Tuesday, March 18, 2014

Sourceforge Bundles Malware with Legit Downloads


Last Sunday night I uploaded my professional/personal website, gabrielohhmedia.com to A Small Orange, my webhost. Go check it out. Of course uploading the site did not come without some hiccups. I wasn’t expecting that one of them would be finding a quality FTP client.

My friend Tecate Valentino is looking for a copy of Photoshop for his Mac. Being the advocate for free and open source software that I am, I suggested downloading and installing The GIMP. Well, today I decided to read up on the latest GIMP news and after nonchalantly browsing through the GIMP’s homepage news section, I  found a bit of news that disturbed me enough to type up a fresh blog post.

The GIMP reports in a blog post, GIMP Windows Installers Move From Sourceforge to FTP.GIMP.org, dated 11-05-13, details the latest horrors. Sourceforge was once a popular place to find and safely download FLOSS. I was really disappointed to find out that SourceForge now uses a special installer that bundles spyware, malware, and crimeware with your download. Shame shame shame.


Sourceforge screenshot showing arrows for multiple downloads, some from advertising.
Download here, download there.
Looking for an FTP client on my Windows 7 system, I immediately searched for FileZilla, a 5-star free and open-source FTP client. In a rush to install FileZilla and upload my site, I came across the bundles of crapware SourceForge was trying to push with my download. Thankfully I caught it and hopefully the unwanted wares did not install. I will have to double-check when I get home.

Thinking back on my most recent downloads from Sourceforge,  I downloaded and installed Miro Video Converter to encode some .webm and .mp4 video for HTML5 video on my website. The download link in Miro’s website took me to Sourceforge where I was able to find the Miro installer after bobbing and weaving the ads with green arrows indicating, “download here!” This time, the Sourceforge installer did not prompt me to install the third party malware such as PC Optimizer and Live Help. When the download finished, I noticed I had at least 4 unwanted applications on my desktop which I immediately and hopefully permanently uninstalled.

Making matters worse, the developers of FileZilla and Miro Video Converter are aware of Sourceforge’s installer changes because they are reported to be on the take. It is a shame when good software such as FileZilla is being used to push junk on the unsuspecting user. If you want my advice, be wary when downloading software, even once trusting locations such as Sourceforge. When forced to go to Sourceforge and the likes, watch the download options to prevent the dreaded Ask toolbar or PC Optimizer spyware.