Sourceforge Using ADs As Download Vectors For Malware

CRogers · **Joined:** Aug 15, 2013 **Posts:** 125

There is only one page that I actually care about. I don't care how many mirrors there are, or where else on the internet it is hosted, the only link I care about is the one off gimp.org's downloads page for the windows installer. That's the link that should have no ads, and no download buttons ANYWHERE, if the link activates a download. All you should see is the "Your download will begin in a few seconds" message. In fact, it shouldn't be hosted on Source Forge at all. It's fairly obvious the site is not a trustworthy source for installation packages anymore.

I'm telling Richard Stallman. lol :hoh

CRogers · **Joined:** Aug 15, 2013 **Posts:** 125

Incidentally, I got to meet Richard Stallman when he came to speak in Brighton, UK. Everyone was taking pictures which made him uncomfortable, so I didn't. I said "I won't bother you with a camera, but I will shake your hand and say "Thanks for coming to speak for us"." I shook his hand, and he said "Happy hacking." to me. It was awesome. lol

Rod · **Joined:** May 16, 2010 **Posts:** 16200

All you need to do is click the link at gimp.org website and the download starts. If the problem is your friends are confused when the source forge page loads, just ask them to do nothing and wait for the download dialog to appear. It will on it's own.

However i do agree that "Your download has started" should be in larger text.

mackenzieh · **Posted:** Mon Aug 19, 2013 1:07 pm **(#24)**

CRogers, Just recommend the gimp website http://gimp.org
That's where I downloaded GIMP. That way, no spam or spyware is involved.

CRogers · **Joined:** Aug 15, 2013 **Posts:** 125

No, everyone's missed the point. I don't want to have to babysit everyone I send to gimp.org!
I don't want to have to warn people away from clicking potential malware links disguised as download buttons. Downloading GIMP should be easy, safe, and problem free. No one should have to guess how it's done to keep from getting adware installed on their PC. Normally if I see more than one download button on a site, I leave. I don't even risk it. Why should I? Why should anyone?

Do you know how angry Richard Stallman will be? He gets upset if you say "Linux" without "GNU" in front of it. What do you think he's going to say when he finds out that people might get infected with adware/malware on a gimp download page? :hoh

Rod · **Joined:** May 16, 2010 **Posts:** 16200

Perhaps on this page
http://www.gimp.org/downloads/
There should be a warning that the link will open in a source forge page but the download will start automatically.

rich2005 · **Joined:** Mar 04, 2011 **Posts:** 2618

Odinbc wrote:

The SourceForge Installer is not in all Windows downloads from SourceForge.
Is there any evidence that the Because of malware being found in SourceForge downloads, this link has been removed.
download uses it?

AFAIK Gimp uses the Inno freeware installer from JRsoftware.

For the paranoid out there

Logging a Win7 32 bit VM using WinToolsPro for a Gimp 2.8.6 installation.

This a custom setup & did not include the translations or desktop/quicklaunch icons.
Most of the reg entries are associations + uninstall etc
No weird files installed, all in ..\GIMP 2 plus a few windoze log files.

Next the first run

A bit surprised at the 46 reg entries, some a bit strange but these involve windows games?
files the usual .gimp-2.8 folders + some python into ..\GIMP 2

Anyone want to look at the logs unzip the attachment if you dare

YAFU · **Joined:** Nov 09, 2011 **Posts:** 726

Oops! So GIMP SourceForge page is not official?
Because of malware being found in SourceForge downloads, this link has been removed.

So I do not know if the GIMP developers can do something about referring to SourceForge.

Jernej Simončič appears in the item "... and dozens of others listed in a separate page":
http://www.gimp.org/team.html

So this is OpenSource, anyone can offer to download GIMP. Unfortunately, there may be cases where any OpenSource program could be used as bait to mislead people and introduce malicious code in many ways. We'll have to be more careful and always recommend downloading from the official site or reliable people that we know from the forums..

Rod · **Joined:** May 16, 2010 **Posts:** 16200

Thanks rich2005. I dare. :lol

Rod · **Joined:** May 16, 2010 **Posts:** 16200

One thing i noticed in setup is with Parthas Gimp-2.8.5 installer there is no libexec folder.

Also his uninstall folder is named setup.
I haven't downloaded Gimp from gimp.org in a long time anyways. I always grab it from Parthas website now.

Mainly because he catches the bugs and fixes them faster than the new dev beta releases do.

rich2005 do you mind trying a vm install of Parthas version of gimp-2.8.6?
http://www.partha.com

GnuTux · **Posted:** Mon Aug 19, 2013 2:21 pm **(#31)**

Here's the problem. Sourceforge, like 10s of millions of other websites, allows advertising via various Ad networks, including Google Adsense. Context sensitive Ads are served up randomly, based on keywords contained on a given webpage and optionally, keywords entered by the account holder. Advertisers want you to download various download managers, trial-ware, tool-bars and such, which may contain adware or spyware. When you go to a download page on any website that uses one of these Ad networks, like Google Adsense, the context search scripts will pick up the keyword "download" and start serving up ADs that contain a download button, in hopes that some of the users will click and install that by mistake.

Windows users are the most vulnerable because as a matter of practice, they install binaries from various websites all over the internet. This opens Windows users up to a plethora of potential attack vectors, so they have to be extra careful not to fall prey to these types of shenanigans. In the end though, they are agreeing to install the junk and they should take a moment to the read the TOS before answering "yes" to anything. For the most part, Linux users don't have to worry about these kinds of things because they usually install binaries from their disros' repositories. Windows users also tend to be less "techie" and can be easily confused when it comes to installing binaries.

Getting to my main point, this is an issue that Windows users face on any website that displays Ads from Google or any other Ad network, no matter which package, GIMP or otherwise, they are looking to download and install. The same type of ADs containing download buttons appear on every package on Sourceforge. Just pick a package at random, refresh the screen that contains the ADs a few times, and you'll see what I mean.

Here is a screen shot of a case in point: emule.

So, what is the solution? The only solution is to place the files on a page that doesn't display ADs from Google (or one of the other popular AD networks). As far as GIMP is concerned, that would be whoever is responsible for the decision to use Sourceforge as their binary hosting site. My suggestion, to avoid this kind of thing, would be for GIMP binaries to be hosted directly on gimp.org.

Rod · **Joined:** May 16, 2010 **Posts:** 16200

GnuTux wrote:

Here's the problem. Sourceforge, like 10s of millions of other websites, allows advertising via various Ad networks, including Google Adsense. Context sensitive Ads are served up randomly, based on keywords contained on a given webpage and optionally, keywords entered by the account holder. Advertisers want you to download various download managers, trial-ware, tool-bars and such, which may contain adware or spyware. When you go to a download page on any website that uses one of these Ad networks, like Google Adsense, the context search scripts will pick up the keyword "download" and start serving up ADs that contain a download button, in hopes that some of the users will click and install that by mistake.

Windows users are the most vulnerable because as a matter of practice, they install binaries from various websites all over the internet. This opens Windows users up to a plethora of potential attack vectors, so they have to be extra careful not to fall prey to these types of shenanigans. In the end though, they are agreeing to install the junk and they should take a moment to the read the TOS before answering "yes" to anything. For the most part, Linux users don't have to worry about these kinds of things because they usually install binaries from their disros' repositorys. Windows users also tend to be less "techie" and can be easily confused when it comes to installing binaries.

Getting to my main point, this is an issue that Windows users face on any website that displays Ads from Google or any other Ad network, no matter which package, GIMP or otherwise, they are looking to download and install. The same type of ADs containing download buttons appear on every package on Sourceforge. Just pick a package at random, refresh the screen that contains the ADs a few times, and you'll see what I mean.

Here is a screen shot of a case in point: emule.

[ Image ]

So, what is the solution? The only solution is to place the files on a page that doesn't display ADs from Google (or one of the other popular AD networks). As far as GIMP is concerned, that would be whoever is responsible for the decision to use Sourceforge as their binary hosting site. My suggestion, to avoid this kind of thing, would be for GIMP binaries to be hosted directly on gimp.org.

I agree.

That or as i stated before, add something to the effect of "This download will open in a new Source Forge window or tab. The download will start automatically. Please wait for the download and save as dialog window to appear.

That would probably help immensely. I wonder how many Windows users are deciding not to download GIMP because of this.

CRogers · **Joined:** Aug 15, 2013 **Posts:** 125

GnuTux wrote:

*snip*My suggestion, to avoid this kind of thing, would be for GIMP binaries to be hosted directly on gimp.org.

An excellent idea. Maybe we can start a petition? Think I'll add Inkscape to that list too, since the result is the same.

Thanks for your input, Tux.

Alec Burgess · **Joined:** May 09, 2012 **Posts:** 28

I walked through GnuTux's example with eMule starting from Googling [emule] and going to the sourceforge link. Then turned off AdBlockPro (for me in Google Chrome) and refreshed a couple of times. 2nd time showed a VERY BIG [DOWNLOAD] button.

Moral: browsing in Windows w/o some kind of Ad block software is a mug's game. I suspect 9 out of 10 Gimp Chat users know this already but how to educate those potential users who need the info most .... ?

Rod · **Joined:** May 16, 2010 **Posts:** 16200

I always directed folks to parthas website as i trust his builds so much. So i never really saw this as a problem. But i see it now.

http://www.partha.com

rich2005 · **Joined:** Mar 04, 2011 **Posts:** 2618

Rod wrote:

..snip
rich2005 do you mind trying a vm install of Parthas version of gimp-2.8.6?
http://www.partha.com

What a monster, 5000 files, anyway FWIW installed in a 'clean' Win7 VM, not over the top of an existing GIMP.

Rod · **Joined:** May 16, 2010 **Posts:** 16200

rich2005 wrote:

Rod wrote:

..snip
rich2005 do you mind trying a vm install of Parthas version of gimp-2.8.6?
http://www.partha.com

What a monster, 5000 files, anyway FWIW installed in a 'clean' Win7 VM, not over the top of an existing GIMP.

Thank you sir.

billps · **Joined:** Jun 26, 2013 **Posts:** 16

If anyone doesn't think sourceforge's advertising is out of control, then look at this:

That's why Windows users need Adblock. And sadly that's why I no longer refer people to gimp.org to download the software - because it links to that page.

GnuTux · **Posted:** Sat Sep 07, 2013 11:35 am **(#39)**

Yeah, I think that is way over the top. If a download site is going to run ADs, they should not place the ADs in a location where users can be easily confused with the actual download link, which means the site is complicit in attempting to trick its users into downloading malware.

YAFU · **Joined:** Nov 09, 2011 **Posts:** 726

billps wrote:

That's why Windows users need Adblock.

I'm GNU/Linux user and I don't like Microsoft.
But I must say that this misleading ADs is potentially dangerous for Linux too. If they give to download a binary package with malware to install on Linux as root, an inexperienced user could be fooled.
Viruses able to replicate without user intervention is the kind of malware that is very difficult to exist in Linux. But the Linux user being fooled could give permission to install some malware.