[BUG] Chatbox-1.3.3-arm64.dmg triggers JS/Agent.OBF false positive??

[fleytman]

Bug Description ESET Endpoint security found

Chatbox-1.3.3-arm64.dmg » DMG » 4.hfs » HFS » app.asar » ASAR » dist\renderer\renderer.js - JS/Agent.OBF trojan

But the latest version Chatbox-1.3.1-arm64.dmg on github doesn't show any trojans.

P.S. I see that just before the 1.3.3 version the license was changed to MIT. It is very alarming that a version with a trojan appears right after that.

[MilanKovacic]

@Bin-Huang Can you comment on what exactly is going on? Why is there a release that is not on GitHub? Why was the license changed - such license change requires permission from all contributors whose code is still present? Why are releases fetched from "https://pub-0f2a372de68244aabdee60c9d82c4c6c.r2.dev"? Website mentions the following changes for version 1.3.3:

v1.3.3 You can now set user avatars in messages. Added support for configuring a custom API host for Gemini. Implemented an option in settings to enable or disable Markdown and LaTeX rendering. Fixed issues with LaTeX rendering. Fixed potential stuttering and crashing issues during message generation. Fixed issues with redundant pop-up prompts during auto-updating. Fixed various minor bugs.

None of these features/fixes seem to be in the current code at GitHub (https://github.com/Bin-Huang/chatbox/compare/v1.3.1...main), so where are they?

[fleytman]

It's also bad that the github version offers to update with the version from the site, which has a trojan...

[Bin-Huang]

I attach great importance to this issue and am currently investigating its source.

[Bin-Huang]

@Bin-Huang Can you comment on what exactly is going on? Why is there a release that is not on GitHub? Why was the license changed - such license change requires permission from all contributors whose code is still present? Why are releases fetched from "https://pub-0f2a372de68244aabdee60c9d82c4c6c.r2.dev"? Website mentions the following changes for version 1.3.3:

v1.3.3 You can now set user avatars in messages. Added support for configuring a custom API host for Gemini. Implemented an option in settings to enable or disable Markdown and LaTeX rendering. Fixed issues with LaTeX rendering. Fixed potential stuttering and crashing issues during message generation. Fixed issues with redundant pop-up prompts during auto-updating. Fixed various minor bugs.

None of these features/fixes seem to be in the current code at GitHub (v1.3.1...main), so where are they?

I am investigating the cause of this issue. Before proceeding, I would like to clarify that the installation packages from the website distribution and Github releases are both from the same Github Actions pipeline. The reason I offer website distribution is purely because in some countries and regions (such as China), downloading from Github releases is extremely slow.

[Bin-Huang]

No Security Issues Detected

I have NOT detected any security issues in all distributions of version v1.3.3 provided on the website using different security software.

From ESET:

From Avira:

Meanwhile, I have checked all potential areas that might have been overlooked. And I searched the Internet for JS/Agent.OBF and didn't find any fully relevant vulnerability disclosures. At present, I believe that the current distribution version of the website does not have any security issues.

@fleytman Could you send the file with the warning to tohuangbin@gmail.com? That way, I can further determine where this file came from.

Answer to the Appeal Question

Why is there a release that is not on GitHub?

I've been using Github Actions to build and distribute releases. After Github Actions finishes running, it automatically creates a draft in Github Releases, which requires manual editing and confirmation to be publicly displayed. Since I always release new versions late on Sunday nights (developing intensively on Saturdays and Sundays, starting intensive testing at noon on Sunday), each build takes about an hour, and I have missed many drafts that weren't made public...

In addition, after Github Actions finishes running, it also uploads new installers to my Cloudflare R2 storage, and the website automatically distributes the latest version. This greatly reduces my workload. I'm also using this site to improve the download speed of the installation package in various countries because there are serious network delays when accessing GitHub Releases in some countries. No one has mentioned there being any issue with this before.

Why was the license changed - such license change requires permission from all contributors whose code is still present?

Oops, it seems my changes were a bit casual, I apologize for my actions. The reason I modified the license is because I recently received an email from a developer who wants to fork this repository and develop new open-source project on top of it. This made me realize that the original license might hinder others' work (although this developer was willing to follow it), so I changed it to the more liberal MIT license to make it easier for other potential developers to work on their own projects. Most of the code was written by me, and initially, it was under the MIT license. I was unaware of the requirements for changing a license, and I apologize again for my actions.

Why are releases fetched from "https://pub-0f2a372de68244aabdee60c9d82c4c6c.r2.dev/"?

As I mentioned above, this is my Cloudflare R2 storage bucket, which facilitates the release of new versions and allows people from various countries to download at faster speeds.

Finally

I've always kept an eye on security issues with vigilance and precaution during the development and maintenance phase, and my professional expertise and competence (as a senior software engineer) enable me to develop secure and reliable software. Emotionally, I've devoted a year of intensive work to this project, spending all my spare time here, and I'm the last person who would want anything to go wrong with it.

I have scanned the installation packages offered by the website and used different security software, but haven't found any problems. I believe the software is secure enough.

[MilanKovacic]

Glad to hear everything's in order, and my questions were aimed at understanding the situation for everyone's peace of mind. Thank you for addressing the concerns. Appreciate your quick response!

[fleytman]

@Bin-Huang Good afternoon, thanks for the reply. I checked the macOS version yesterday via virustotal but found nothing. Today I decided to check the vindos version and nod32 trojan is found: https://www.virustotal.com/gui/file/54dfe2fb22549587683210038010baa59d8da9dfc222bd62a1d6db35748d5b2d At the same time, version 1.3.1 does not find https://www.virustotal.com/gui/file/7bc9d872729d2795fb509e913b955e6abd916f6a7f0d1ac34b40f7cfd9898034.

Maybe it's false detection, maybe not. Maybe you should contact eset for more details. For example on their forum https://forum.eset.com/. I get my antivirus scan files from https://chatboxai.app . I originally discovered the problem when the antivirus reacted to an already installed application. Alas, I am not allowed to re-install the application because of the trojan detection.... But here is a screenshot from the report that the antivirus initially detected:

screenshot

From what I've found on the topic https://github.com/electron/electron/issues/1205 https://www.f-secure.com/v-descs/trojan-downloader-js-agent-fdl.shtml

P.S. Thank you for the swift response regarding the security issue. I have great respect for the time and effort you've put into Chatbox. Although the trojan alert could be a false positive, it might be worth revisiting the build and distribution channels as a precaution, especially after the recent license update.

[fleytman]

@Bin-Huang, I understand your interest in transitioning the Chatbox project to an MIT license, which undoubtedly can facilitate the software's integration and use in commercial projects. However, I would like to address the importance of GPL3 for the current and future developer community of your project.

Switching to an MIT license may require consent from all contributors who have contributed under GPL3. This is not only a legal necessity but also a matter of respecting and valuing their contributions. Therefore, I recommend that you first reach out to each contributor to obtain permission for such a change.

Furthermore, have you considered dual licensing? This would allow for the spirit of open source, protected by GPL3, to be maintained while also offering a more flexible MIT approach for those interested in commercial use. Dual licensing would enable the community to continue developing forks of your project strictly within the GPL3 framework, which may be important for those who value the principles of open source and wish to see their contributions remain free and accessible to all.

This approach could serve as a compromise that satisfies both open-source advocates and those seeking easier paths to commercialization.

[Bin-Huang]

Thank you for your suggestions. I have reverted the changes made to the license, rolling it back to GPL. Moving forward, I will seriously consider a dual-license approach. Given that other contributors' code makes up a small part of the project, and much of it is outdated, the transition to a dual licensing model may go smoothly.

I want to return to the initial issue of security warnings that we discussed. I'll keep this GitHub issue open for a while to see if there is any follow-up or if anyone else encounters a similar situation. After that period (a few months), I might close this issue to streamline management.

In this age of rapid iteration of AI/LLM technologies, maintaining such an open-source project is indeed an urgent and hefty task. Thank you very much for your understanding.

[fleytman]

1.3.4 virus total without trojan https://www.virustotal.com/gui/file/70b1e78c8bb7cf00f17a7a2e6f3a984cb46e12bf81ee8dd19c573dec96d5ce81

How I can disable autoupdate in chatbox app? Can I choose in app check and download new version only from github?

[art-mis]

@Bin-Huang hi! I confirm a similar response from ESET Endpoint Security to Chatbox 1.3.3. That being said, I see that you posted version 1.3.4 on Github, but skipped 1.3.2 and 1.3.3. Is it possible for you to add them to Github? I would like to figure out why the antivirus reacts to the chatbox this way and complete my investigation.

[art-mis]

@Bin-Huang and could you please tell me how I could disable automatic updates of Chatbox to avoid similar problems in the future?

[WiSaGaN]

v1.3.3 You can now set user avatars in messages. Added support for configuring a custom API host for Gemini. Implemented an option in settings to enable or disable Markdown and LaTeX rendering. Fixed issues with LaTeX rendering. Fixed potential stuttering and crashing issues during message generation. Fixed issues with redundant pop-up prompts during auto-updating. Fixed various minor bugs.

None of these features/fixes seem to be in the current code at GitHub (v1.3.1...main), so where are they?

@Bin-Huang I am also one of the happy user that is currently on 1.3.3, thus concerned about the situation. Thanks for all the explanation, it really helps clearing things up. However, I haven't found any explanation on why the code for 1.3.3 is not on Github. And if it is possible to push the 1.3.3 code in the github so others can reproduce the binary to check where the problem is?

[Bin-Huang]

Here is the v1.3.3 version that I supplemented in GitHub Actions (I just made it public with a click), hoping it will be useful to those in need.

https://github.com/Bin-Huang/chatbox/releases/tag/v1.3.3

[WiSaGaN]

Sorry, I may have misunderstood something. But this tag points to https://github.com/Bin-Huang/chatbox/commit/32f196ae062d0554dd6daa922cfad8420fd39498 , which is the change to revert the license back to GPL from MIT on April 2?

[MilanKovacic]

Sorry, I may have misunderstood something. But this tag points to 32f196a , which is the change to revert the license back to GPL from MIT on April 2?

There is information regarding this in https://github.com/Bin-Huang/chatbox/issues/803#issuecomment-1797994508. Essentially, the product has become closed source from my understanding. This is very confusing for consumers, as most people would expect GitHub releases being published from the repository.

[Bin-Huang]

Here, I'd like to further elaborate on the security-related work I did in v1.3.4:

From gathering information from various angles, I've realized that mainstream security scanning software (e.g., Windows Defender) can sporadically flag false positives—a low probability, unpatterned event. By "unpatterned," I mean that while individual users might encounter a false alert with the same installer, most others do not experience any issues. This sort of false positive is even more common in open-source software. Here's a Google search of a false positive case in an open-source project on GitHub:

https://www.google.com/search?q=site%3Agithub.com+Wacatac.b!ml+trojan

False positives from security scanning software are not isolated incidents, with many open-source projects falling victim to this, including highly reputable ones like ollama and vscode-go. Numerous developers are voicing their frustration over this.

To minimize the occurrence of these false flags by security scans, I've learned a couple of lessons from various cases:

1. Add a certificate signature to the software (I've spent a decent amount of money to purchase a certificate from DigiCert).
2. Submit files for scanning to Microsoft Defender with each release.

These methods merely reduce the chances of false positives as much as possible. For instance, even after releasing v1.3.4, I still received a tweet from a user who encountered a security false positive with the new version.

To sum it up, I want to say that Windows is not friendly to open-source software and independent developers. Whether it's the financial cost of certificates, the disheartening two days spent trying to get the certificate to work properly on GitHub Actions, or the exhaustive search and troubleshooting for the cause of these false positives... As I read in a Reddit comment, the development environment on Windows is bad, and it's only getting worse...

[Bin-Huang]

Here I attach the message discussed on Twitter.

...and the link mentioned in the message: https://github.com/electron-userland/electron-builder/issues/6474

[fleytman]

Add a certificate signature to the software (I've spent a decent amount of money to purchase a certificate from DigiCert).

I recommend making a separate announcement that you had to spend money on the certificate, stating how much it cost and a link for donations

[Bin-Huang]

Just like we discussed before, it's more likely a false positive from all aspects now. To better manage the issues, I've closed it for now.

[CallMeR]

病毒库时间：2024-11-16 19:29 开始时间：2024-11-18 00:50 总计用时：00:00:08 扫描对象：119 扫描文件：1 发现风险：1 已处理风险：1 病毒详情： 风险路径：C:\Users\xxx\Downloads\Chatbox-1.6.1-Setup.exe >> $PLUGINSDIR\app-arm64.7z >> resources\app.asar, 病毒名：ADV:TrojanDownloader/JS.Generic!meteor, 病毒ID：6647d1deafbe837b, 处理结果：已处理，删除文件

最近用 火绒v6 检查近期的 3 个版本 1.6.x ，都会报告这个。

可能相关的问题，也许是上游导致的？： https://bbs.kafan.cn/thread-2267610-1-1.html

[Bin-Huang]

I've checked all the dependencies and found some that need updating. Don't worry - these outdated dependencies don't affect user data security, they just cause some app slowdown and unresponsiveness when inputting data (like this issue: https://github.com/advisories/GHSA-c2qf-rxjj-qqgw). I've already updated all the necessary dependencies, and these changes will be included in the next release.

我检查了一下所有的依赖项，确实有一些值得升级。不过这些过时的依赖并不会影响用户的数据安全，只是会导致某些输入时应用卡顿与不可用（例如这个 https://github.com/advisories/GHSA-c2qf-rxjj-qqgw ）。我已经全面升级了所有需要升级的依赖项，这个更新将会在下一个版本中发布。

[Bin-Huang]

After investigating for several weeks, I believe the false positives from antivirus software are most likely due to the overly aggressive code obfuscation I used. I implemented code obfuscation to protect some important source code in the official Chatbox edition under the electron framework. The application code gets obfuscated before packaging and is stored in the app.asar file. While this obfuscated code doesn't introduce any actual security risks, it does increase the likelihood of triggering false alarms in antivirus software. So, I've decided to reduce the obfuscation level in the next version to avoid these false positives.

实际上经过我几周的排查，我认为安全软件误报的真正原因，更可能是因为我使用了过于严格的代码混淆技术。我采用代码混淆技术是为了在 electron 架构下保护 Chatbox 官方版本中一些重要的应用源码。这样应用代码将会在打包前进行混淆，然后存放在 app.asar 文件中。虽然这些应用代码被混淆后不会引入任何的安全问题，但确实会增加安全软件误报的几率。因此，我已经决定在下一个版本中，适当降低代码的混淆等级，以此来规避误报问题。

[CallMeR]

因此，我已经决定在下一个版本中，适当降低代码的混淆等级，以此来规避误报问题。

1.7.0 在火绒检测下，还是有 downloader 病毒的问题。

[Bin-Huang]

I think I understand what's causing this now. I'm using electron-updater for the auto-update feature in Chatbox software. It's actually a super popular update library in the Electron community. I've noticed from their GitHub issues that some antivirus software might flag it as suspicious on certain systems. There are quite a few discussions about this in the community, but unfortunately, there doesn't seem to be a good way to avoid these false positives at the moment.

我大概明白是什么原因了。我正在使用 electron-updater 这个工具库来实现软件自动获取更新。这是一个在 electron 社区中非常热门和流行的自动更新工具库。我曾经在它的 issues 中观察到，它的行为方式可能在某些系统中容易被误报成安全问题。目前在社区中存在很多这样的讨论，但是目前看似乎没有办法来规避误报。