5 ms·

Wait, why are people so quick to download and install these binaries? This is an excellent opportunity to piggyback a virus onto a ton of people's computers, an

Wait, why are people so quick to download and install these binaries? This is an excellent opportunity to piggyback a virus onto a ton of people's computers, and the "Yify" github profile seems to have no other prior history: https://github.com/Yify https://github.com/Yify EDIT: Nevermind, it's headed by jduncanator who seems to have done a lot of public work. They also contributed to the original popcorn time.

balls187 13y ago
I don't if it's the same dude|lady|group, but Yify is well known in the torrent scene.
- mistercow 13y ago
  It looks like it is actually affiliated, given that the group's email is github@yts.re
skimmas 13y ago
it's also a node-webkit so while one could inject some code in the nodewebkit runtime, most of the code is just html js and css.
pkamb 13y ago
This recently happened with the "StealthBit" bitcoin Mac App. The precompiled version on the Github Release page contained additional malicious code not present in the repo: http://www.macrumors.com/2014/02/10/bitcoin-stealing-trojan/ http://www.macrumors.com/2014/02/10/bitcoin-stealing-trojan/
- kenjackson 13y ago
  It looks like this is just a local web app(?). The only binary I see used is ffmpegsumo. Given, that can't you just download the repo locally, replace ffmpegsumo with a trusted version from elsewhere, and at least know you aren't running a version that differs from what is on the repo?
  - malone 13y ago
    They are using node-webkit which means any javascript has unrestricted access to the nodejs api http://nodejs.org/api/ http://nodejs.org/api/. It wouldn't be hard to do something malicious with those low level filesystem, network and process modules.
forlorn 13y ago
This seems to be the same YIFY group that releases shitty video transcodes. I wouldn't recomment using the software they offer.
- theon144 13y ago
  And also the same YIFY group that PopcornTime primairly downloads movies from...
doliveros 13y ago
This is not the official repo. The official repository is on https://github.com/popcorn-team/popcorn-app https://github.com/popcorn-team/popcorn-app. That's not even Yify's repository. Probably some holaunblocker guy wanted to take advantage of the news and else to drive traffic to their website.

balls187 13y ago

I don't if it's the same dude|lady|group, but Yify is well known in the torrent scene.

mistercow 13y ago
It looks like it is actually affiliated, given that the group's email is github@yts.re

skimmas 13y ago

it's also a node-webkit so while one could inject some code in the nodewebkit runtime, most of the code is just html js and css.

pkamb 13y ago

This recently happened with the "StealthBit" bitcoin Mac App. The precompiled version on the Github Release page contained additional malicious code not present in the repo: http://www.macrumors.com/2014/02/10/bitcoin-stealing-trojan/ http://www.macrumors.com/2014/02/10/bitcoin-stealing-trojan/

kenjackson 13y ago
It looks like this is just a local web app(?). The only binary I see used is ffmpegsumo. Given, that can't you just download the repo locally, replace ffmpegsumo with a trusted version from elsewhere, and at least know you aren't running a version that differs from what is on the repo?
- malone 13y ago
  They are using node-webkit which means any javascript has unrestricted access to the nodejs api http://nodejs.org/api/ http://nodejs.org/api/. It wouldn't be hard to do something malicious with those low level filesystem, network and process modules.

forlorn 13y ago

This seems to be the same YIFY group that releases shitty video transcodes. I wouldn't recomment using the software they offer.

theon144 13y ago
And also the same YIFY group that PopcornTime primairly downloads movies from...

doliveros 13y ago

This is not the official repo. The official repository is on https://github.com/popcorn-team/popcorn-app https://github.com/popcorn-team/popcorn-app. That's not even Yify's repository. Probably some holaunblocker guy wanted to take advantage of the news and else to drive traffic to their website.