Hacker News Reader

Comment by nneonneo | Hacker News Reader

The source code itself looks relatively clean; there's autoupdate functionality but it looks like it's gated behind a confirmatory dialog box.

It's much more likely that the binary releases and/or autoupdate binaries are backdoored. If someone compiles their own version, and then clicks to accept the autoupdate, they could be infected. The binary is 15+MB in size, which is far more than enough to hide a small backdoor.

View on HN

It's the auto-update functionality from a now-suspect URL. The repo has since been taken down, but here's the suspect file:

https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...

Drat, archive.org didn't snag it. Do you happen to have a copy? https://web.archive.org/web/20230000000000*/https://github.c...

check https://github.com/bb33bb/getsymbol and https://github.com/clayne/win-getsymbol, two up to date forks -- and my comment above https://news.ycombinator.com/item?id=37425311

Found these two forks which are still accessible (and are supposedly up to date with the upstream repo (linked in the comment above) which is not accessible anymore):

https://github.com/bb33bb/getsymbol

https://github.com/clayne/win-getsymbol

here is the same link as in the comment above from one of the forks:

https://github.com/bb33bb/getsymbol/blob/main/GetSymbol/CMai...

the code fetches from `UPDATE_CHECK_URL`, which is hardcoded as:

https://dbgsymbol.com/version

which as of the time of this posting, returns:

"GetSymbol 2.0.3|https://dbgsymbol.com/downloads/2.0.3/GetSymbol.exe"

the GetSymbol.exe file (which is downloadable right now) being presumably the infected file being discussed..!

wow! all mirror repos (I found 5) have since been disabled :-)

you can still see cached bits of the code via github search -> https://github.com/search?q=path%3AGetSymbol%2FCMainDlg.cpp+...

and a tiny bit of the repo's main page in google's cache: http://webcache.googleusercontent.com/search?q=cache%3Ahttps...

and the user's github profile, again from google's cache: https://webcache.googleusercontent.com/search?q=cache:JXXyoV...

the dbgsymbol.com links above still work, obviously.

Github just erasing a repo and forks from existence is scarier than any potential malware that could have been included there. Not the first time they have done this - usually based on copyright accusations, but the reason does not matter - if you must use ShitHub, at least mirror your projects elsewhere folks.

Yeah that’s what I’m referring to. IIRC it requires clicking/confirming a dialog to actually run the “update”, although I didn’t look that carefully before it got taken down.

There were also some binary DLLs in the repo (in the x64 directory) which get loaded/executed on first launch and then deleted. I didn’t reverse-engineer to see if there was anything malicious inside of them, but it seemed pretty fishy to me.

Reply on news.ycombinator.com