Slashdot Mirror
Project Hosting Service Fosshub Compromised, Embedding Malware Inside Hosted Files (softpedia.com)
At least some applications on Fosshub, a free project hosting service appear to have been compromised, according to several reports. (Update: Fosshub has acknowledged the hack.) The software portal, furthermore, is serving malware payloads, reports add. Catalin Cimpanu of Softpedia says that a hacking group which goes by the name of PeggleCrew is responsible for the hack. "In short, a network service with no authentication was exposed to the internet," the hacker told Softpedia in an email. "We were able to grab data from this network service to obtain source code and passwords that led us further into the infrastructure of FOSSHub and eventually gain control of their production machines, backup and mirror locations, and FTP credentials for the caching service they use, as well as the Google Apps-hosted email." The hacker group told the publication that they have compromised the entire website, "including the administrator's email. He also revealed he didn't dump the site's database but claimed that "passwords weren't salted." A user on Reddit, who has since received lots of upvotes, adds: Some popular apps that have links to FossHub that may be infected include: Audacity, WinDirStat, qBittorrent, MKVToolNix, Spybot Search&Destroy, Calibre, SMPlayer, HWiNFO, MyPhoneExplorer, and IrfanView.Another application which has reportedly been compromised is Classic Shell. It is ostensibly overwriting the MBR on users' computers. Many users are upset with the timing of hack, noting that plenty of people were looking for Classic Shell amid the release of Windows 10 Anniversary Update. Update: 08/03 17:30 GMT by M :In a blog post, Audacity said that Fosshub was serving a hacked copy of its audio editing software for three hours. It adds that "no Audacity Team infrastructure was compromised." Fosshub team writes: Last night we had a security incident caused by a group of hackers that allowed them to log-in to FossHub developer *through* an user that was compromised. Shortly after, we noticed two users that were compromised. They simply logged-in using their passwords and this allowed them to escalate. [...] Several hours later, we noticed the attackers were able to gain access through an FTP account and we decided to shut down the main server immediately to prevent any further infection/damage. FossHub.com is down on purpose until we are able to identify the way hackers were able to escalate. Fosshub insists that the hacked copy of Classic Shell was only downloaded 300 times. In the meantime, if you know someone who may have downloaded the compromised copy of Classic Shell, here's what they need to do next.
I updated Classic Shell yesterday. How do I tell if my MBR got re-written, or other malware got installed?
Sourceforge hosted malware and embedded it within project files for a long time. It seems like distributing malware is par for the course with open source software.
I don't know anything about malware hosted files... but I can tell you a lot about apk's malware infested host file.
...right? right?
It's one of the best programs since Windows 8 came out.
There's really no excuse for a site being compromised in this manner. In order to gain such access, there must be extreme negligence, one instance of which is the lack of salted passwords. This is all too common, yet website operators who should know better fail to properly secure their sites. At some point, sorry isn't enough, and we need to start imposing real penalties for negligent security practices. If a business made this mistake, there would be calls for sanctions against the business. It's time to send website operators to prison, regardless of whether it's for business or not, when they should know better and their negligence can harm other users. Maybe security will improve when people start going to jail for criminal negligence.
Stop relying on project-hosting websites like Fosshub, Github, etc. Host your own damn projects on your own website on your own servers.
I couldn't find any information on _when_ this was likely to have happened. I use 1/2 that list at home and the office, but haven't updated any in a few weeks at least, so I'd like to check that out.
>the hacker told Softpedia in an email.
>The hacker group told the publication that they have compromised the entire website
>A user on Reddit, who has since received lots of upvotes, adds
--->>>Many users are upset with the timing of hack, noting that plenty of people were looking for Classic Shell amid the release of Windows 10 Anniversary Update.
This is Slashdot's new way of promoting Windows 10 on behalf of the US government and Microsoft. Roll Dice if you know what I'm saying.
Nobody is going to hack and disturb an open source software hub, knowing it is simple to replace and compare hashes for security. Further, nobody using open source is going to also use Reddit.
Lying fucking Slashdot. liar liar pants on fire.
They are made because of this thread. https://interviews.slashdot.org/story/16/08/03/0418200/interviews-ask-ruby-on-rails-creator-david-heinemeier-hansson-a-question
and we are mearly players in various subdivisions. Conform! Or be cast out!
Also look at what they said in the summary here
Some popular apps that have links to FossHub that may be infected include: Audacity, WinDirStat, qBittorrent, MKVToolNix, Spybot Search&Destroy, Calibre, SMPlayer, HWiNFO, MyPhoneExplorer, and IrfanView.
Simply put, if they think those may be infected it is a simple restore from backup from like all over the Internet literally.
"THAT MAY BE INFECTED" oh yeah, seriously guys. No, seriously ya.
Ouch.
That site was pretty thoroughly compromised. It's going to take ages to clean up this mess. If it was me, I don't think I could ever trust that site to host my files again.
My only concerns now are: where source repositories compromised and is there any chance compromised applications will make it - or have made it - into, say, Debian or Fedora, or did the compromise just affect Windows installers (as the summary implies)?
Yep it is FUD. It may take 20 minutes to put the right MD5'd files back up, only because of having to change passwords.
An email to Softpedia is Social Engineering in-reverse 101.
usually you send an email to get somebody to believe something so you can hack them.
In this case it is an email to a bullshit site claiming they were already hacked. Same deal. Social engineering but posted on Slashdot as news.
Fuck you Slashdot. Use your heads ok?
They say the hacker group is PeggleCrew
That is a US government hacking group. I know my hackers.
OurMine is Israel but not state sponsored.
Anonymous is Israel state sponsored.
Lizard Squad is NSA.
Well what it sounds like then, if PeggleCrew is a government crew, and this story is a lie. The government are pushing lies on Slashdot now.
"Many users are upset with the timing of hack"
That makes it sound like that Fosshub choose when they were to get hacked.
How do you figger nigger just cuz yo lips are bigger
nobody reverse engineered windows closed source installers to hack irfanview you fucking retard. download one and download one from the actual site and md5 sum them. same? ya no shit stupid.
EVERY CHANCE I GOT loca7ing #GNNA, market share. Red
>Update: 08/03 17:30 GMT by M :In a blog post,
Stay on it, nobody knows what to do about this driving issue. meanwhile if legit, you would have said basically nothing yet... just waited until they restored their irfanview repository from backup and changed their password.
Such bullshit. Slashdot is not telling the truth here at all.
look like some bitches now. Maybe soylentnews now?
HEADS UP, this is a fact. Nothing gets -1 unless it demands attention.
I actually got burned with WinDirStat (trying to free up space in a VM). Since it was a VM, no big loss/deal to fix. Now I just have to figure out why the new Windows 10 Anniversary Update logs me out automatically. *sigh*
This is a discussion of the temporarily infected Classic Shell installation file: W10 anniversary update, installed CS4.3, had to repair OS.
Clean: ClassicShellSetup_4_3_0.exe
MD5: e10881b65c27c6e09e5a33cd8bcd99c6
SHA1: a6b06d07fe3b1a7204b1b62c67fbf3c602385364
File size: 7220496 bytes
Infected: ClassicShellSetup_4_3_0.exe
MD5: c67dff7c65792e6ea24aa748f34b9232
SHA1: 438b6fa7d5a2c7ca49837f403bcbb73c14d46a3e
File size: 7148732 bytes
Lie.
Only LUDDITES infect Appdows 10 with LUDDITE Classic Shell because they're too stupid to use appy app apps!
Apps!
So Fosshub's statement acknowledging the hack means nothing?
If a popular downloading website doesn't secure their site with TLS then they deserve to get hacked. Ninite is much better to package your downloads anyway. This website needs to burn.
This is the Softpedia which scrapes open-source project sites for files and then downloads them to their servers to offer to the world.
Softpedia tends to host chunks of the original content, and not all of the content. In the case of many open-source projects, they have one or two versions and they are not the most recent.
Softpedia should STFU, fucking parasites.
They are hijacking open source projects and have as much integrity as the u.s. government or that dead fuck which used to run apple.
qBittorrent has GPG signed files. It also double hosts them on FossHub and Sourceforge.
As was said above 100 x.
"Windows logo when you start up? Then you got malware installed."
More technically precise: Should be "Then you got EVIL installed." Malware is destructive in only one or a few ways. With Windows 10, Microsoft plans an ongoing delivery of EVIL.
Contrary to popular misconception, Pinocchio is not a pathological liar in the story but instead someone who learns from his mistakes, including learning not to need to lie. If only Slashdot were the same way.
No, you're just a moron. Classic Shell forum post about the hack and a screenshot which is exactly what I saw. Jesus, you're a bunch of pathetic paranoid fucks.
Website gets hacked, a few suckers (like me) have to fix their mbr (and partition as it breaks that too for some), and life goes on.