8 ms·

Any other projects affected ? Would be nice to start a list of all affected projects. This could also be a case of targeted attack on the gimp account.

phkahler 11y ago
Or you can just stop getting anything from sourceforge since their MO is now to distribute crapware.
- subudeepak 11y ago
  Even apache openoffice is using SourceForge for their downloads. There are quite a lot of s/w there at this moment.
  - JoshTriplett 11y ago
    OpenOffice has not been relevant for a while; development has moved to LibreOffice. See https://lwn.net/Articles/637735/ https://lwn.net/Articles/637735/
    - subudeepak 11y ago
      :) Agree on that ! [Have not used any office in a while now - Markdowns have been sufficient]
    - makomk 11y ago
      They're distributing LibreOffice now too, presumably without bothering to ask for the permission of the actual developers.
      - yellowapple 11y ago
        They technically don't need permission to perform the redistribution, seeing as LibreOffice is FOSS and distribution of software is permitted. However, they do need permission to claim to be representatives of the LibreOffice developers.
        JoshTriplett 11y ago
        And whether they need permission or not, bundling malware into the installer is evil.
prokoudine 11y ago
http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor1/profile/ Nice list. Got Audacity there, for instance.
- subudeepak 11y ago
  These are all affected repos ! Damn !!!
- psykovsky 11y ago
  Bitcoin is on there also. Now that is worrying.
  - prokoudine 11y ago
    It doesn't neccessarily mean all of them are affected, but I think it's a call for a close inspection.
    - psykovsky 11y ago
      I download the bitcoin .exe, and it came clean, with the right signatures, but who knows how they are distributing the stuff. I have a Ubuntu computer. If they're at least a bit smart they will use their download redirects to serve the spyware only to Windows computers or something, so that could be why I got a clean binary. Bitcoin devs investigated, at my request. They removed the sf-editor1 user from the project owners and checked the binaries to see if sigs matched, and they did. But like I said, they could be filtering who they serve the "spyware" to.
- SwellJoe 11y ago
  Several of those are projects that were never hosted at SourceForge, aren't they? Firefox, for example, I don't believe was ever an SF project. WordPress, I don't recall ever seeing on SourceForge. Are they altering the binaries they are posting on their "mirror"? This is very confusing.
- lvs 11y ago
  Firefox, cgminer, zotero, etc.. Yikes.
patdavid 11y ago
The account that the GIMP-WIN project got "moved" to from it's official maintainer (jernej), is called "sf-editor1". Having a look through that accounts project history is a little fishy (http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor1/profile/)....
- subudeepak 11y ago
  Does not look like something they would have done intentionally. Explanations will come soon I guess.
NoMoreNicksLeft 11y ago
The safest thing to do would be to assume that all software there is similarly afflicted and to never use Sourceforge again. People who host software there should move to a different platform.
- baldfat 11y ago
  The only issue is that Sourceforge made nice binaries available. Most people have no idea how to use git and/or build their own binaries.
  - ksherlock 11y ago
    Even before they started adding malware installers, downloads redirected through an extra ad page (and interfered with curl, wget, etc).
    - ender1 11y ago
      wget at least isn't affected, as long as you copy the link from the files page (the one that normally displays ads and a countdown timer in browser - it'll download the file directly with wget, since they apparently do user-agent sniffing).
    - JohnTHaller 11y ago
      SourceForge has worked with wget, NSIS's inetc, etc for at least the last 10 years. We've been using it with PortableApps.com.
  - hodefoting 11y ago
    The official win32 gimp installers were not made by sourceforge, but by the GIMP contributor now locked out of managing the relevant sourceforge account. The same win32 installers that used to be provided on sourceforge are now provided from gimp.org directly http://download.gimp.org/pub/gimp/v2.8/windows/ http://download.gimp.org/pub/gimp/v2.8/windows/ the problem is the nice binaries being replaced by sourceforge made installers that also install adware.
  - 11y ago

phkahler 11y ago

Or you can just stop getting anything from sourceforge since their MO is now to distribute crapware.

subudeepak 11y ago
Even apache openoffice is using SourceForge for their downloads. There are quite a lot of s/w there at this moment.
- JoshTriplett 11y ago
  OpenOffice has not been relevant for a while; development has moved to LibreOffice. See https://lwn.net/Articles/637735/ https://lwn.net/Articles/637735/
  - subudeepak 11y ago
    :) Agree on that ! [Have not used any office in a while now - Markdowns have been sufficient]
  - makomk 11y ago
    They're distributing LibreOffice now too, presumably without bothering to ask for the permission of the actual developers.
    - yellowapple 11y ago
      They technically don't need permission to perform the redistribution, seeing as LibreOffice is FOSS and distribution of software is permitted. However, they do need permission to claim to be representatives of the LibreOffice developers.
      - JoshTriplett 11y ago
        And whether they need permission or not, bundling malware into the installer is evil.

prokoudine 11y ago

http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor1/profile/ Nice list. Got Audacity there, for instance.

subudeepak 11y ago
These are all affected repos ! Damn !!!
psykovsky 11y ago
Bitcoin is on there also. Now that is worrying.
- prokoudine 11y ago
  It doesn't neccessarily mean all of them are affected, but I think it's a call for a close inspection.
  - psykovsky 11y ago
    I download the bitcoin .exe, and it came clean, with the right signatures, but who knows how they are distributing the stuff. I have a Ubuntu computer. If they're at least a bit smart they will use their download redirects to serve the spyware only to Windows computers or something, so that could be why I got a clean binary. Bitcoin devs investigated, at my request. They removed the sf-editor1 user from the project owners and checked the binaries to see if sigs matched, and they did. But like I said, they could be filtering who they serve the "spyware" to.
SwellJoe 11y ago
Several of those are projects that were never hosted at SourceForge, aren't they? Firefox, for example, I don't believe was ever an SF project. WordPress, I don't recall ever seeing on SourceForge. Are they altering the binaries they are posting on their "mirror"? This is very confusing.
lvs 11y ago
Firefox, cgminer, zotero, etc.. Yikes.

patdavid 11y ago

The account that the GIMP-WIN project got "moved" to from it's official maintainer (jernej), is called "sf-editor1". Having a look through that accounts project history is a little fishy (http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor1/profile/)....

subudeepak 11y ago
Does not look like something they would have done intentionally. Explanations will come soon I guess.

NoMoreNicksLeft 11y ago

The safest thing to do would be to assume that all software there is similarly afflicted and to never use Sourceforge again. People who host software there should move to a different platform.

baldfat 11y ago
The only issue is that Sourceforge made nice binaries available. Most people have no idea how to use git and/or build their own binaries.
- ksherlock 11y ago
  Even before they started adding malware installers, downloads redirected through an extra ad page (and interfered with curl, wget, etc).
  - ender1 11y ago
    wget at least isn't affected, as long as you copy the link from the files page (the one that normally displays ads and a countdown timer in browser - it'll download the file directly with wget, since they apparently do user-agent sniffing).
  - JohnTHaller 11y ago
    SourceForge has worked with wget, NSIS's inetc, etc for at least the last 10 years. We've been using it with PortableApps.com.
- hodefoting 11y ago
  The official win32 gimp installers were not made by sourceforge, but by the GIMP contributor now locked out of managing the relevant sourceforge account. The same win32 installers that used to be provided on sourceforge are now provided from gimp.org directly http://download.gimp.org/pub/gimp/v2.8/windows/ http://download.gimp.org/pub/gimp/v2.8/windows/ the problem is the nice binaries being replaced by sourceforge made installers that also install adware.
- 11y ago