Unofficial site distributing malicious version? about greenshot

[jklingen]

Thanks for reporting this. We know about this website, but unfortunately cannot do much about it. The problem is not limited to greenshot, we found several similar sites for popular tools... We wrote a detailed blog post about this some time ago https://getgreenshot.org/2019/01/07/fake-websites-targeting-oss-users-malware/

We already reported this site to Google Safe Browsing and the hosting provider, but have not heard back. If you can take the time, I assume that additional reports to these institutions can help for them to actually take action

[vaderj]

Thanks. I did see the article before I posted this but after Symantec caught the .exe, I just wanted to increase the visibility.

Thanks to everyone involved for continuing to update an awesome product!

*I also reported that site as well

[savchenko]

At present, greenshot.org links to the greenshot.fr which is registered with OVH. From what I remember, OVH support has rather dim view on re-packaged OSS bundled with malware.

However, download link returns 404, so there is not much to talk about. Perhaps it's worth talking to greenshot.org/fr contacts regarding setting-up CNAME to getgreenshot.org or just transferring domains to @Lakritzator ?

[jklingen]

@asvc we did try to get in touch with OVH some time ago, but they never responded and nothing has happened since then. I just tried again via email, if that does not work I'll try again via Twitter after the holidays.
For me, the .org site does not forward to the .fr site, and I can still download the binaries from both.
If you can't, that's maybe a feature of your browser or internet provider?

I doubt it will help to try to talk to the company behind these fake websites - after all it's obvious they set up all of these websites (for other OS projects as well) to intentionally mislead people into downloading their modified binaries 😠 I assume they are not interested into transferring any of their domains.

[savchenko]

Ah, greenshot.fr was in one of the lists I was using to block malwertising on a local DNS resolver. Fixed.

I have few ideas in mind, but perhaps you could make this issue private first?
I would imagine that operator of greenshot.org/fr is watching this repository like a hawk.

[jklingen]

AFAIK there is no way to have private issues in Github, or is there? 🤔
If you prefer to have a private conversation about this, you may use our gmail address (see website > impressum)

Again got no response from OVH, tried to ping them on a different channel today.

[savchenko]

@jklingen , please see here: https://help.github.com/en/github/getting-started-with-github/faq-about-changes-to-githubs-plans

[jklingen]

Maybe I am missing something, but I cannot find any info about private issues on this page, only a bit about private repositories.

[savchenko]

Hm... I think this will require another, private repository. Good thing is that now you can have 2000 of them for free.

[savchenko]

OK, apparently one can create a team, make it private and invite members there. I have just done that for a test.