FileZilla Has an Evil Twin That Steals FTP Logins 197
Nerval's Lobster writes "On the same day the world discovered Western intelligence agencies were siphoning user information from Angry Birds and other popular smartphone apps, a leading antivirus developer revealed hackers are doing the same thing with one of the most popular open-source applications on the Internet. Maliciously modified versions of the popular FTP application FileZilla look and act just like the real thing, but include extra code that steals the login data typed in by users and sends it to an unauthorized server using the same FTP operation launched by the user without going through a firewall that might spot what it's doing, according to an alert posted this afternoon by antivirus developer Avast Software. The malicious version is fully functional, uses the same graphical interface and component file names as the original, and masks itself further by avoiding any suspicious entries in the system registry, overt attempts to communicate with outside servers or other changes, according to the Jan. 27 alert from Avast. The most obvious differences are that the poisoned version of filezilla.exe is 6.8MB smaller than the real thing and there are two DLL libraries included in the fake that are not present in the original. They are labeled ibgcc_s_dw2-1.dll and libstdc++-6.dll, according to Avast. The official version's Nullsoft installer is v2.45-Unicode; the evil twin uses v2.46.3-Unicode. Automatic updates also fail on the poisoned version 'which is most likely a protection to prevent overwriting of the malware binaries,' Avast added."
Firewall (Score:5, Interesting)
I'm not fully understanding the "sends it to an unauthorized server using the same FTP operation launched by the user without going through a firewall that might spot what it's doing" part. It's posting the stolen credentials via http, not FTP. If FileZilla is only given access to the FTP port then it should block this behavior, correct? I'm just not understanding what's magical about this - any app that is already given blanket permission to access the network in a general way can send data to places it shouldn't go without being blocked by firewalls. They make it sound like there's something special or exotic it's doing to avoid the firewall and I'm not understanding exactly what that is.
Re: (Score:2, Interesting)
More importantly, any app which legitimately needs access to an internet-enabled DNS resolver can exfiltrate data without permission to access the internet on its own. What you need in order to catch this kind of thing is an IDS, not a firewall.
Re: (Score:2)
As long as an app can connect to a random IP, there is a way to send data.
No need for any particular port access if you control the receiving server.
Re:Firewall (Score:5, Interesting)
Re: (Score:2, Funny)
fatphil.*******.haxorsrus.ru is not a valid domain name.
Re: (Score:3)
The "DNS servers you use" are the things that do the sneaking information in and out for you - that's their job.
Re:Firewall (Score:5, Informative)
If FileZilla is only given access to the FTP port then it should block this behavior, correct?
What "FTP" port? Every FTP transfer requires a control connection and a data connection --- the data connection is established based on a procedure that depends on transfer mode -- there is standard mode, or passive mode (for firewall traversal).
In either case, the destination port number is not a specific FTP port, but a port number dynamically allocated by the server and presented to the client, or vice-versa
In Passive mode, to establish the data connection, the FTP client must open a connection back to the server ON ANY PORT specified by the server, sourced from its ftp-data port.
In Active mode, the client must select an ephemeral port from the 32768 to 65535 range, send it over the control connection, and accept a TCP connection from the server.
Re: (Score:3)
FTP: Still sucking because it was invented with NCP in mind.
Re: (Score:2)
The Standard data connection to any FTP server is (23)
No. Port 23 is the WKP of the Telnet service.
An error is the ports about 32768 as it's anything abover 1024 that's fair game with the ephemral ports being above 49151- the registered ports
The default ephemeral port range in Linux and many operating systems is 32768 to 61000. The remote end is not entitled to make assumptions about what range ephemeral ports may be allocated from by the opposite end. The remote system has free use of all valid
Re: (Score:2)
"You canâ€(TM)t find any suspicious behavior, entries in the system registry, communication or changes in application GUI." Apart from the suspicious behaviour and the communication, that is - duh!
If they can't describe what it does, they clearly don't understand what it does.
Just make sure you compare known hashes which you got from a secure (and trusted by you) server when you download binaries. Then this problem m
Re: (Score:3)
Re:Firewall (Score:5, Insightful)
That would indeed be a bit more exotic, but from what I can tell it's just doing a simple http get to the Russian server with the encoded credentials. From the Avast report:
https://blog.avast.com/wp-cont... [avast.com]
The DNS lookup to the Russian server and the http get are there as plain as day.
What we need is a mechanism (Score:2)
Re:What we need is a mechanism (Score:4, Insightful)
Then the problem shifts from getting your binaries from the right website to getting your sourcecode from the right website.
Re: (Score:2)
Re: (Score:2)
Hashes help, but aren't perfect... If the original source of the code was compromised, then the published hashes could be too and any mirror sites would also pick up the backdoored version. But this isn't unique to open source code, the same attacks can be performed on binaries too if you control the original distribution point.
On the other hand, having the source increases the chance that any changed would be detected by third parties.
If someone only compromised a single mirror site, then you should be abl
Re: (Score:3)
The binary is never going to be identical - it contains all kinds of platform- or compiler-dependent stuff, as well as timestamps. Depending on optimization flags, the compiler may even restructure it differently, with no practical way to isolate security-relevant portions that should remain unchanged. And a malicious payloads could be basically anywhere in the executable, so every part is security-relevant.
The approach is still good, but since it already involves distributing the source code, it would make
Re: (Score:3, Informative)
You're over thinking it.
if you're compiling from source, check the hash of the source against an official source of the source.
If you're running a pre-compiled binary, then check the hash of the binary with an official source of the binary.
Re: (Score:2)
Re:What we need is a mechanism (Score:5, Informative)
No need to be condescending. I use FOSS all the time. Yet, AFAIK, there is no such mechanism that lets a developer introduce security fingerprints which "tag" a critical section of code, and which the compiler adds to the binaries, in such a way that after compiling source locally, you can check critical parts of your binaries on compliance with the "official" fingerprints. Or am I mistaken ?
There is no mechanism in most compilers/linkers that allows you to recreate the exact same executable that someone else built, byte by byte. You would need a compiler to be hundred percent deterministic. I could imagine some optimisation algorithms working better with some randomisation, so that wouldn't be possible. a+b could sometimes translate to "load a, add b" and sometimes "load b, add a". Things like the __FILE__ macro in C or C++ include the full path of the file, which is different on your machine than on mine. And of course you'd need the exact same build environment. Exact same version of every library that is used.
Re: (Score:3)
Re: (Score:3)
No, but why would you want to do things in such a convoluted way?
Typically you just verify that the sourcecode you build from matches the published source through the use of checksums and/or gpg signatures... Verifying the resulting binaries would be flawed, as all manner of things could change the resulting binaries such as compile time flags, development headers, compiler version, linked libraries, linker/compiler options etc.
Aside from verifying the original source, if there are modifications made to the
Re: (Score:2)
Re:What we need is a mechanism (Score:5, Funny)
What you seem to want is Gentoo.
Gentoo? I've only got an 8 core machine with 64G of RAM.
Re:What we need is a mechanism (Score:5, Informative)
The question is really do you have SSD. It only takes a few days to build gentoo on some architecture which actually benefits from it, like a K6... with a laptop drive. On a modern machine with a SSD you ought to be able to knock it out in actually quite reasonable time.
Re: (Score:2)
With 64GiB, he doesn't even need a SSD. Just use a RAM disk for the build process
Re: (Score:2)
Re: (Score:2)
It's been a long time since I built gentoo, but it really only took me a couple days to get it with a browser on a K6 laptop with 384MB RAM. I would anticipate even a modern vintage installing on such a platform in less than a week. That seems like a long time, and it is if it's your only machine, but if your only machine is a K6 laptop then you can probably upgrade for free :)
I don't much see the point of gentoo on massively powerful hardware. On limited hardware for which there's no builds and which benef
This is BIGGER than Filezilla (Score:3)
Without a doubt this will be used as propaganda against the entire Open Source community. Everything OSS.
I'd bet the Sales & Marketing Dept. at Microsoft and the all the rest will have talking points in their sales peoples hands before the end of the day.
At this moment, there is nothing about this on the Filezilla project's website. GET ON IT people!
An accurate explanation should be front page before the scare tactics have a chance to work.
Plus, users need an instant & easy way to identify if their version is legit to ease their minds.
Now concerning the bad guys... I'd suggest some sort of vigilante justice is in order.
Perhaps identifying the rogue servers and uploading something the local authorities might be interested in.
Actually, Windows is partly to blame here (Score:3)
There is no equivalent in the Windows world to the signed source repositories of Linux. Windows keeps itself updated through signed updates, but does nothing about the other thousands of applications and libraries that are installed. There's probably a good reason why this rogue FTP app isn't in a repository, those evil library files would have to be included in the dependency manifests for all to see. These things survive in Windows because users are forced to install everything from the untrusted web.
Re: (Score:2)
Deeper - they survive in Windows because users don't give a damn 99.9% of the time, and the only
Re: (Score:2)
Re:Actually, Windows is partly to blame here (Score:4, Informative)
There's a world of difference between software having a digital signature and the software installer actually checking the digital signature. Does Windows even have a mechanism to check the signature?
Yes. Many (most?) installers for Windows check the signature when you open the installer. This has been the case for ages, with even Windows XP checking signatures (though not for nearly as many things as Windows Vista/7/8 do).
If a program wants admin rights (and many installers do), Windows will check the signature and display a different prompt for signed and unsigned code (see here [wikipedia.org] for an example).
Re: (Score:2)
I had a quick look in your link to the UAC and couldn't see much relevance as it all seemed to be about elevating privileges rather than authenticating 3rd party software. I've never seen Windows do any checking except for drivers.
Re:Actually, Windows is partly to blame here (Score:4, Informative)
So, it's the software that you download that verifies itself? Or, does Windows have a list of checked software along with their signatures?
The author(s) of individual software programs acquire a code-signing certificate from a certificate authority that Microsoft trusts for that purpose. The author(s) then sign their software using that certificate. Windows verifies the signature and ensures it's from a cert issued by a trusted CA.
I had a quick look in your link to the UAC and couldn't see much relevance as it all seemed to be about elevating privileges rather than authenticating 3rd party software. I've never seen Windows do any checking except for drivers.
Most software requires admin rights to install, so it's sensible that the results of the signature checks show up in the escalation prompt. (If the software is unsigned, it gets a scary yellow warning. If it's signed, it shows up in an ordinary looking prompt that lists the program name and the publisher details, as found in the certificate.)
Additionally, if you try opening unsigned executables Windows will prompt you with a moderately-scary warning. Here's a screenshot [imgur.com] of such a warning that I took a few minutes ago.
In short: yes, Windows does check signatures on software but it (for better or worse) gives users the option of easily running or installing software even if the program is unsigned.
Re: (Score:2)
Addendum: compare the screenshot of the unsigned program mentioned above with that of a signed program [imgur.com]. That check takes place in Windows Explorer when one opens an executable, before the UAC prompt for admin rights to install it.
That functionality has been in Windows since Windows XP.
Re: (Score:2)
Re: (Score:3)
I didn't look for a shield, I looked at "Publisher". On signed software, it says the name (E.g., "Microsoft Corporation" or "Adobe" or such). On unsigned software, it just shows up as "Unknown publisher".
Unfortunately, the official FileZilla isn't signed.
Interestingly, OS X Gatekeeper warns you when thi
Re: (Score:2)
Yes.
It's not particularly different than relying on a repository signature. There's nothing stopping you from adding untrustworthy repositories in Linux, and if a repository is compromised signatures can be modified as well. There's a reason people are cautious about PPAs. Package managers are not immune to security issues, either [arizona.edu].
The mechanism is just a digital certif
Re: (Score:2)
And how does your browser know that http://www.yourbank.com/ [yourbank.com] which has a verisign issued certificate is your bank, and http://www.scambank.cn/ [scambank.cn] which also has a verisign issued certificate is not your real bank?
And therefore, how is the end user supposed to know that the binary signed by "Martin Pikryl" and verified by verisign is a genuine copy of WinSCP, and that the binary signed by "John Smith" and also verified by verisign isn't?
Re: (Score:2)
But given that anyone can get a code signing certificate, and that such a certificate only certifies that a particular organisation or individual created a given binary, how is a non technically literate user supposed to know that "joe smith" isn't a legitimate author to be signing a build of filezilla?
A malicious distributor of malware could easily get his code signed, and also create a legitimate looking website from which to distribute it. How are end users supposed to differentiate between all the diffe
I used to wonder about that (Score:2)
Why is there no yum repository for Windows or OSX. It seems like there is plenty of motivation for them to exist.
Re: (Score:2)
Actually, I was talking about freeware/shareware (Score:2)
There are tonnes of packages that are available for free for windows. Winscp, putty, etc, But currently there is no one way to just say "gimme that". Other than google/browse/download without verify. There is a system under cygwin to download software and maybe that is what most people use. But I dont think it covers everything.
Re: (Score:2)
And if you're using such crude methods to differentiate between legitimate and malicious binaries, the malware authors will just pad their binaries with zeroes until they're the same size as the legitimate ones.
They will also compile their binaries with the same compilers, so that it uses the same external libraries, and they will compile with more aggressive file size optimization so that their small amount of extra code doesn't result in the binary being any larger (and thus they can pad with zeroes to ma
Comment removed (Score:4, Insightful)
Two sane ways to install free software. (Score:5, Insightful)
1. package manager of your distro (ie. trust someone trustworthy to curate)
2. git clone; make (ie. get it from the developers directly)
Anything else is basically eating candy you found on the street.
Re: (Score:2)
Wow, that's the best description I've heard in a long time. It's 100% bang on. People like candy...
However, downloading the source means that you're trusting the compiler or the virtual machine that's running the code. OK, signed gcc straight from debian, that I trust (but there's no need to follow up with a Thompson Trusting Trust reference, I'm fully aware of the principle). But, to be honest, I don't trust the guys who are trying to push
Re: (Score:2)
The same applies for non free software... You need to ensure you've got it from a trusted source.
In fact, non free software is potentially even more dangerous in this regard as you're more likely to be entering credit card details into the site you're purchasing the software from.
Re: (Score:2)
If you trust solution (1), then you can just as easily trust solution (2) if you clone from a gpg-signed git tag.
Update your HOSTS file...yes really. (Score:5, Informative)
From TFA
Stolen data is sent to the IP 144.76.120.243 that belongs [to a] server hosted in Germany.
"We found 3 domains that link to same IP:
go-upload.ru created 2012.09.23
aliserv2013.ru created 2013.09.09
ngusto-uro.ru created 2013.09.19
Unfortunately, domains are registered through the infamous Russian domain registrar Naunet.ru, which is associated with malware and spam activities. This registrar hides client contact info and ignores requests to suspend illegal domains.
No, don't bother... yes really (Score:2)
a) it's attempting to enumerate badness. There's always new badness, you can't enumerate it all. New badness can be created quicker than you can update your hosts file.
b) bad software can happily use a randomly or dynamically generated name which you cannot add to your hosts file, as it can't be known in advance, and may only be used once.
Isn't this what Malware/AV tools are for? (Score:3)
This is why we use AV/Malware tools isn't it? Malware is distributed in a lot of different ways and if you download a corrupted installer or image from a questionable site then you should expect something extra with what you're getting. This is what the AV vendors should be watching out for but also take a few minutes of common sense when downloading, otherwise expect to have your info stolen or your system compromised. While I'm glad the Avast researcher here published the warning, I liken this to stories about the NSA, "One more corrupted installer that installs Malware, read all about it!" Now if he'd found out that the information was being leaked back to Germany for spying then it would have been more interesting.
File under 1001 Bleeding Obvious Things (Score:3)
Install only from the source. If you install from a third-party source or don't check the md5sum what did you expect?
Tag story as stupid
Hey, I just found a bottle of whisky by the side of the road.... Party! (what could go wrong?)
Re: (Score:2)
Hey, I just found a bottle of whisky by the side of the road.... Party! (what could go wrong?)
Hey, I know a guy who regularly does this.
But, nowadays, after the pee incident, he carefully sniffs the bottle before he drinks...
obvious solution (Score:2)
I assume the malicious version appeared from an unreliable site. So, the obvious solution is to simply download Filezilla from source forge and not some random file host site.
Re: (Score:2)
How is a non technical end user supposed to know that sourceforge is the official site of filezilla, and that other sites are not?
That's not the only place you'll find these dll's (Score:2)
I found both of them in TOR browser software and the pro edition of Easeus Partition Master 9.1.1 (legally obtained, not pirated).
So is there something inherently wrong with dll's bearing that name, or are they OK except when they crop up in Filezilla?
Re: (Score:3)
They are DLL's used by many programs which are compiled with a certain compiler. It's like saying a program comes bundled with msvcrtXX.dll.
The fact that you're even bothering about the names is much more important. What the hell makes you think that the filename is an indicator of its contents? That DLL could be named the same as a harmless file but contain the virus routines. The name is neither here nor there.
The interesting question is "what's the hash?" - is it an official copy of those files, whic
Re: (Score:2)
Thanks for the information. I've found that a heads-up on certain file names can be quite helpful, however. If a particular file name has been targeted by nasty people, I'll just submit the one on machine for analysis by one of the many on-line anti-malware sites that attend to such things.
As it works out, I've learned that according to several sources the specific DLL's on my system are OK. They're where they belong, they're exactly the right size and contain exactly what they should contain...nothing
Please (Score:5, Insightful)
Stop all this filesize / filename nonsense.
Either publish signed hashes of the good version or don't bother at all. If it takes more than a minute to change the filesize / filenames to something arbitrary of your choice as a malware author, I'll be amazed, especially when you could easily make it be the same size as the official one in this case by just padding with zeroes.
Please stop using these things are identifiers for malware. Same for "check for this registry entry". Any idiot with a copy of the virus can modify the strings in it to use a different reg entry / server / filename / filesize but what they CAN'T do easily is make a file with the same hash as something official.
And given that I couldn't even see a GPG key or hash value on the download page of FileZilla at all, pretty much this kind of thing is to be expected.
Re: (Score:2)
Errr....
It has native binaries for OS X and most Linux flavors. It's also in the repositories for several Debian derivatives.
In fact, I went to Filezilla because it was the only reliable FTP/SFTP app on OS X that I didn't have to pay an arm and a leg for. I still use it to transfer files on Linux and Mac systems.
Sourceforge download ads (Score:2)
This one example why Open Source sites need to take the threat of Advertsm mimicking download buttons on their sites.
Instead they are still glossing over the risks.
http://sourceforge.net/blog/ha... [sourceforge.net]
Re: (Score:2, Informative)
The number of times I have accidently clicked on an ad Download button instead of the actual download button on sites I am not familiar with is astounding. I always have caught on quickly, stopped the incorrect download and then gone looking for the correct one, but as a Comp Sci PhD candidate and computer security practitioner, the fact that it can fool me even for a minute is astounding. Sites really should remove ads that confuse where you should be clicking to download what you came there for.
Re:"Download Now" ads... (Score:2)
Unfortunately, it's not that easy to remove "all" of those annoying, misleading, "download now" ads. My website shows ads through Google AdSense (i.e. the biggest ad network out there) and despite my going through every week or two to ban entire misleading advertiser accounts, there are always new "Download" ads waiting in the queue from new accounts. I've literally blocked hundreds of accounts by now - 5 or 10 every week for a year or two.
I feel bad for my random users that get caught by the adware (or wor
Re:Also Ran (Score:5, Informative)
Mostly because these dll's are present in projects compiled with MingW.
Re:Defamation (Score:5, Insightful)
You really think the NSA is sending their data to Russian servers? That's where the article says it's going.
Re: Defamation (Score:3)
Why would the nsa need to steal FTP logins this way? Aren't FTP logins already done in plain text, meaning they could scarf them up as the traffics going through routers they control?
Re:Defamation (Score:5, Funny)
So... am I the only one that thinks the NSA version sounds like the better option? Smaller, newer runtime, other bufixes. Sounds like an upgrade.
Re: (Score:2)
There's no evidence this is an NSA program.
Re:Defamation (Score:4, Insightful)
There's no evidence this is an NSA program.
To be honest I really hope there wouldn't be!
Re: (Score:3)
Dependency upon additional external DLLs? If this was an NSA thing, they'd design it better than that.
Unless they deliberately introduced an obvious substandard design element precisely to make people think someone else did it, of course.
Re:This dll names look like legal ones (Score:4, Informative)
This dll names look like legal ones atleast in Linux world. I several time install libstdc++ as an dependencies of other packages.
Duh, logic fail. The article does not claim that these particular DLLs provide the malicious code, but are simply some easily observable differences between the friendly and malicious version.
Re: (Score:2)
The problem is that this news will now cause legitimate software that just happens to use these libs to be labelled as suspect, and the authors of malware will simply use a different compiler setup that doesn't require these two libs (eg the official bin is much larger most likely because it includes the functionality that the malicious version draws from these libs)
Re: (Score:2)
Plus he was making the apparently fallacious assumption that the article writers had any idea what they were talking about.
Re: people still use FTP? (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
It's supported by Filezilla, anyway. I use that if I quickly need to transfer files to/from a linux box on a LAN, with only openssh-server needed on the other machine. It's also really easy to use for beginner/non-technical users, and is an apt-get install away on linux too.
Re: (Score:3)
Re: (Score:2)
What do you mean? it comes with the Microsoft RDP client, sometimes a RDP server named "Remote Assistance" and of course Internet Exploiter :D
Can even share a directory over the network by right-clicking on it. Well, if it was not buried by more wizards and login errors, I dunno.
Re: (Score:3)
Re: (Score:2)
I may be particularly lucky but I seem to hit ~10MB/s on a 100Mb LAN constantly, even when both ends are half-decent Pentium 3 level hardware. Seen an ssh transfer slow when using WinSCP, or worse with a ssh server run on *Windows* (I think that one just uses Cygwin)
Even more fun there's Dokan sshfs you can run on Windows : slow but enough to play music and movie files from the linux remote host.
Slowest I've seen was downloading files with scp under MS-DOS, it was like 80KB/s but there was something wrong w
Re: people still use FTP? (Score:2)
Re: (Score:3)
People still use telnet extensively too...
The primary reason for the use of both ftp and telnet instead of ssh, is because windows still comes with ftp and telnet clients but no ssh, so you can be guaranteed that virtually any machine you ever use will have a client.
Re: (Score:3)
Microsoft seems to have the decency of not including telnet by default these days. I remember being pissed by that once. Thanksfully about the only legitimate reason to use telnet was to login to your modem or router and this has been superceded by web interfaces. Or so I hope ;), maybe some people rely on it in the enterprise - in a segregated control network to access whatever stuff, or in industry to access embedded/industrial stuff, not on the internet either. It's so crude I think of it as kind of a se
Re: (Score:2)
I know telnet sucks and everyone wants to disable ICMP everywhere too but it's so easy... does it resolve, ping, trace, telnet, yes/no here is the most likely cause.
Re: (Score:2)
Telnet? (Score:2)
I use telnet to debug different servers. For example, I may telnet on port 80 to verify that httpd is running and is properly configured, or to get the real error message hidden by the "helpful" message by my email client.
Re:Blame Source Forge... (Score:5, Informative)
it wouldn't surprise me that if it were SourceForge's own "custom downloader" that's the one pushing the altered versions with login stealing functionality... it's been pushing adware and other crap too and FileZilla especially has been hit by this. Here's a short selection of complaints from the FileZilla forums:
https://forum.filezilla-project.org/viewtopic.php?f=2&t=30240
(this one has screenshots documenting the EXE installer hijacking done by SourceForge)
or this one: https://forum.filezilla-project.org/viewtopic.php?f=1&t=31127
and more... https://forum.filezilla-project.org/search.php?keywords=sourceforge+adware
Re:Blame Source Forge... (Score:4, Informative)
Hi Folks,
SourceForge is aware of the malformed FileZilla FTP and are no way associated with or responsible for this malicious program posing as FileZilla.
The FileZilla installer on SourceForge is a stub that encapsulates the actual FileZilla installer to ensure the original FileZilla software is delivered. All offers that are presented when downloading FileZilla are optional and go through a rigorous verification and strict compliance process to make sure they are not malicious and virus free. No personally identifiable information is ever collected.
Best regards,
The SourceForge Community Team
Re: (Score:3, Interesting)
Re: (Score:3)
Well, yes, because you have to store and send the original password.
You can't send the hash to a remote FTP server as a login, they won't accept it. And the definition of a hash is basically to make it difficult to "work backwards" to a username from it.
So, somewhere, you either have to store in plaintext or in a file which the program encrypts and has full capabilities and permissions to read. About the only way to do this efficiently and safely is to have a "locked" wallet kind of affair that the user h
Re: (Score:2)
What else are you going to store? Of course you could use sftp and rely on ssh-agent to manage the key, but then you'd be using Linux instead of Windows with FileZilla.
Re: (Score:3)
It's a FTP client! If you use passwords there, you're doing it wrong.
It's an ancient protocol that sends logins and passwords over the network in plain text, and you're concerned with storing them on your disk unencrypted?
Re:Passwords are stored in plain text anyway (Score:4, Informative)
Re:What about GNU/Linux ? (Score:5, Interesting)
what I find funny is that the poisoned extra payload version is several megabytes smaller than the clean one!
Re: (Score:2, Informative)
filezilla.exe is smaller, but it also includes libgcc and libstdc++ - they're several megabytes and probably statically linked in the official version.
Re: (Score:2)
filezilla.exe is smaller, but it also includes libgcc and libstdc++ - they're several megabytes and probably statically linked in the official version.
yeah that would probably explain it.
(the only reason why I'd have doubts still is.. well, it's filezilla. it's a fucking godzilla. it works just enough to work, the ui is just good enough to work and .. well, that's why it killed off cuteftp maybe, but it's not great by any means)
Re: (Score:3)
Sounds like they cut out the auto-update code. That would drop a few megabytes.
Re: (Score:2)
Problematic for anything that doesn't host its own installer files, yes. Now a lot of OSS projects are on SourceForge, which tries to entrap you into downloading one of their other installers.