Re: [Gimp-user] gimpx? possible malicious software using Gimp name

[Steve Kinney <admin pilobilus net>]

On 05/26/2013 08:48 AM, Michael Schumacher wrote:
> On 25.05.2013 19:22, Michael Strout wrote:
> > Hi all,
> >       I just received a text message on google voice with
> > something which
> > was made to look like a failed image embed that led to this page
> > http://imgsend.com/?photo=792MBQ which talked about requiring a
> > gimp photo
> > viewer for a .JPG.GMP file.  Links lead to a gimpx.org domain
> > which thing
> > looks like a malicious site crafted to fool windows users into
> > installing
> > malware to me.
>
> Yes, it is. See
> https://mail.gnome.org/archives/gimp-developer-list/2012-August/msg00074.html
> for an analysis, with slightly different urls.

The owner of the domain name "gimpx.org" is hiding behind a
pseudo-anonymous registrar.  That in itself is enough to rule out
installing anything offered on the site.

The hosting service where the gimpx.org website lives,
secureserver.net, presents a "404 page not found" notice at
http://secureserver.net/index.html, another strong indicator of
"other than honest" intentions.

> > If I'm incorrect and this is somehow a valid tool please let me
> > know to set my mind at ease.
>
> This isn't a valid tool. Most likely a trojan.

Looks that way to me.  Maybe somebody who has the time and interest
will install it in a virtual machine and audit the results to
determine what the gimpx.org installer actually is/does.  But
directing users to the "real goods" provides a complete solution, so
why bother?

> > If not, does anyone know if there's something that can be done
> > about it?
>
> Educating users would be the best approach. Any suggestions how to
> phrase a warning for www.gimp.org/downloads?

The Windows installation instructions in my GIMP tutorial for
beginners at http://pilobilus.net/gimp_tutorial.html conclude with:

Warning! Do not download the GIMP from unofficial websites offering
"Free Downloads." Sabotaged GIMP installers rigged with trojans have
been discovered in the wild.

The phrase "rigged with trojans" has a hyperlink to:

http://blog.meetthegimp.org/yay-mainstream-and-trojaned-gimp-installers/

It might be useful to put a warning like this on the front page of
the GIMP site, followed by a link to the relevant Sourceforge page
for the "real" Windows port.  The educational impact would be
substantial.

Also, the GIMP site's front page has a Google rank of 7 (out of 10
on a log scale), so a hyperlink here would add a lot of weight in
search result placement of the Sourceforge page for the GIMP
installer.  This would help prevent search engines from being
manipulated via SEO to send people to sites with trojanized GIMP
installers.

At present, the link to the Windows port on the Downloads page at
gimp.org is hidden behind a "show other downloads" link buried in
the middle of the page.  This is hard to justify, as the majority of
current and potential users are on Microsoft platforms.  The GIMP is
a *powerful* gateway drug for Free Software, so (literally) hiding
it from people who are using Microsoft junk does Linux advocacy no
favors.

I would be inclined to move the link for Windoze installers to the
top of the Downloads page on the GIMP website.  The higher on the
page this link appears, the more likely that a search engine will
direct would-be first time users there, rather than to a hosting
service for malware.

:o)

Steve