search

alexzorin / authy

Go library and program to access your Authy TOTP secrets.
MIT License
800 stars 57 forks source link

Windows executable contains Trojan:Win32/Ymacco.AA22? #12

Closed rdickson1995 closed 3 years ago

rdickson1995 commented 3 years ago

Hi, Windows defender just detected Trojan:Win32/Ymacco.AA22 inside the authy-export-windows-amd64.exe binary. What's going on here?

More info about this trojan here: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3aWin32%2fYmacco.AA22&threatid=2147757354 and https://howtofix.guide/trojanwin32-ymacco-aa22/. According to the second URL the Trojan "Attempts to connect to a dead IP:Port" and "Performs some HTTP requests" along with other things.

I suppose I will delete the tool and start changing all my TFA secrets everywhere :(.

alexzorin commented 3 years ago

It's a false positive.

The binary was built and uploaded by Travis CI from the source code in this repository (https://travis-ci.org/github/alexzorin/authy/builds/737211656).

I'm not going to put effort into working around crappy antivirus heuristics, nor buy a code-signing certificate, for an operating system I don't even use.

The Windows binaries are published as a convenience for whoever wants it, if you don't trust it, then run the program from source using the instructions in the README.

If you feel the need to rotate your TOTP keys, I understand, but I'm 100% sure there's nothing wrong with the binary.

nitz commented 3 years ago

I appreciate the binaries being published for windows, for what it's worth! Fantastic tool.

But just as a more jerks being jerks, chrome is flagging your bins as "dangerous" too. I swear the absolute raket that is code signing for stuff like this drives me mad.

image

Either way, just wanted to say thanks for the awesome software!

raverecursion commented 3 years ago

I appreciate the binaries being published for windows, for what it's worth! Fantastic tool.

But just as a more jerks being jerks, chrome is flagging your bins as "dangerous" too. I swear the absolute raket that is code signing for stuff like this drives me mad.

image

Either way, just wanted to say thanks for the awesome software!

Chrome marks all downloaded binary files as 'potentially dangerous'. Nothing to worry about!