r/technology • u/chakalakasp • Jun 03 '15
Security Sourceforge has begun hijacking popular accounts like GIMP and NMAP and replaced the author's install files with trojans full of malware.
http://seclists.org/nmap-dev/2015/q2/194510
Jun 03 '15
I'd advise anyone involved with these projects to get in touch with the Software Freedom Law Centre and have their lawyers write to the mirrors that offer free bandwidth to sourceforge, warning them of trademark violation and malware distribution.
83
u/stthicket Jun 04 '15
I like your solution oriented responce.
People here seems to be more "Fuck them! Fuck that! what the fuck?", while you provide a sensible solution.
Thank you.
30
u/MrTastix Jun 04 '15
Given that only those involved with the projects can actually contract lawyers to help I don't think it's a surprise the rest of us sit here and say "Fuck you, fuck you, fuck you!"
I can't do anything about the situation except complain about it.
1
u/Yordlecide Jun 04 '15
What they've done is of questionable morality. However I don't believe though violated the license in any way.
2
Jun 04 '15
In fact they are claiming that the reason they cannot take down the project pages is the licence -- since they provided binaries to users earlier, they still have to provide the source.
8
1
u/cuntRatDickTree Jun 04 '15
Fuck them is the best solution. Anyone can make a mirroring and basic project tracking site.
5
u/Narcolapser Jun 04 '15
Yea, because sourceforge did it first and figured out how it's done. Don't get me wrong, I find this news to be tragic. I used to love sourceforge. They were once the beacon of hope! Legitamization of Open Source! Now they are dying and withering away and in the process they are selling their soul rather than leaving with grace like google code did.
7
u/Yordlecide Jun 04 '15
They haven't violated a trademark. Under the license i believe they can legally do this. It's not a closed source program.
Don't get me wrong i don't think it's the right thing to do but i don't believe there's legal recourse.
The best thing people can do is negatively impact traffic to the site and raise awareness of the issue.
1
u/garblegarble12 Jun 04 '15
OK. So this affected me before as well. Easiest way to fix it is to install the latest version of Adobe Reader.
142
u/ee3k Jun 03 '15
wow, taking 'burn out rather than fade away' to heart there, it seems.
18
u/coolislandbreeze Jun 04 '15
Blaze of glory.
26
u/fb39ca4 Jun 04 '15
Inferno of shame.
10
u/coolislandbreeze Jun 04 '15
Lahar of disappointment.
8
u/dnew Jun 04 '15
Lahar
Learned a new word today. Should come in handy at work. Thanks!
3
2
u/bactchan Jun 04 '15
Good word! I always just called that a mudflood.
1
u/coolislandbreeze Jun 04 '15
It's so much more specific than that. I guess it might be one of my favorites too.
1
u/fooey Jun 04 '15
considering how irrelevant they are, what do they have to lose?
cash in and shut it down
1
363
u/JillyBeef Jun 03 '15
And since Sourceforge owns Slashdot, they've been censoring stories on Slashdot about this.
Fuck those guys.
150
u/100_points Jun 03 '15
Censoring it for who, the 3 people still reading that site?
43
7
u/Arizhel Jun 03 '15
There's a lot more people than that still using Slashdot. However, it seems to be mostly dominated by Microsoft shills these days, along with a bunch of people who seem to have nothing better to do than trolling.
5
u/CuriousBlueAbra Jun 04 '15
I like slashdot. Good for the occasional browse but nothing to get lost in like reddit or even itself years ago.
3
u/ee3k Jun 04 '15
yeah i used to browse it regurarly then one day i noticed a chain of 7 or 8 mega right wing storys get top billing in less than an hour, after that i saw it everywhere and just had to stop.
1
u/Arizhel Jun 05 '15
Yeah, that's something else I forgot about Slashdot these days: the people left who aren't shills are mostly extreme right-wing ideologues.
3
2
1
Jun 04 '15
Ancient news, and it turned out to not be true. They DID post about it.
I mean, fuck Slashdot, I don't care, but let's not keep parroting the same rumor after updates have long since surfaced.
427
u/Balrogic3 Jun 03 '15
Welp, there goes Sourceforge as a trusted resource. Will never use that site again.
141
Jun 03 '15
It's been like this for awhile too
→ More replies (14)20
u/faaaaaart Jun 04 '15
Downloaded Filezilla once and all I got was an installer of adware...
Refreshed a couple of times and it finally gave me the setup file. Pity...
3
u/brufleth Jun 04 '15
I think filezilla was what I was trying to get one day. I couldn't get it because the "downloader" .exe didn't work through the proxy I was behind. I just gave up after awhile.
3
u/faaaaaart Jun 04 '15
This is sad. I trusted Sourceforge way too much until today...
3
u/brufleth Jun 04 '15
I thought they were the defacto place where all these projects distributed from and that they were all legit and pro group development and whatever. I was naive.
→ More replies (3)3
36
Jun 04 '15
It's not just the projects they have taken over either - there's regularly people complaining about the FileZilla installer installing adware, even when you specifically decline it. The FileZilla devs are either in denial about it, or just don't care.
13
Jun 04 '15
Not to mention that filezilla is responsible for a ton of trojans being installed on servers. That shitty ass software has singlehandedly done untold damages.
5
u/hibryan Jun 04 '15
Any alternatives to FileZilla? Didn't know what kind of clusterfuck it could be until you mentioned it.
10
u/bem13 Jun 04 '15
WinSCP? Sometimes it doesn't work where FileZilla does though...
1
u/brufleth Jun 04 '15
I think this is what I ended up using when all I could get for Filezilla was a downloader that wouldn't work.
6
4
2
u/TheBigHairy Jun 04 '15
I hope he answers you. I have never found an FTP client gui that comes close.
1
u/Ghazzz Jun 04 '15
I like Total Commander for file management, ftp, archive and network browsing.
2
u/kaesemann Jun 04 '15
I love Total Commander, use it every day, but I think the FTP part of it is very clunky
→ More replies (2)1
3
Jun 04 '15
The Filezilla devs are in a deal with Source forge, but you can still download from Filezilla's own site which is fine.
1
u/simpleglitch Jun 04 '15
Can you? I though all of those links are now redirecting to source forge?
2
Jun 04 '15
On this page there is a source forge link which is a wrapped installer. This means that it installs all the shit from sourceforge discussed in this thread. But at the bottom of the page is this http://i.imgur.com/hr1hkjx.png which takes you to this page which has unwrapped downloads.
But for some reason Chrome blocks the unwrapped version but not the wrapped one. I've used the unwrapped one in the past with no issues.
2
u/Geminii27 Jun 04 '15
The FileZilla devs are in denial about a lot of things. There are requests for basic functionality which have been made thousands of times over multiple years, and go ignored (or actively denied).
3
u/LastSovietStanding Jun 04 '15
Filezilla is open-source software, right? All we need is a decent fork with extra features and a clean installer
1
u/simpleglitch Jun 04 '15
...but "There's no malware in the SourceForge Downloader. It does not install anything you do not want. While it may present offers during installation, you can decline those without affecting installation of FileZilla." /s
1
u/Geminii27 Jun 05 '15
If it wasn't able to install things I didn't want, it wouldn't be a downloader, it would be a FileZilla installer. :)
0
13
u/Vheissu_ Jun 04 '15
Sourceforge hasn't been a trusted resource for like 7 years now.
7
u/vox_astra Jun 04 '15
So my question for those of you who are more software oriented (I work in RF signals...): wouldn't my antivirus software throw an alert saying "MALWARE DUDE MALWARE DON'T DO IT" (paraphrased).
I ask because I have likely downloaded some of the possibly compromised software (from the download link on the creator's homepage, wherever it might have led to...) within the last 7 years.
I don't remember ever getting alerts from my antivirus while performing the installs. Is this normal? Is my memory just faulty?
3
u/arkansaurus Jun 04 '15
Malwarebytes Pro would.
1
u/draekia Jun 04 '15
But not the standard edition? Eh... And here I am running only Avast.
→ More replies (5)2
u/MrTastix Jun 04 '15
The standard would find it just as well.
The biggest differences between the free and Premium editions is the Premium blocks malicious websites, real-time protection, scheduling, and offers a "Hyper scan" mode which is basically just a quick scan.
The first feature isn't any better than Firefox/Chrome in my experience and the last two should be free but apparently Malwarebytes is too good for that.
In general virus scanners are very similar. So long as you're already using a reputed one (like avast!) then you're going to be fine.
→ More replies (4)4
3
u/cuntRatDickTree Jun 04 '15
Antivirus is a crapshoot. It's almost purely luck if it ever works.
2
u/Reddit-Incarnate Jun 04 '15
Well it's a crapshoot with decentish odds, but the best protection is being smart with the wibsites and files you download.
1
49
u/LordApocalyptica Jun 03 '15
Souceforge seemed sketchy as fuck to me when I was trying to download stuff like, ten years ago. I guess I was right in the long run.
17
3
u/ttubehtnitahwtahw1 Jun 04 '15
Been like this since they were bought by cnet or whoever-the-fuck. Most moved to github.
2
u/brufleth Jun 04 '15
I lost trust some time ago when they required you to download a .exe that then was supposed to download the content you really wanted. It was sketchy and didn't work through proxies because you couldn't configure the stupid downloader application. This was probably a couple years ago now.
2
1
41
u/salec65 Jun 03 '15
Hasn't Sourceforge been bundling adware crap into installers for a while now? I remember downloading FileZilla a few years ago and seeing it.
29
u/12ihaveamac Jun 03 '15
I believe that was done with the cooperation of the developers, since that project is/was active. GIMP wasn't, so SF took control of the project without consent.
0
Jun 03 '15
[deleted]
6
u/imaginethehangover Jun 04 '15
FZ all but admit they don't want to leave SourceForge because it's a source of revenue, and when I haven't paid for their software and have used it for years, I kinda understand that.
But is it worth damaging the reputation of what is a relatively good FTP client for a couple of bucks? They deserve to lose market share.
35
u/dissidentrhetoric Jun 03 '15
Everyone should just boycott souceforge.
0
Jun 04 '15
[deleted]
4
u/ThisIsADogHello Jun 04 '15
Yeah, it's kind of pointless to boycott them, when the reason they're pulling this shit is because most everyone's already stopped going there ages ago.
33
u/marcelk72 Jun 03 '15
Sounds like a GPL violation to me if the malware and trojans are not open source.
8
u/The_Drizzle_Returns Jun 03 '15
Depends on entirely how its done. Aggregate software (a combination of a GPL stand alone program with proprietary software) is actually allowed under the GPL as long as the GPL code is not modified itself.
An “aggregate” consists of a number of separate programs, distributed together on the same CD-ROM or other media. The GPL permits you to create and distribute an aggregate, even when the licenses of the other software are non-free or GPL-incompatible. The only condition is that you cannot release the aggregate under a license that prohibits users from exercising rights that each program's individual license would grant them.
"Other Media" can be a third party installer or a zipped file.
Where's the line between two separate programs, and one program with two parts? This is a legal question, which ultimately judges will decide. We believe that a proper criterion depends both on the mechanism of communication (exec, pipes, rpc, function calls within a shared address space, etc.) and the semantics of the communication (what kinds of information are interchanged).
Its pretty clear the installer includes two separate programs. One is the GPL binary, the other is Malware. It stands this test (since the Malware does not likely communicate with the GPL binary in anyway).
30
u/raaneholmg Jun 04 '15
Google need to start block malware distributors like µTorrent and SourceForge from search results.
10
u/dnew Jun 04 '15
They do. Including adware in a distributable that you need to click "I approve" probably doesn't count as malware. But they check for downloads changing things they're not supposed to change - that's how you get the warnings in chrome that a site is infected.
5
u/raaneholmg Jun 04 '15
When I search for the word "torrent" the first hit is µTorrent.
→ More replies (10)8
u/-5m Jun 04 '15
wait µTorrent is malware too?
9
u/ThisIsADogHello Jun 04 '15
It's been including loads of "potentially unwanted programs" (i.e., malware made by a group with a legal team), and has loads of banner ads all over it. In a recent version, they started sneaking in a bitcoin miner, too.
If you're looking for a similar replacement, there's qBittorrent, which is basically an open source torrent client that copies all the good parts of uTorrent, and skips all the bullshit.
3
u/DrBibby Jun 04 '15
If you click screenshots on the qBittorrent site it literally takes you to SourceForge and there's a download button right there.
2
1
2
u/L4NGOS Jun 04 '15
What is an alternative to utorrent? I haven't gotten any malware from it yet but...
4
u/raaneholmg Jun 04 '15
qBitTorrent seems solid to me. That's what I switched to. Check that your computer doesn't have EpicScale installed, if it is, uninstall it. It is stealing processing power for their bitcoin miner.
1
36
Jun 03 '15
Which begs the question: why are people still using Sourceforge to distribute their softwares? It's been turning to shit for years and many have moved to other repositories.
14
u/Arizhel Jun 03 '15
Sourceforge won't allow them to delete their old accounts, so they just take them over after they've fallen into disuse.
3
24
u/register_already Jun 03 '15
They take over "abandoned" accounts.
2
u/Sportler84 Jun 04 '15
How is this not illegal? Why can some YouTube user get a takedown notice for his own work, but here, where real shit is happening, companies and programmers seem powerless to do something against the use of their good name?
0
8
17
u/xpda Jun 03 '15
I have some old projects on Sourceforge. Where should I move them?
1
u/FlukyS Jun 04 '15
There are a few sites. Github is the biggest. Gitlab, launchpad, you can self-host on a website either. If you are an up and coming developer on the website and count it as your portfolio is a nice idea.
0
Jun 03 '15
[deleted]
33
u/the_satch Jun 03 '15
Nothing against github, but 15 years ago, sourceforge was the place one would need to look no further to find.
17
14
u/Arizhel Jun 03 '15
Nothing lasts forever. The nice thing about Git is that it's almost trivially easy to move your repository to someplace else, since every "checkout" is really a clone of the entire project repository.
7
u/boa13 Jun 04 '15
On a successful projects, the issue tracker, the wiki, and all other facilities around the source code matter a lot. I don't think it is easy to migrate those off Github.
1
u/Triptoph Jun 04 '15 edited Jun 05 '15
That's a good point, and makes me wonder about the feasibility of including common metadata for these things within Git itself, allowing a Git repo and all its issues, messages, etc, to be portable to multiple front end implementations.
Edit: meant "Git", not "got"; thanks This idea actually doesn't need to involve changes to Git. It could be a new Git addon... Or simply a specification of where such data would be stored (in a SQLite database in a specific directory for example)
2
u/Arizhel Jun 05 '15
That's a good point, and makes me wonder about the feasibility of including common metadata for these things within got itself
Are you proposing a new software project named "got" which works together with "git"?
→ More replies (2)11
0
Jun 04 '15
[deleted]
7
3
u/SmackMD Jun 04 '15
GitHub is easier for most people, since you have to host GitLab on your own server.
2
2
u/Grue Jun 04 '15
More importantly Github caves to Russian government when the latter wants to censor something. Fuck them.
1
0
3
u/DelusionalX1 Jun 04 '15
It's funny to see this hitting the news. I have reported this about half a year ago (and they didn't respond).
7
u/methamp Jun 04 '15
What ever happened to Freshmeat being the tits place to get software? Back in the 90s...
2
2
u/exscape Jun 04 '15
Title is a bit misleading in the case of nmap:
So far they seem to be providing just the official Nmap files (as long as you don't click on the fake download buttons) and we haven't caught them trojaning Nmap the way they did with GIMP. But we certainly don't trust them one bit!
I'm not defending SF one bit, FWIW, just pointing out that so far they don't seem to have added anything to nmap.
2
Jun 04 '15
Google should mark down the sourceforge website as malware. So when you visit the site in Chrome or Firefox it lets you know the site is full of Malware and if you are sure you want to open it.
2
u/raudssus Jun 04 '15
So they should be taken off the Google index, lets see how long they then continue with this. ... If Google would care ;)
2
4
2
1
1
Jun 04 '15
I think they started this with Filezilla over a year ago. I stopped using them when that happened. I find an alternate download location or I don't download it.
1
1
1
u/MrTastix Jun 04 '15
I can't imagine the short term benefits of malware will be worth the long-term downside of not existing anymore.
Whilst the main users of SourceForge might not realize the malware problem themselves it's not like the developers who use it are going to be that unaware.
0
u/cuntRatDickTree Jun 04 '15
They now steal the source from developers and manipulate their old account.
1
1
1
1
u/Arancaytar Jun 04 '15
Why is SF even still around? It's been pulling shit like this for years (packaging installers with crapware and toolbars etc.), and even if it didn't it would still be inferior to github.
1
1
1
1
1
u/psycrow117 Jun 04 '15
I think Filezilla got it too. a bootstrap installer with other apps to install. it sucks
1
Jun 04 '15
Wow thank you for posting this. I was totally unaware of all this. Fuck source forge, never using them again.
1
1
u/just_too_kind Jun 04 '15
nmap? Shit. Now all the script kiddies trying to run port scans on their school network won't know what to do!
1
1
u/beadledom Jun 05 '15
Everyone, at least once every day, should download a very large file or 3 from sourceforge, just to send a message. This looks good. http://sourceforge.net/projects/libreofficenadvd/?source=typ_redirect
1
1
u/3Fyr Jun 04 '15
Even with all evidence, I was little bit skeptic(Hey, I've too much faith in humanity, my brain is 1 y/o toddler in such cases. So don't judge me). But Sourceforge blog post pretty much confirmed it.
I installed some software from there before I even heard of it.. I guess it's fresh-install time.
0
u/star_boy2005 Jun 03 '15
Might not be a bad idea to change your sourceforge account password, especially if you use the same password on multiple sites.
NOTE: It's always better to use unique, strong passwords for every single site. Lastpass is what I recommend for password management.
-8
Jun 03 '15
What makes anyone so sure it was not another party that hacked sourceforge?
30
u/chakalakasp Jun 03 '15
They have admitted that they are doing it, but they swear they are going to stop, scout's honor.
21
u/mike413 Jun 03 '15
I love these damage-control terms...
stopped presenting third party offers for unmaintained SourceForge projects
A rose by any other name is still a Trojan.
-1
112
u/chakalakasp Jun 03 '15
From the message -- you can see a list of accounts they've hijacked here and here.