You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Windows version. Symantec has detected potential fraud software #284
I have used SEP to scan the installers and extracted versions as well as Norton Internet Security (NIS) and no issues are found. However on a SEP box when I run the installer I get this:
Once you go past that everything is fine. All the above shows is that SEP has not seen this very much and is being cautious.
Where do you see this "flagged as fraud software"? A screenshot might help us.
This tells me it is a "reputation" issue, it is unproven but some evidence it is trust worthy, less than 5 SEP users have seen it and it is new. All of which I would expect for a new release of software like this. I am not seeing the link to fraud software to be honest.
To me SEP is just saying I have not see this very much before. If you are concerned it is compromised then I suggest you download the code, study it and compile it yourself. Clearly if you find a problem in the code please open an issue
Eg someone makes there own executable and then find a way to uploads it to the official website
Can you please check the SHASUM of the executables you're seeing this on, with the one in the release notes? Just to be 100% certain it isn't a compromised one.
If it's not a compromised one... then I guess we can ping the Symantec people to figure out if they can fix their end.
I thought about the SHASUMS but if a hacked can replace the exe then replacing the SHASUMS is no big deal right?
For me Synamtec is doing the right thing, it is warning you of a low reputation file, but I guess we could ask how to avoid this, which is probably a good question.
Depends where the .exe has been downloaded from. If it's been downloaded from here on GitHub then sure, that's a really big deal. But it's not clear that's definitely the case, thus the wanting to check things. 😄
I think generally Adam we all share your concerns, however this problem is not unique to this project, I have seen SEP (and NIS the consumer product) do this with other software, particularly with new releases.
@justinclift I suggest we close this issue and query Symantec about reputation warnings to see what, if anything, we can do? I am happy to pick this up with them if you want me to.
@justinclift website looks better now, thanks! I know we mentioned e-mail via sqlitebrowser.org before but I can use my work e-mail, which is probably better, if you are okay with that?
Wondering if a "class 3 digital certificate" is something we need to pay them for. (hoping not) Would you be ok to look into what our options are, and figure out a good way forward?
No worries, I'm kind of expecting that by now they would have enough positive reports for the immediate problem to be over. Figuring out the future solution though would be kinda useful. 😄
@justinclift I am sorry but have to confess I never got round to submitting these files to Symantec. I am not aware of any issues with the 3.7.0 release, so that's good. However as far as code signing goes I have found https://www.certum.eu/certum/cert,offer_en_open_source_cs.xml or rather a colleague pointed me to it. Could you take a look and let me know what you think please.
Hmmm, looks kind of dodgy really. Some bits which jump out at me:
Secured by the SHA1 function ← SHA1 is widely regarded as broken, and shouldn't be used in things any more. (kind of ironic, as git still uses it for core functionality. No idea if that's being looked at... 😉)
Requires sending a copy of ID documentation to a third party in Poland I've not personally heard of before (unizeto.pl). ← Maybe it's just my lack of knowledge in this space, but this is concerning to me.
I don't believe the SHA1 issue is such a concern for signing, however I agree it is broken for encryption. You have read more than me but I don't think any of us would want to send ID to an unknown 3rd party. I might try and look into that and see. How about we close this issue?
Activity
glawrence commentedon May 1, 2015
I have used SEP to scan the installers and extracted versions as well as Norton Internet Security (NIS) and no issues are found. However on a SEP box when I run the installer I get this:
Once you go past that everything is fine. All the above shows is that SEP has not seen this very much and is being cautious.
Where do you see this "flagged as fraud software"? A screenshot might help us.
adam-nelson commentedon May 1, 2015
Click More info
Be interesting to see if someone has compromised the code or the exe file
I also know that SQL light was featured on Hak5. Popular online tech show
glawrence commentedon May 1, 2015
I clicked "More Details" and can see this:
This tells me it is a "reputation" issue, it is unproven but some evidence it is trust worthy, less than 5 SEP users have seen it and it is new. All of which I would expect for a new release of software like this. I am not seeing the link to fraud software to be honest.
adam-nelson commentedon May 1, 2015
Fraud software could be a exploited or compromised code even.
Eg someone makes there own executable and then find a way to uploads it to
the official website
glawrence commentedon May 1, 2015
To me SEP is just saying I have not see this very much before. If you are concerned it is compromised then I suggest you download the code, study it and compile it yourself. Clearly if you find a problem in the code please open an issue
justinclift commentedon May 1, 2015
Can you please check the SHASUM of the executables you're seeing this on, with the one in the release notes? Just to be 100% certain it isn't a compromised one.
If it's not a compromised one... then I guess we can ping the Symantec people to figure out if they can fix their end.
glawrence commentedon May 1, 2015
I thought about the SHASUMS but if a hacked can replace the exe then replacing the SHASUMS is no big deal right?
For me Synamtec is doing the right thing, it is warning you of a low reputation file, but I guess we could ask how to avoid this, which is probably a good question.
justinclift commentedon May 1, 2015
Depends where the .exe has been downloaded from. If it's been downloaded from here on GitHub then sure, that's a really big deal. But it's not clear that's definitely the case, thus the wanting to check things. 😄
adam-nelson commentedon May 1, 2015
Geoff is getting the same error message as me. So the reputation and sha
hadh should be the same. and someone would need to label it as fraudware
its concerning. You can open a file these days and find your entire data
wiped, stolen or executable remotely phones home :)
adam
glawrence commentedon May 2, 2015
I think generally Adam we all share your concerns, however this problem is not unique to this project, I have seen SEP (and NIS the consumer product) do this with other software, particularly with new releases.
@justinclift I suggest we close this issue and query Symantec about reputation warnings to see what, if anything, we can do? I am happy to pick this up with them if you want me to.
justinclift commentedon May 2, 2015
@glawrence Yep, please do. I think my wording towards Symantec would be very unkind. Probably not productive. 😉
glawrence commentedon May 2, 2015
No problem, happy to pick this up. Do you want me to provide any feedback in this issue, or close this and I'll raise a new one with any actions?
justinclift commentedon May 2, 2015
Might as well do it here. 😄
glawrence commentedon May 6, 2015
@justinclift my conclusion is we would need to submit our new binaries to https://submit.symantec.com/whitelist/isv/ which seems worth a try to me. Would you like me to do this for the v3 files?
PS http://sqlitebrowser.org/ is pointing to the v2 Windows exe files, which needs updating
justinclift commentedon May 6, 2015
@glawrence Yep, please do that.
Oh yeah, good point about the v2 files. I'll fix that right now.
1 remaining item
justinclift commentedon May 6, 2015
@glawrence For that ISV upload page, it has an item about:
If that causes any hassle, we might be able to get @sqlitebrowser.org addresses happening. Would that be useful?
glawrence commentedon May 6, 2015
@justinclift website looks better now, thanks! I know we mentioned e-mail via sqlitebrowser.org before but I can use my work e-mail, which is probably better, if you are okay with that?
justinclift commentedon May 6, 2015
Yep, for sure. 😄
glawrence commentedon May 6, 2015
Leave it with me then and I'll see what happens, might be a "fire and forget"....
justinclift commentedon May 6, 2015
Cool. 😄
glawrence commentedon May 6, 2015
Just been reading and...
My guess is we would need to do so with the installer and executable. Any thoughts?
justinclift commentedon May 6, 2015
Wondering if a "class 3 digital certificate" is something we need to pay them for. (hoping not) Would you be ok to look into what our options are, and figure out a good way forward?
justinclift commentedon May 18, 2015
@glawrence How's this going? 😄
glawrence commentedon May 18, 2015
Not forgotten but going slowly, sorry.
justinclift commentedon May 19, 2015
No worries, I'm kind of expecting that by now they would have enough positive reports for the immediate problem to be over. Figuring out the future solution though would be kinda useful. 😄
glawrence commentedon Jun 27, 2015
@justinclift I am sorry but have to confess I never got round to submitting these files to Symantec. I am not aware of any issues with the 3.7.0 release, so that's good. However as far as code signing goes I have found https://www.certum.eu/certum/cert,offer_en_open_source_cs.xml or rather a colleague pointed me to it. Could you take a look and let me know what you think please.
justinclift commentedon Jun 28, 2015
Hmmm, looks kind of dodgy really. Some bits which jump out at me:
glawrence commentedon Jun 28, 2015
I don't believe the SHA1 issue is such a concern for signing, however I agree it is broken for encryption. You have read more than me but I don't think any of us would want to send ID to an unknown 3rd party. I might try and look into that and see. How about we close this issue?
justinclift commentedon Jun 29, 2015
Sure. If it happens again for future releases, then we know it wasn't just a once off thing, and we'd better look into it in depth. 😄