Non-official site with a tampered version of KeePass | Hacker News Reader

Non-official site with a tampered version of KeePass

security.infoteam.ch

151 pointsredsec78 comments

Hah, the Linux version points you to the original website (only the Mac and Windows versions appear to be modified)! The year of the Linux desktop is truly here.

doesnt that just imply that these scammers thought the linux userbase to be too small to be worthwhile?

the comparatively small userbase is actually an underappreciated security feature of linux ;)

not the website owner but people involved in the PUP ecosystem.

i'm sure that if installcore supported linux, then the linux binaries would also be bundlers.

Or that Linux users would instantly raise a hue and cry on seeing ads?

Kind of like how scammers use bad grammar on purpose to weed out the people too smart to be a victim.

Yes, now that you mention it - they deliberately tried to design their dragnet to exclude victims who were likely to be problematic. :)

Isn’t that the infamous “security by obscurity”?

More or less.

As I recall, the few Mac home users in the mid-2000s were talking about how Macs couldn't get viruses as a selling point.

A few home users?

https://www.youtube.com/watch?v=ZwQpPqPKbAw

No, I meant a tongue-in-cheek statement that Linux is the only worthwhile desktop because it's not affected :P

I've reported the website here: https://safebrowsing.google.com/safebrowsing/report_phish/?t...

Hopefull it will be blocked by the browsers using the safe browsing list.

I reported it to afnic too. Since it does use the same domain name maybe they will act.

Look like it's a copy paste of the .com one, with same download links.

Looks like its hosted on wp.com:

https://i0.wp.com/keepass.fr/wp-content/uploads/2018/05/keep...

So maybe we can report it here too:

https://en.wordpress.com/abuse/

Only works if you put this as URL though:

https://wp.com/keepass.fr/

safebrowsing is useless. We've reported scams of VLC shipping malware for years. They are still there.

FWIW, report the domains to https://someonewhocares.org/ , as he keeps updating it, and it is used by e.g. PiHole and my own hostfile generator.

I've had discussions with coworkers on why you shouldn't ve downloading putty from putty.org. Sure, they seem to be linking to the official downloads now, but imho it's just poor hygiene to use such pages. It takes just a moment of carelessness to get pwned

Rather unfortunate that "putty.org" is the first result in searches and looks a lot more legit than "chiark.greenend.org.uk" even if it (currently) links there.

I've had discussions with coworkers on why they shouldn't look up "free online json beautifier" and dump thousands of lines of crown jewels into them (http too). Meanwhile we're doing web dev and JSON responses are autoformatted in Firefox dev tools so there's an amazingly convenient and perfectly safe alternative right there...

How do we impart urgency with this kind of stuff?

Show your coworkers jq, it is amazing:

https://stedolan.github.io/jq/

This looks great! Coworkers don't work in the shell at all though so there's that, but I might use it at times.

They're lookin for that syntax highlighted and interactive experience you know.

It's putty's own fault. They used to (and perhaps still do) have a section on how they don't want your donated domain - they like their current one.

From their FAQ:

> No, thank you. Even if you can find one (most of them seem to have been registered already, by people who didn't ask whether we actually wanted it before they applied), we're happy with the PuTTY web site being exactly where it is. It's not hard to find (just type ‘putty’ into google.com and we're the first link returned), and we don't believe the administrative hassle of moving the site would be worth the benefit.

>>we don't believe the administrative hassle of moving the site would be worth the benefit

this is so short sighted, especially for software used to admin productive systems

Windows 10 has real OpenSSH ssh installed by default now (since April). The time for PuTTY has passed. May it rest in peace.

PuTTY's been a thing for almost two decades at this point. That's quite a lot of inertia; It will take a lot more than three months for people to migrate, nevermind the people who aren't on W10.

There are quite a few of these:

https://keepass.fr/ https://7zip.fr https://audacity.fr https://gparted.fr https://keepass.fr https://nc3354.nexylan.net https://paintnet.fr

Thanks for the update, they all look to come from the same guys.

They do. They're all registered via one email: https://domainbigdata.com/gmail.com/mj/0DnwUjDWo0L7ysS4kB00p...

Good find! Can't believe this person made that many fake domains.

So, basically somebody went through the list of all tools most commonly installed trough ninite, and created a spoof for each of them.

What are some safety measures you take when downloading a new version of keepass? Checking the digital signature of the binary?

Original keepass downloads are hosted on sourceforge which has not had the best history of integrity the way I see it.

pup bundlers also tend to be signed. just checking for a valid signature would not be enough

Sourceforge is under new management and they removed the bundled installers, as I understand it.

https://sourceforge.net/blog/brief-history-sourceforge-look-...

Compile it from source, it's a standard Visual Studio solution that builds without issues.

But there are no guarantees about the source either unless I am willing to audit all of it?

I agree, that's why signed source code releases are the safest thing you can get. Keepass has signed releases (including the source code archive) that can be checked with OpenPGP.

https://keepass.info/integrity.html

If you trust the signed source code there's no reason you shouldn't trust the signed binary - unless you have sufficient time and expertise to audit the source.

This is how I view it:

* Being open source protects against a malicious developer. Otherwise there is nothing preventing him to build the binary with a different source, and send the passwords to his own server.

* Signed code archive prevents against a compromised hosting site.

In order to get from a trusted source to a trusted binary, you have to trust the compiler and its dependencies as well, I think.

This. And the benefit is it's easy to add your own fixes to your local version too. Stuff like removing the PerformSelfTest() call, adding items to the ListView in batch, item bounds checking when refreshing the ListView, etc. can quite noticeably speed up the UI, and random window focusing/sizing issues aren't too hard to fix either.

You might also consider submitting such changes as a patch to Dominic, the developer.

In a perfect world I would love to, but every time I've tried to submit improvements to open-source software I've come out extremely frustrated with how many hoops I have to jump through just to get my code properly considered, let alone merged. Half the time the developers are extremely resistant to changes and believe the change is wrong/unnecessary, or the current state is already correct, or that the changes are too big and/or not worth it, or that their upstream code is responsible, etc., and the other half the time they're admittedly quite welcoming but present hoops that on my end I simply don't feel like jumping through (like putting more personal info on the internet than I care to), especially when I'm already going out of my way to help people. Maybe you'd think the problem is with me, or maybe Dominic would be an exception in all regards, but wherever the problem is, I've grown very reluctant about the idea in general, so I just fix bugs on my own computer and let someone else who cares & has the time/energy to put up a real fight fix the issues for everyone else.

> their upstream code is responsible

Then you're not going to the good people. Stop going through intermediaries, go straight for the source (package specific issues on Ubuntu must be reported to Ubuntu -like python not recognizing a new module-, but bad code inside the package must be dealt with with upstream).

> Half the time the developers are extremely resistant to changes and believe the change is wrong/unnecessary, or the current state is already correct, or that the changes are too big and/or not worth it, [...]

That's why I take the habit of jumping on IRC first, talking with devs a bit and trying to understand why I find a specific piece of code problematic.

I was trying to add support for i686 on an AUR package I maintain; quickly dismissed "we don't support i686 anymore anyway, just slap comments in your PKGBUILD and ship it".

I was working with the btrfs(8) util, which has the most horrific interface ever designed; "OK, we're not hostile to a new interface design, but you'll have to provide a comprehensive explanation of what you want and how it should behave".

And finally, documentation usually gets merged real fast (recently on cbsd(8) and nextcloud).[0][1]

[0] https://github.com/nextcloud/documentation/pull/826

[1] https://github.com/cbsd/cbsd-wwwdoc/pull/12

I assure you I'm not naively just dumping code on random developers and telling them to merge it. I do talk to them first, that's exactly how I figure out they think their code is fine and my changes are unwelcome whenever that's the case. (Edit: Well, mostly. It's also happened that my changes were rejected after I made the patch, but that was nevertheless after discussions had already taken place. Like when I said they later decide the patch is too big.) And regarding the upstream project issue: in the case I had in mind, the upstream project had its own reasons for not doing things the way I mentioned. The changes really did belong in the downstream project, but the downstream guy just didn't care to have to maintain the changes. Although, I also have to point out that upstream projects tend to present even more obstacles for merging code -- not only when the entire reason there's a downstream fork is that upstream is not going to support the entire platform/architecture/whatever, but also when they're big projects with their own hoops I don't care to jump through on my end as I explained earlier.

keepassxc

What if you don't have/want cloud syncing programs installed on your whole system just for the sake of a password manager?

They aren't required. I use KeePassXC and don't use any type of cloud syncing.

No, the question is what if you do want cloud syncing for your passwords (you need to sync with your phone somehow without manually uploading/downloading from a browser every time...), but unable or unwilling to install a background cloud syncer installed on every system you use KeePassXC on. People blindly suggest KeePassXC without realizing not everyone has or wants a cloud syncer installed on their entire system.

That was worded a bit ambiguously then

You're not really going to get around having to install "something" to sync your passwords if you want to have your passwords synced

You could use something like Syncthing if you just don't want to trust any company with your data

Otherwise, I cant really suggest a solution either

> That was worded a bit ambiguously then

Sorry, I hope it's clear now.

> You're not really going to get around having to install "something" to sync your passwords if you want to have your passwords synced

Huh? This is obviously wrong; I'm doing literally this with KeePass. I haven't installed anything, and it has a plugin to sync directly with Google Drive that doesn't mess with or care about anything in the rest of the system.

So then you have installed a Google drive agent, or at least you use the service? That is the problem you're discussing.

I don't follow you. I use Google Drive, and I don't install additional software on the OS. I just sync with it directly using KeePass. There is no "problem". It works just just fine.

My understanding of the problem under discussion here is that there are some people who will refuse to use a cloud syncing service, period. Syncing with Google Drive does not get around this constraint, regardless of whether it requires any locally installed software.

Additionally, I was not personally aware of any way to "sync directly" other than using the Google Drive desktop client (https://www.google.com/drive/download/) and storing the database file in the synced folder. It sounds like you're saying Keepass has some direct integration with Google Drive?

All of that said, I am really not invested in this issue - I use multiple cloud sync services and it doesn't bother me.

> I was not personally aware of any way to "sync directly" other than using the Google Drive desktop client. It sounds like you're saying Keepass has some direct integration with Google Drive?

Indeed it has a plugin for this, yeah. That's exactly what I'm saying. https://sourceforge.net/projects/kp-googlesync/

Syncthing isn't very intrusive in my experience/opinion.

I created a keepass/syncthing directory somewhere inside my home directory, and I told Syncthing to sync only that directory. And the directory only contains the Keepass database plus a few Syncthing log files and such.

What does this have to do with keepassxc? (the community version of keepassx)

It doesn't have built-in syncing, unlike KeePass. So if you want cloud syncing you have to install an entire syncer on your file system just for the sake of that one program. The assumption that everyone has or wants an automatic behind-the-scenes file syncer installed on every system they use the program on is quite a big and incorrect one.

All keepass executable downloads have valid digital signatures and are signed by the developer.

I usually just use SHA / MD5 checksum, digital signatures

I think 7zip has a way for you to check the hash signature with just a right click on the file so thats dandy

Are you imparting trust on checksums downloaded from the same source page?

Not implying you are but there is plenty of software where that is how they expect users to verify the integrity of the download. Useful for checking bit errors, but in the event that someone has replaced the binary then they could probably also replace the checksum...

I didnt think about that, but there's not always a reputable alternative checksum source.

I was thinking about all the times I had to download a windows ISO. And how microsoft had openly published what the checksum values were so I could verify this after downloading from a 3rd party

I would need to do more research here you make a good point

I'm getting a different installer file from this website with not as many ad bundles detected : https://www.virustotal.com/#/file/23c3a4564265bc996ab61c1227...

Anyway, this wouldn't be the first time an open source software is packaged with some adware. Unsavory, but I think within the limits of the license.

seems to be just another bundler from the same network (installcore), but packed with a different exe packer

Pretty ironicly, Terms of use warn to be very careful when downloading files with an exe.,. Vbs,. Lnk,. Bat,. Sys, or a suffix com., Because these files may contain a virus or spyware !

It's a common technique used by hucksters, "here's some friendly advice ...", it's both an attempt to signal good intent and to load the mark with a subconscious sense of having been done a favour (and so needing to do a favour back to the huckster/salesman.

Not ironic: totally intentional marketing trick. It makes you more inclined to trust the provider of the warning. They seem knowledgable about something important, and they're sharing that information with you. More insidiously, it makes you less likely to apply the warning to them. Because (unconsciously you think this) why would someone warn you about a trick they themselves are trying to pull?

Who did this without thinking about an exfiltration tool instead?

I thought this too. Obviously not a very creative use of the domain squat. Worth reading:

- https://en.wikipedia.org/wiki/Cybersquatting

- https://en.wikipedia.org/wiki/Brandjacking

one of those "make money online"/"internet marketing" type people just wanting to get the affiliate commissions from a pay-per-install network of the PUP bundler type.

Unfortunately I can't read the article without enabling javascript - anyone care to post a summary? :)

Unrelated to the topic, the article points out a lot of things about certificates in the URL bar. That got me to think about the URLs themselves, can I set my browser up so it displays the punycode representation of my url?

network.IDN_show_punycode in firefox

The french is also terrible, google-translated french.

This is correct french, and there is no way this was machine translated.

Source : am french

It's proper french. I think I can be fooled by this website.

Except it's not? It's totally proper French, even if it has some grammar errors, but we're usually not that good in grammar so yeah...

Examples? There's some subject and possession disagreement here and there ("Cette clé, que vous définissez ... accéder à tous ses autres mots de passe"), but otherwise looks pretty good.

There's "crypter" instead of "chiffrer" but I know some people think that "crypter" is acceptable.

Ye that's what i was thinking about, didn't realise crypter existed, there's me shown! I should have looked more closely.

Something I don't understand though is when I do a google search, google sometimes sponsors these phony sites.

One time I downloaded the wrong google chrome which was ironic because I was on google searching it.

Other examples that come to mind with different sites are popcorn.sh vs popcorn-time.to. There not the same repository.

Normally I just do a sanity check by checking the domain URL and checking if it has authority.

If its on sourceforge... I just assume its malware or has bundled PUPware on it, run it through antivirus and SHA/MD5 checks.

Ninite.com is pretty convenient I hope they don't get comprimised one of these days and get sold to a shady vendor

Reply on news.ycombinator.com