-x86_v1_8_0_472.exe: https://www.virustotal.com/gui/file/4ff7eec9e69b6008b77de1b6e5c0d18aa717f625458d80da610cb170c784e97c https://www.virustotal.com/gui/file/4ff7eec9e69b6008b77de1b6... JDownloader2Setup_windows-x86_v11_0_29.exe: https://www.virustotal.com/gui/file/de8b2bdfc61d63585329b8cfca2a012476b46387435410b995aeae5b502bd95e https://www.virustotal.com/gui/file/de8b2bdfc61d63585329b8cf... JDownloader2Setup_windows-x86_v17_0_17.exe: https://www.virustotal.com/gui/file/e4a20f746b7dd19b8d9601b884e67c8166ea9676b917adea6833b695ba13de16 https://www.virustotal.com/gui/file/e4a20f746b7dd19b8d9601b8... JDownloader2Setup_unix_nojre.sh: https://www.virustotal.com/gui/file/6d975c05ef7a164707fa359284a31bfe0b1681fe0319819cb9e2c4eec2a1a8af https://www.virustotal.com/gui/file/6d975c05ef7a164707fa3592...

salomonk_mur 5mo ago
What? How would you know it was them?
- Retr0id 5mo ago
  Comparing the hashes would be one way

Our_Benefactors 5mo ago

I’ve never run into a program that manages to disregard as many UX best practices as Jdownloader. It has more maddening features than I can count. Even stuff like sorting a column by date doesn’t work how you would want it to, because it applies some “package grouping”. It’s the epitome of nonsensical defaults, features that maybe 1% of the user base would want and care about but toggled on by default.

Existing4190 5mo ago

> As there has been a question about updates. Those are not compromised, different infra, protected by end-2-end digital signature. Phew! From: https://old.reddit.com/r/jdownloader/comments/1t6goqe/is_the_website_hacked/okhg2ur/ https://old.reddit.com/r/jdownloader/comments/1t6goqe/is_the...

kristofferR 5mo ago

What's new? Hasn't JDownloader already served malware with the default installer for years, you had to use specific adware-free installers to avoid it? https://board.jdownloader.org/showthread.php?t=54725 https://board.jdownloader.org/showthread.php?t=54725

Cider9986 5mo ago
Here is a guide to debloat JDownloader (https://claraiscute.neocities.org/Guides/jdownloader2/ https://claraiscute.neocities.org/Guides/jdownloader2/) dark theme (https://github.com/moktavizen/material-darker-jdownloader https://github.com/moktavizen/material-darker-jdownloader)
- dopa42365 5mo ago
  Years ago I made my own "dark-ish mode" for it and holy hell, so annoying having to change 50 different more or less accurately labeled and named color settings that only take affect after restarting the program.

RandomGerm4n 5mo ago

I wish there was finally a decent alternative to this junk. JDownloader pretends to be GPL, but parts of it are closed source. Plus, the Windows installer on the official site is a gamble, and you can only find a clean installer in the forum. The developers claim it’s "just adware", but since it’s a web-based installer, different things are offered depending on your IP address. Some of these install themselves even if you decline them, and some also contain real malware. It was actually to be expected that they wouldn't secure their website properly and that someone else would end up spreading malware as a result. The only reason to still use this software is that it works with every obscure filehoster out there. Alternatives like pyload are much less effective at bypassing all the security measures these sites put in place to block download managers. It also lets you download videos from streaming sites that other tools like yt-dlp refuse to support.

papichulo2023 5mo ago
Agree, I removed it from my selfhosted apps because for some reason it always has high cpu usage even when no downloading anything.
skrebbel 5mo ago
Protip, modern browsers (IE6 and later) have a built-in parallel download feature!
- Lammy 5mo ago
  That's not why people use JDownloader. There are plugins for every popular file-sharing site that automate navigating download pages, handling countdown timers, and pausing for ratelimits.
Lammy 5mo ago
> you can only find a clean installer in the forum `winget install AppWork.JDownloader` Built in to Windows since Windows 10 v1809 :)
_aavaa_ 5mo ago
Were’s the AI rewrite when you need it.

raphinou 5mo ago

When will we finally sign artifacts? I'm not only complaining, I also work on a solution (asfaload) that I want easy to use. As it is multisig, such platform breaches become impossible. Below is the doc of the CLI, i'm looking for testers and challengers of the solution! https://asfaload.com/doc/ https://asfaload.com/doc/

nticompass 5mo ago

I remember using download managers back in the day, and by "back in the day" I mean dial-up (and maybe early DSL). I liked being able to pause downloads and possibly split them up using multiple connections. Nowadays, are download managers even needed anymore? At least for me, the internet is fast enough that I don't need a separate download manager, plus browsers support the pausing (and maybe multiple connections?) feature already. I'm just curious why someone would need to use JDownloader. EDIT: I hadn't thought about "warez" sites in a while and sites like megaupload where you had to wait for a timer. Those are totally "valid" uses for a downloader like this, thanks.

rvnx 5mo ago
[dead]
garyfirestorm 5mo ago
The ‘scene’ or warez sites are still up and running. Sharing cracked softwares, movies shows etc. through file hosting services. If say you wanted a Blu-ray movie with Dolby atmos sizing near 10 gig. Then you’d queue the file sharing site download links in jdownloader and let it automatically manage these downloads for you.
- parhamn 5mo ago
  This sent me down memory lane, what happened to warez-bb!
- nticompass 5mo ago
  I guess it's been a while since I used those type of sites. I admit that I used to, and I do remember those sites like megaupload or whatever that had a timer.
- zamadatix 5mo ago
  [dead]
- Havoc 5mo ago
  Very much doubt scene is using downloaders these days. ftp for the groups and torrent/usenet for the plebs

hereme888 5mo ago

Wasn't Jdownloader known in the past for bundling adware?

kanemcgrath 5mo ago

I am always worried that popular software like this is getting compromised. But what about all the smaller stuff? I download and run a bunch of small programs, especially for game modding. Do the small tools not have the same risk because of their smaller scale invites less dedicated attacks? or do they get compromised and fly completely under the radar?