search

XavierBerger / RPi-Monitor

Real time monitoring for embedded devices
https://xavierberger.github.io/RPi-Monitor-docs/index.html
GNU General Public License v3.0
1.16k stars 176 forks source link

Bitdefender shows Trojan Warning in Firefox Profile Cache at loading RPI Monitor Website #327

Open Peacemaker80 opened 4 years ago

Peacemaker80 commented 4 years ago

Hallo,

i don't know if it is a bug but every time i load or reload the Webinterface of RPIMonitor on my PI3 or PI4 with the newest Raspbian and all updates my Bitdefender Internet Security on my Win 10 Machine comes up with the Warning Message that JS:Trojan.Cryxos.3793 was found in Firefox Profile Cache and move this in Quarantine. After setup a fresh Rasbian install its the same. Anybody else have this issue? My Win 10 Machine is clean, after full scan and it only appears if i load the RPI Interface.

Thanks for an answer

licaon-kter commented 4 years ago

But what script? File? Dig into Bitdefender logs

Peacemaker80 commented 4 years ago

C:\Users\XXXX\AppData\Local\Mozilla\Firefox\Profiles\YYYYYYY.default-12345678\cache2\entries\1B946087BA0A8A01FF56A44ACE2EB09D86BBCA68 ist mit JS:Trojan.Cryxos.3793 infiziert.

X, Y and 12345678 are replacements for personal data. It looks like the cached Data of the Webinterface brings up the Warning. False Positve?

Peacemaker80 commented 4 years ago

Ok i have take a look in this File in Quarantine and post it now: ` // +--------------------------------------------------------------------+ \ // ¦ Raphaël 2.1.0 - JavaScript Vector Library ¦ \ // +--------------------------------------------------------------------¦ \ // ¦ Copyright © 2008-2012 Dmitry Baranovskiy (http://raphaeljs.com) ¦ \ // ¦ Copyright © 2008-2012 Sencha Labs (http://sencha.com) ¦ \ // +--------------------------------------------------------------------¦ \ // ¦ Licensed under the MIT (http://raphaeljs.com/license.html) license.¦ \

BLAH BLAH BLAH very much code....

// +--------------------------------------------------------------------+ \

:http://123.123.123.3:8888/js/raphael.2.1.0.min.js strongly-framed 1 request-method GET response-head HTTP/1.1 200 OK Date: Thu, 28 May 2020 13:05:17 GMT Server: libwww-perl-daemon/6.01 Content-Type: application/javascript Content-Length: 90075 Last-Modified: Sat, 26 Aug 2017 20:16:42 GMT original-response-headers Date: Thu, 28 May 2020 13:05:17 GMT Server: libwww-perl-daemon/6.01 Content-Type: application/javascript Content-Length: 90075 Last-Modified: Sat, 26 Aug 2017 20:16:42 GMT ctid 2 uncompressed-len 0 _ `

Peacemaker80 commented 4 years ago

I think the file http://123.123.123.3:8888/js/raphael.2.1.0.min.js produces the error

Peacemaker80 commented 4 years ago

In Chrome no bitdefender warnings were shown at loading the webinterface of RPI Monitor. ?

licaon-kter commented 4 years ago

This file? https://github.com/XavierBerger/RPi-Monitor/blob/develop/src/usr/share/rpimonitor/web/js/raphael.2.1.0.min.js

Looks fine: https://www.virustotal.com/gui/file/27b96ab9ad424b0a8088ed06946853db481d1581669b49fc4f4fab2968bd9b36/detection

Can you download the whole repo and scan it locally?

Peacemaker80 commented 4 years ago

After download all an scan it directly no warnings occur. Only the firefox tempfile which contains the cached version of this .js file produces the error...... Very strange... Must be a error in firefox in addtion to this javascript or a false positve. I will compare the files on the pi and the download from github with notepad++.