xLoader instructions lead to a trojan

gnea / grbl

An open source, embedded, high performance g-code-parser and CNC milling controller written in optimized C that will run on a straight Arduino

https://github.com/gnea/grbl/wiki

Other

3.99k stars 1.59k forks source link

xLoader instructions lead to a trojan #1186

Closed skruger closed 1 year ago

skruger commented 1 year ago

I followed the windows instructions to load a grbl binary on to my arduino using xLoader. https://github.com/gnea/grbl/wiki/Flashing-Grbl-to-an-Arduino#for-windows

The xLoader didn't actually work and windows identified a Trojan and named xLoader as being related to it's installation.

xloader-trojan

AlexHolden commented 1 year ago

I've deleted the link, just in case. I've never used xLoader myself so I'm not sure what is the official site to download it from.

X3msnake commented 1 year ago

XLoader is a sourceless wrapper to avrdude and since the author never released the sourcecode and his website disappered from the web, the copies around the web can not be trusted

It is better to use avrdudess gui instead. It is opensource and updated. Download only from the source GitHub

https://github.com/ZakKemble/AVRDUDESS

harryberlin commented 1 year ago

BTW: Laser GRBL has a Dialog for uploading Firmware.

arrsoft312 commented 1 year ago

You can give a try to my small and simple utility for flashing HEX-files to Arduino UNO and Nano boards.

Source code: https://github.com/arrsoft312/update Compiled binary for Windows: https://github.com/arrsoft312/update/releases/latest

skruger commented 1 year ago

I followed the CLI instructions so I was able to get the image flashed. I just wanted to make sure this was reported to raise awareness. Thanks for all your suggestions, I may incorporate them when I have more arduinos to flash.

per1234 commented 1 year ago

I'm not sure what is the official site to download it from.

This is the XLoader download link that was in the wiki before the chain of malicious edits:

http://www.hobbytronics.co.uk/download/XLoader.zip

You can see it in the wiki commit history here:

https://github.com/gnea/grbl/wiki/_compare/bf8da25354e311faaafc15ffae4819c59b3b7b2f