Hackers breach JDownloader's website to serve malware-laced downloads

https://www.neowin.net/news/if-you-downloaded-this-popular-software-recently-you-might-have-installed-malware/

by bundie • 3 months ago

119 31 3 months ago

neowin.net

bundie• 3 months ago

u/rubi2333 uploaded the malicious files to virustotal.com

JDownloader2Setup_windows-amd64_v1_8_0_482.exe: https://www.virustotal.com/gui/file/5a6636ce490789d7f26aaa86...

JDownloader2Setup_windows-amd64_v11_0_30.exe: https://www.virustotal.com/gui/file/fb1e3fe4d18927ff82cffb3f...

JDownloader2Setup_windows-amd64_v17_0_18.exe: https://www.virustotal.com/gui/file/04cb9f0bca6e0e4ed30bc927...

JDownloader2Setup_windows-amd64_v21_0_10.exe: https://www.virustotal.com/gui/file/32891c0080442bf0a0c5658a...

JDownloader2Setup_windows-x86_v1_8_0_472.exe: https://www.virustotal.com/gui/file/4ff7eec9e69b6008b77de1b6...

JDownloader2Setup_windows-x86_v11_0_29.exe: https://www.virustotal.com/gui/file/de8b2bdfc61d63585329b8cf...

JDownloader2Setup_windows-x86_v17_0_17.exe: https://www.virustotal.com/gui/file/e4a20f746b7dd19b8d9601b8...

JDownloader2Setup_unix_nojre.sh: https://www.virustotal.com/gui/file/6d975c05ef7a164707fa3592...

salomonk_mur• 3 months ago

What? How would you know it was them?

Retr0id• 3 months ago

Comparing the hashes would be one way

Our_Benefactors• 3 months ago

I’ve never run into a program that manages to disregard as many UX best practices as Jdownloader. It has more maddening features than I can count. Even stuff like sorting a column by date doesn’t work how you would want it to, because it applies some “package grouping”. It’s the epitome of nonsensical defaults, features that maybe 1% of the user base would want and care about but toggled on by default.

Existing4190• 3 months ago

As there has been a question about updates. Those are not compromised, different infra, protected by end-2-end digital signature.

Phew!

From: https://old.reddit.com/r/jdownloader/comments/1t6goqe/is_the...

kristofferR• 3 months ago

What's new? Hasn't JDownloader already served malware with the default installer for years, you had to use specific adware-free installers to avoid it?

https://board.jdownloader.org/showthread.php?t=54725

Cider9986• 3 months ago

Here is a guide to debloat JDownloader

(https://claraiscute.neocities.org/Guides/jdownloader2/)

dark theme (https://github.com/moktavizen/material-darker-jdownloader)

dopa42365• 3 months ago

Years ago I made my own "dark-ish mode" for it and holy hell, so annoying having to change 50 different more or less accurately labeled and named color settings that only take affect after restarting the program.

RandomGerm4n3• 3 months ago

I wish there was finally a decent alternative to this junk. JDownloader pretends to be GPL, but parts of it are closed source. Plus, the Windows installer on the official site is a gamble, and you can only find a clean installer in the forum. The developers claim it’s "just adware", but since it’s a web-based installer, different things are offered depending on your IP address. Some of these install themselves even if you decline them, and some also contain real malware. It was actually to be expected that they wouldn't secure their website properly and that someone else would end up spreading malware as a result. The only reason to still use this software is that it works with every obscure filehoster out there. Alternatives like pyload are much less effective at bypassing all the security measures these sites put in place to block download managers. It also lets you download videos from streaming sites that other tools like yt-dlp refuse to support.

papichulo2023• 3 months ago

Agree, I removed it from my selfhosted apps because for some reason it always has high cpu usage even when no downloading anything.

skrebbel• 3 months ago

Protip, modern browsers (IE6 and later) have a built-in parallel download feature!

Lammy2• 3 months ago

That's not why people use JDownloader. There are plugins for every popular file-sharing site that automate navigating download pages, handling countdown timers, and pausing for ratelimits.

Lammy2• 3 months ago

you can only find a clean installer in the forum

`winget install AppWork.JDownloader`

Built in to Windows since Windows 10 v1809 :)

_aavaa_• 3 months ago

Were’s the AI rewrite when you need it.

Havoc2• 3 months ago

I know people are using aria2 for similar purposes but haven't checked out how well it works

sunaookami• 2 months ago

What part of it is closed-source? You can clone it from the SVN, even the MyJdownloaderClient and all plugins are open-source. Only thing that sucks are their docs because its a Google Doc and there isn't really any explanation but I've got a plugin to work via AI.

RandomGerm4n3• 2 months ago

Not all plugins are open source. Some of them are included in the jdclosed dependency which is just a blob. The developers claim this is to prevent sites from patching them. However this approach is not compatible with the GPL and the developers have simply been ignoring this for years.

raphinou• 3 months ago

When will we finally sign artifacts?

I'm not only complaining, I also work on a solution (asfaload) that I want easy to use. As it is multisig, such platform breaches become impossible. Below is the doc of the CLI, i'm looking for testers and challengers of the solution!

https://asfaload.com/doc/

nticompass3• 3 months ago

I remember using download managers back in the day, and by "back in the day" I mean dial-up (and maybe early DSL). I liked being able to pause downloads and possibly split them up using multiple connections.

Nowadays, are download managers even needed anymore? At least for me, the internet is fast enough that I don't need a separate download manager, plus browsers support the pausing (and maybe multiple connections?) feature already.

I'm just curious why someone would need to use JDownloader.

EDIT: I hadn't thought about "warez" sites in a while and sites like megaupload where you had to wait for a timer. Those are totally "valid" uses for a downloader like this, thanks.

garyfirestorm• 3 months ago

The ‘scene’ or warez sites are still up and running. Sharing cracked softwares, movies shows etc. through file hosting services. If say you wanted a Blu-ray movie with Dolby atmos sizing near 10 gig. Then you’d queue the file sharing site download links in jdownloader and let it automatically manage these downloads for you.

parhamn• 3 months ago

This sent me down memory lane, what happened to warez-bb!

nticompass3• 3 months ago

I guess it's been a while since I used those type of sites. I admit that I used to, and I do remember those sites like megaupload or whatever that had a timer.

Havoc2• 3 months ago

Very much doubt scene is using downloaders these days. ftp for the groups and torrent/usenet for the plebs

RandomGerm4n3• 3 months ago

There are still warez sites that upload content in RAR archives, which are then split into individual parts. A download manager can then download them all one after another instead of having to do it manually. There are also hosting sites with weird CAPTCHAs or various waiting times.

nticompass3• 3 months ago

Fair enough. I do remember using those sites back in the day, and the `.rar.000`, `.rar.001` file lists (or was it `.part1.rar`, `.part2.rar`?). I guess I haven't visited or thought about those sites in a while.

wongarsu• 3 months ago

Dealing with all kinds of weird download sites is the main selling point for me. It's not just warez, you run into them in all kinds of weird places where a nontechnical person needs to share files with a larger audience (google drive etc only works for small audiences), or where somebody decides to monetize by making a couple cents off your download.

With JDownloader you just throw the link in there, and the software deals with mandatory wait times, captchas, throttled downloads, "you exceeded your downloads for today, come back in 24 hours", etc. JDownloader makes sure it eventually succeeds without me having to baby-sit the process

aqua_coder• 3 months ago

Not everyone have fast enough networks, there are places where people find it lucky to download something that is more than 2 GiBs without finding it to fail suddenly.

kogasa240p• 3 months ago

Used it once to pirate Infinity Train because someone put the episodes on MEGA.

dawnerd• 3 months ago

There's quite a lot of legit uses still. And also, it's not about speed, if I'm on a hotel wifi I don't want firefox giving up if I have multiple files queued up from my file server. Sure, browsers support pause/resume but they also fail pretty hard on spotty connections. With jdownloader you just set it and it'll do it's thing.

Also nice if you're manually downloading game mods, some are hosted on file lockers that make you wait so many minutes. Again, jdownloader was built for that.

I also say that as someone that really can't stand jdownloader, but the alternatives are... not great. Surge, the tui, is nice if you're just doing regular ol' http downloads.

hereme888• 3 months ago

Wasn't Jdownloader known in the past for bundling adware?

kanemcgrath• 3 months ago

I am always worried that popular software like this is getting compromised. But what about all the smaller stuff? I download and run a bunch of small programs, especially for game modding. Do the small tools not have the same risk because of their smaller scale invites less dedicated attacks? or do they get compromised and fly completely under the radar?

Hackers breach JDownloader's website to serve malware-laced downloads

Related Stories