search

uBlockOrigin / uAssets

Resources for uBlock Origin, uMatrix: static filter lists, ready-to-use rulesets, etc.
GNU General Public License v3.0
4.17k stars 773 forks source link

[badware] vlc.de #1547

Closed stonecrusher closed 6 years ago

stonecrusher commented 6 years ago

URL(s) where the issue occurs

https://www.vlc.de/

Describe the issue

This (known) scam for german speaking community exists for years now and still not blocked... They bundle OpenSource software together with their malware and make it look official (although there already exists an official german VLC page). They somehow manage to stay in the top results when searching on google. People like to click vlc.de easier than videolan.org when trying to get the VLC player.

Mainly scam for VLC Player (obviously), but also Open Office, PDF-Drucker, Iron Browser, Songbird, Thunderbird, Gimp, Notepad++, 7-Zip, Libre Office [edit: They are clean, but old. Probably just there for SEO].

VLC official build:
vlc-3.0.0-win32.exe   37.1 MB

vlc.de build:
vlc-3.0.0-win32.exe   37.4 MB

Proof

Virustotal only has one match for the new VLC 3.0 version, but the summary for the whole domain shows the red line and community reports go back to 2008...

In their own vlc.de forum they try to justify by citing their licence and general business terms and stuff... but actually the guy opening the thread is completely right.

Licence:

Das Installationsprogramm verändert an Ihrem PC die Startseite von verschiedenen Browsern, sowie das Suchfeld.

Translation:

The installation program changes the homepage of different browsers as well as the search field on your PC.

Tons of results for search on german speaking malware help forum.

okiehsch commented 6 years ago

The 7zip, notepad++ files etc do not bundle anything, as far as I can see. the only files with different hashes than the original are the vlc-player ones, which do have a different digital signature, the site is quite open about what their version of Videolan does.

unbenannt

The part below the bolded part means that the homepage in your browser will be changed and you can prevent this by disabling that option during the installation process -- it will be enabled by default.

@gorhill what do you think, should this site be added to the badware list?

smed79 commented 6 years ago

@okiehsch

you can prevent this by disabling that option during the installation process

Not sure if the normal user will read or change something.

@stonecrusher Unchecky is a recommended software if you are a windows user https://unchecky.com/

stonecrusher commented 6 years ago

You're right - I didn't test the other programs by myself, just read about it. Just checked 7-zip which looks ok. However this is not a trustworthy site. It tries to look like an official vlc site very hard.

And I didn't see that by now they put a warning in the text above the download button.

Actually I think that's (unfortunately) normal behaviour for most people:
Search for vlc, click the most promising and appropiate url (so short! And who even knows vlc is somehow related to "videolan") - cool, there's already the big downloadbutton. Get it!

The directive should be to protect the everyday user. @SMed79 I don't fall for that but already had to revert it from my relatives' PCs a few times.

okiehsch commented 6 years ago

Not sure if the normal user will read or change something.

I am pretty sure that the "normal" user that downloads any installer double clicks it and then clicks "OK" anytime he/she can. 😉

stonecrusher commented 6 years ago

Just documenting in case for the future:

edit

edit

gorhill commented 6 years ago

It does look like a scammy site to me, as per @stonecrusher's arguments. The main purpose of the site, from the domain name to the design, is to deliver a tainted version of VLC. I can't find any obvious link to the real official VLC site.