9 ms·

I got malware in the installer for Filezilla on my Mac. They shove malware in all sorts of non-windows stuff these days...

by edge17 11y ago

barbs 11y ago
I didn't believe you at first, but I just went to install it and...wow... https://imgur.com/a/o6cSW https://imgur.com/a/o6cSW
- yAnonymous 11y ago
  FileZilla are one of the few major projects who actually agree to this. Complain about it on their forums and you'll get a ban.
  - z92 11y ago
    FileZilla opted in for this service, and gets a percentage of the revenue generated by installing these malware.
- logicallee 11y ago
  I thought you were going to show a virus result - the screen you showed is very unambiguously an opt-in screen, it even has the term "Accept" (as opposed to some other word like next or install) making you look at it - if the text said something else you would be very likely to just click it. The button at the left 'skip' is also clear about your other option (if it said 'cancel' it would sound like you're aborting installation.) I just don't see how this is a trick. There's not even a "default" option here, except for the Accept button being on the right. How can anyone possibly click the word "Accept" without even glancing at the text surrounding it - even a glance shows you the giant icon with the slogan "Mac Cleaner Clean Up Junk Files on Your Mac"? If you look at the bullet points, the first one clearly identifies what it does. So it's an opt-in screen. There's no default. The action word is "Accept" and the top bullet is about the additional software you would be installing, with a giant picture and caption showing the same thing. Or you can click "skip." This is above-board if you're going to do this sort of thing. Hell, given how above-board it is I might just click "Accept" in this case! (knowing that the devs opted into it as well.) It is very, very hard to read this as anything other than an opt-in screen. How can you be any less ambiguous?? EDIT: I didn't even notice, there is even grey small text that spells this out in completely unambiguous words! (Thank you for considering this offer from our advertiser...your choice does not affect installation of FileZilla.) I honestly don't even know that I would ask FileZilla to change anything whatsoever about this screen. It's great!
  - brador 11y ago
    It's a trick because everyone just clicks accept blindly. They know this, that's why it's part of the installation process.
  - cosarara97 11y ago
    Most users think the way to install a program is to click next-next-next untill the program is installed. Since they downloaded Filezilla, they will expect that program to install, and not other crap. Are they to blame for not reading? Maybe. But nobody actually wants crapware in their machines, so bundling it with your software so that stupid users get it installed is not nice.
  - oneeyedpigeon 11y ago
    This definitely isn't the worst offender out there, but you're judging it on a bunch of subjective criteria; some will agree with you, others will still be 'fooled'. Although Sourceforge isn't probably a very common installation source for unexperienced users, I'm willing to bet at least some will end up there via a search engine. Bear in mind that some people will literally have no idea what 'MacKeeper' etc. is, and will assume that it's necessary. The only objective measure is "is this software required for what I'm installing"; clearly, in this case, MacKeeper fails. There is a degree of trickery, sure, but they are unequivocally trying to trick people into installing something other than what they intended.
    - pbhjpbhj 11y ago
      I actually got caught on one of these from Adobe - I was doing a flash install, that I'd done many times before, and so was on auto-pilot. It's a bit like clicking send on an email and then remembering you needed to add an attachment (thank you Mozilla for attachment reminders!); a split second after clicking I realised that what I'd clicked on was not the normal license or whatever - by that point it's already installing.
  - DanBC 11y ago
    You say it's a great screen, unambiguous, very clear. But you then say: > EDIT: I didn't even notice, there is even grey small text that spells this out in completely unambiguous words! (Thank you for considering this offer from our advertiser...your choice does not affect installation of FileZilla.) Doesn't the fact that you didn't notice it make you at least pause? I am ad tolerant. I do not run an ad blocker. If an ad is relevant to my interests I will click it. (I click maybe one ad every six months. I've never bought anything as the result of an ad.) And I loathe this kind of bundling. We know that users are unable to read dialog boxes. Ask anyone who's worked in support about their experiences of getting people to read back an error message that's displayed on their screen. Every support channel on the Internet will ask people to post screenshots or to copy and paste the output. IMO there should be an industry standard for how the screens should be worded, what they should look like, what buttons they can or can't include. Yes, we'd see many fewer people installing the malware but that's the point: no-one wants it. I tolerte ads but I see no reason to switch from Google supplied ads to some random adnetwork.
- edge17 11y ago
  Yea, there was a whole thread about this a few days ago - https://news.ycombinator.com/item?id=9623142 https://news.ycombinator.com/item?id=9623142 I actually installed the malware because I'd become so used to not dealing with this sort of stuff on my non-windows machines. The install process hijacks your browser by adding extensions, changing the search engines, blows away your prefs and cookies, installs some crap in the OS, etc. Huge pain in the butt. Totally my fault for just blindly bashing on the next button in the installer. I can assure you, the malware in Filezilla is quite real.
lvillani 11y ago
If you are on a Mac, use homebrew-cask (http://caskroom.io http://caskroom.io). It's like Brew, but for binaries. Works like a charm and you don't get the malware-injecting wrapper.
merb 11y ago
You should start using Cyberduck, it has a Free Client which pops up a window once you installed the free version (but the popup appears only ONCE and does not contain any malware or advertisments), and a paid version without a popup.
- junto 11y ago
  And Cyberduck also supports Rackspace Cloud Files and Amazon S3 containers.
- oneeyedpigeon 11y ago
  Actually, by default, the popup appears every time you close the app, but there's a clear option to suppress it on subsequent occasions for 'this version'. I've never selected that option, so I'm not sure how fine-grained 'version' is; I actually like seeing the reminder because I will, definitely, one day, make a donation, so I appreciate the prompt!
  - merb 11y ago
    still it only advertises itself, not any other software. that's why i would definitly trust cyberduck.
- micro-ram 11y ago
  +1 for CyberDuck
neckro23 11y ago
Not to victim-blame here, but the fact that there's even an "installer" should be a huge red flag. There's no reason a simple FTP program can't be just an .app bundle.

I got malware in the installer for Filezilla on my Mac. They shove malware in all sorts of non-windows stuff these days...

by edge17 11y ago

I got malware in the installer for Filezilla on my Mac. They shove malware in all sorts of non-windows stuff these days...

barbs 11y ago

I didn't believe you at first, but I just went to install it and...wow... https://imgur.com/a/o6cSW https://imgur.com/a/o6cSW

yAnonymous 11y ago
FileZilla are one of the few major projects who actually agree to this. Complain about it on their forums and you'll get a ban.
- z92 11y ago
  FileZilla opted in for this service, and gets a percentage of the revenue generated by installing these malware.
logicallee 11y ago
I thought you were going to show a virus result - the screen you showed is very unambiguously an opt-in screen, it even has the term "Accept" (as opposed to some other word like next or install) making you look at it - if the text said something else you would be very likely to just click it. The button at the left 'skip' is also clear about your other option (if it said 'cancel' it would sound like you're aborting installation.) I just don't see how this is a trick. There's not even a "default" option here, except for the Accept button being on the right. How can anyone possibly click the word "Accept" without even glancing at the text surrounding it - even a glance shows you the giant icon with the slogan "Mac Cleaner Clean Up Junk Files on Your Mac"? If you look at the bullet points, the first one clearly identifies what it does. So it's an opt-in screen. There's no default. The action word is "Accept" and the top bullet is about the additional software you would be installing, with a giant picture and caption showing the same thing. Or you can click "skip." This is above-board if you're going to do this sort of thing. Hell, given how above-board it is I might just click "Accept" in this case! (knowing that the devs opted into it as well.) It is very, very hard to read this as anything other than an opt-in screen. How can you be any less ambiguous?? EDIT: I didn't even notice, there is even grey small text that spells this out in completely unambiguous words! (Thank you for considering this offer from our advertiser...your choice does not affect installation of FileZilla.) I honestly don't even know that I would ask FileZilla to change anything whatsoever about this screen. It's great!
- brador 11y ago
  It's a trick because everyone just clicks accept blindly. They know this, that's why it's part of the installation process.
- cosarara97 11y ago
  Most users think the way to install a program is to click next-next-next untill the program is installed. Since they downloaded Filezilla, they will expect that program to install, and not other crap. Are they to blame for not reading? Maybe. But nobody actually wants crapware in their machines, so bundling it with your software so that stupid users get it installed is not nice.
- oneeyedpigeon 11y ago
  This definitely isn't the worst offender out there, but you're judging it on a bunch of subjective criteria; some will agree with you, others will still be 'fooled'. Although Sourceforge isn't probably a very common installation source for unexperienced users, I'm willing to bet at least some will end up there via a search engine. Bear in mind that some people will literally have no idea what 'MacKeeper' etc. is, and will assume that it's necessary. The only objective measure is "is this software required for what I'm installing"; clearly, in this case, MacKeeper fails. There is a degree of trickery, sure, but they are unequivocally trying to trick people into installing something other than what they intended.
  - pbhjpbhj 11y ago
    I actually got caught on one of these from Adobe - I was doing a flash install, that I'd done many times before, and so was on auto-pilot. It's a bit like clicking send on an email and then remembering you needed to add an attachment (thank you Mozilla for attachment reminders!); a split second after clicking I realised that what I'd clicked on was not the normal license or whatever - by that point it's already installing.
- DanBC 11y ago
  You say it's a great screen, unambiguous, very clear. But you then say: > EDIT: I didn't even notice, there is even grey small text that spells this out in completely unambiguous words! (Thank you for considering this offer from our advertiser...your choice does not affect installation of FileZilla.) Doesn't the fact that you didn't notice it make you at least pause? I am ad tolerant. I do not run an ad blocker. If an ad is relevant to my interests I will click it. (I click maybe one ad every six months. I've never bought anything as the result of an ad.) And I loathe this kind of bundling. We know that users are unable to read dialog boxes. Ask anyone who's worked in support about their experiences of getting people to read back an error message that's displayed on their screen. Every support channel on the Internet will ask people to post screenshots or to copy and paste the output. IMO there should be an industry standard for how the screens should be worded, what they should look like, what buttons they can or can't include. Yes, we'd see many fewer people installing the malware but that's the point: no-one wants it. I tolerte ads but I see no reason to switch from Google supplied ads to some random adnetwork.
edge17 11y ago
Yea, there was a whole thread about this a few days ago - https://news.ycombinator.com/item?id=9623142 https://news.ycombinator.com/item?id=9623142 I actually installed the malware because I'd become so used to not dealing with this sort of stuff on my non-windows machines. The install process hijacks your browser by adding extensions, changing the search engines, blows away your prefs and cookies, installs some crap in the OS, etc. Huge pain in the butt. Totally my fault for just blindly bashing on the next button in the installer. I can assure you, the malware in Filezilla is quite real.

lvillani 11y ago

If you are on a Mac, use homebrew-cask (http://caskroom.io http://caskroom.io). It's like Brew, but for binaries. Works like a charm and you don't get the malware-injecting wrapper.

merb 11y ago

You should start using Cyberduck, it has a Free Client which pops up a window once you installed the free version (but the popup appears only ONCE and does not contain any malware or advertisments), and a paid version without a popup.

junto 11y ago
And Cyberduck also supports Rackspace Cloud Files and Amazon S3 containers.
oneeyedpigeon 11y ago
Actually, by default, the popup appears every time you close the app, but there's a clear option to suppress it on subsequent occasions for 'this version'. I've never selected that option, so I'm not sure how fine-grained 'version' is; I actually like seeing the reminder because I will, definitely, one day, make a donation, so I appreciate the prompt!
- merb 11y ago
  still it only advertises itself, not any other software. that's why i would definitly trust cyberduck.
micro-ram 11y ago
+1 for CyberDuck

neckro23 11y ago

Not to victim-blame here, but the fact that there's even an "installer" should be a huge red flag. There's no reason a simple FTP program can't be just an .app bundle.