4 ms·
This recently happened with the "StealthBit" bitcoin Mac App. The precompiled version on the Github Release page contained additional malicious code not present
by pkamb 13y ago
This recently happened with the "StealthBit" bitcoin Mac App. The precompiled version on the Github Release page contained additional malicious code not present in the repo:
http://www.macrumors.com/2014/02/10/bitcoin-stealing-trojan/ http://www.macrumors.com/2014/02/10/bitcoin-stealing-trojan/
- kenjackson 13y agoIt looks like this is just a local web app(?). The only binary I see used is ffmpegsumo. Given, that can't you just download the repo locally, replace ffmpegsumo with a trusted version from elsewhere, and at least know you aren't running a version that differs from what is on the repo?
- malone 13y agoThey are using node-webkit which means any javascript has unrestricted access to the nodejs api http://nodejs.org/api/ http://nodejs.org/api/. It wouldn't be hard to do something malicious with those low level filesystem, network and process modules.