Trojan found in Filezilla downloaded from SourceForge • Hacker News Board

Re: Trojan found in Filezilla downloaded from SourceForge

#101

Post by gargalatas » Thu, Dec 03, 2015, 1:18 PM UTC

Unfortunately Filezilla has this trojan for some years now! The trojan send all your identities to a server. This is tested 100%. We had many passwords stolen this way and we are 100% sure that it's filezilla.

Just take this test: Try to download the Filezilla and when the download page shows click on the Direct Link. Then compare the two executables, one that downloaded automatically and the one that it downloaded via the direct link. You will see that the direct download is clean but the other has the SF icon and it has a virus!

Re: Trojan found in Filezilla downloaded from SourceForge

#102

Post by jmnicolas » Thu, Dec 03, 2015, 1:19 PM UTC

krylon wrote: post #81

jmnicolas wrote: post #10

No way I'm supporting this kind of behavior. Can you suggest an alternative to FileZilla ?

I use WinSCP. I cannot say much about technical differences, but it has worked well for me. Also, PuTTY comes with a SFTP/SCP client, and unless there are strong reasons you cannot use SFTP, it is a lot better than FTP, security-wise (does not transmit passwords in plain text and allows using cryptographic keys rather than passwords; in fact, on OpenSSH you can configure the server to deny password authentication com…

It's funny I already use WinSCP but for SSH and SFTP connexions to Linux servers, it didn't even occurs to me that I could use it for regular FTP too. Thanks.

Re: Trojan found in Filezilla downloaded from SourceForge

#103

Post by jmnicolas » Thu, Dec 03, 2015, 1:23 PM UTC

brusch64 wrote: post #18

jmnicolas wrote: post #10

No way I'm supporting this kind of behavior. Can you suggest an alternative to FileZilla ?

you can install Filezilla from Ninite. https://ninite.com/ Well - you are trusting that Ninite doesn't include any crapware / malware, but until now I didn't had any problems with it. Makes updating Java Runtime much nicer too.

I think you can avoid the virus by downloading the zip but as I said I don't want to support this kind of behavior, so I have uninstalled Filezilla from my computer and will uninstall it on all computers at work too.

Re: Trojan found in Filezilla downloaded from SourceForge

#104

Post by facepalm » Thu, Dec 03, 2015, 1:23 PM UTC

chris_wot wrote: post #73

facepalm wrote: post #31

Earlier quoted context omitted.

Shouldn't this be a criminal offense?

It's usually hidden in the EULA. Very hidden. It's not just Filezilla or sourceforge doing this. Lenovo do this routinely. They used to bundle something called BrowserGuard, which contains a PUP by Conduit. Conduit have since been partially acquired by another company Perion. I followed that rabbit hole last year, Lenovo point blank refuse to acknowledge it is spyware. And it IS spyware. I created a Perion account to…

Good to know - I was almost ready to consider Lenovo again after Superfish, but no...

Re: Trojan found in Filezilla downloaded from SourceForge

#105

Post by jmnicolas » Thu, Dec 03, 2015, 1:24 PM UTC

halviti wrote: post #65

teddyh wrote: post #12

Earlier quoted context omitted.

The problem is not FileZilla, but SourceForge. They do this to all their files.

I had contacted FileZilla's developer about this back in 2014. He let me know that bundling crapware was "intentional" http://i.imgur.com/AvfDuOA.png His statement about alternate download links was also incorrect, because I was asking about Filezilla server, which I could not find anywhere but sourceforge.

Does it mean that I have this crap installed since at least 2014 on all computers at work and Sophos didn't detect it ?

Re: Trojan found in Filezilla downloaded from SourceForge

#106

Post by joopxiv » Thu, Dec 03, 2015, 1:25 PM UTC

lmm wrote: post #80

joopxiv wrote: post #40

Earlier quoted context omitted.

Someone explained that after he got some malware on his computer and subsequently all his websites were hacked. The response? Once you've got malware on your computer, you've lost already, game over. You need to prevent the infection in the first place. OMFG...

That's correct though. Even if the passwords weren't stored at all, malware could just install a keylogger and record them when you typed them in.

The fact that there are ways to obtain passwords even when they are not stored unencrypted is not really a reason to make it as easy as possible for malware to get every password on your system.

Re: Trojan found in Filezilla downloaded from SourceForge

#107

Post by jmnicolas » Thu, Dec 03, 2015, 1:25 PM UTC

tomaac wrote: post #88

jmnicolas wrote: post #10

No way I'm supporting this kind of behavior. Can you suggest an alternative to FileZilla ?

https://cyberduck.io/ They have some issues with SSL certificate, though.

I don't know why you were downvoted, will check it, thanks.

Re: Trojan found in Filezilla downloaded from SourceForge

#108

Post by joopxiv » Thu, Dec 03, 2015, 1:27 PM UTC

kuschku wrote: post #95

icebraining wrote: post #91

Earlier quoted context omitted.

If the server checked against a client-provided hash, the hash would become the password , and the attacker could just use the hash as-is to login to the server. Hashing on the client solves nothing.

Except if you require hash of (password+timestamp modulo 60000)

In that case you can't just store the hash of the password, you will need to password itself.

Re: Trojan found in Filezilla downloaded from SourceForge

#109

Post by pjmlp » Thu, Dec 03, 2015, 1:28 PM UTC

IshKebab wrote: post #79

scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

D has the best mailing list interface in the world by an enormous margin . http://forum.dlang.org/ (The forum is a front-end to the mailing lists / newsgroups.)

I love D's community to have their forums also accessible via NNTP.

Re: Trojan found in Filezilla downloaded from SourceForge

#110

Post by gorhill » Thu, Dec 03, 2015, 1:36 PM UTC

bigbugbag wrote: post #71

jug wrote: post #3

AFAIK this practice (and not on the FileZilla project alone) is why uBlock Origin is blocking SourceForge.

Though ublock origin can use it, it's the ublock badware risks filter list which is blocking sourceforge : https://github.com/gorhill/uBlock/wiki/Badware-risks

You are linking to uBlock Origin ("uBO") -- that filter list is specific to uBO. The other "uBlock"[1] (abandonware) does not support strict blocking, which is what blocks SourceForge.

[1] https://github.com/chrisaljoudi/uBlock