Hackers breach JDownloader's website to serve malware-laced downloads

107

bbundie about 15 hours ago 29 commentsRead Article on neowin.net

FR version is available. Content is displayed in original English for accuracy.

⚡ Community Insights

Discussion Sentiment

70% Positive

Analyzed from 1021 words in the discussion.

Discussion (29 Comments)Read Original on HackerNews

RandomGerm4n•about 13 hours ago

I wish there was finally a decent alternative to this junk. JDownloader pretends to be GPL, but parts of it are closed source. Plus, the Windows installer on the official site is a gamble, and you can only find a clean installer in the forum. The developers claim it’s "just adware", but since it’s a web-based installer, different things are offered depending on your IP address. Some of these install themselves even if you decline them, and some also contain real malware. It was actually to be expected that they wouldn't secure their website properly and that someone else would end up spreading malware as a result. The only reason to still use this software is that it works with every obscure filehoster out there. Alternatives like pyload are much less effective at bypassing all the security measures these sites put in place to block download managers. It also lets you download videos from streaming sites that other tools like yt-dlp refuse to support.

Lammy•about 10 hours ago

> you can only find a clean installer in the forum

`winget install AppWork.JDownloader`

Built in to Windows since Windows 10 v1809 :)

papichulo2023•about 12 hours ago

Agree, I removed it from my selfhosted apps because for some reason it always has high cpu usage even when no downloading anything.

Havoc•about 4 hours ago

I know people are using aria2 for similar purposes but haven't checked out how well it works

_aavaa_•about 10 hours ago

Were’s the AI rewrite when you need it.

skrebbel•about 11 hours ago

Protip, modern browsers (IE6 and later) have a built-in parallel download feature!

Lammy•about 10 hours ago

That's not why people use JDownloader. There are plugins for every popular file-sharing site that automate navigating download pages, handling countdown timers, and pausing for ratelimits.

Existing4190•about 14 hours ago

> As there has been a question about updates. Those are not compromised, different infra, protected by end-2-end digital signature.

Phew!

From: https://old.reddit.com/r/jdownloader/comments/1t6goqe/is_the...

nticompass•about 12 hours ago

I remember using download managers back in the day, and by "back in the day" I mean dial-up (and maybe early DSL). I liked being able to pause downloads and possibly split them up using multiple connections.

Nowadays, are download managers even needed anymore? At least for me, the internet is fast enough that I don't need a separate download manager, plus browsers support the pausing (and maybe multiple connections?) feature already.

I'm just curious why someone would need to use JDownloader.

EDIT: I hadn't thought about "warez" sites in a while and sites like megaupload where you had to wait for a timer. Those are totally "valid" uses for a downloader like this, thanks.

dawnerd•about 11 hours ago

There's quite a lot of legit uses still. And also, it's not about speed, if I'm on a hotel wifi I don't want firefox giving up if I have multiple files queued up from my file server. Sure, browsers support pause/resume but they also fail pretty hard on spotty connections. With jdownloader you just set it and it'll do it's thing.

Also nice if you're manually downloading game mods, some are hosted on file lockers that make you wait so many minutes. Again, jdownloader was built for that.

I also say that as someone that really can't stand jdownloader, but the alternatives are... not great. Surge, the tui, is nice if you're just doing regular ol' http downloads.

garyfirestorm•about 12 hours ago

The ‘scene’ or warez sites are still up and running. Sharing cracked softwares, movies shows etc. through file hosting services. If say you wanted a Blu-ray movie with Dolby atmos sizing near 10 gig. Then you’d queue the file sharing site download links in jdownloader and let it automatically manage these downloads for you.

nticompass•about 12 hours ago

I guess it's been a while since I used those type of sites. I admit that I used to, and I do remember those sites like megaupload or whatever that had a timer.

parhamn•about 12 hours ago

This sent me down memory lane, what happened to warez-bb!

Havoc•about 4 hours ago

Very much doubt scene is using downloaders these days. ftp for the groups and torrent/usenet for the plebs

RandomGerm4n•about 12 hours ago

There are still warez sites that upload content in RAR archives, which are then split into individual parts. A download manager can then download them all one after another instead of having to do it manually. There are also hosting sites with weird CAPTCHAs or various waiting times.

wongarsu•about 11 hours ago

Dealing with all kinds of weird download sites is the main selling point for me. It's not just warez, you run into them in all kinds of weird places where a nontechnical person needs to share files with a larger audience (google drive etc only works for small audiences), or where somebody decides to monetize by making a couple cents off your download.

With JDownloader you just throw the link in there, and the software deals with mandatory wait times, captchas, throttled downloads, "you exceeded your downloads for today, come back in 24 hours", etc. JDownloader makes sure it eventually succeeds without me having to baby-sit the process

nticompass•about 12 hours ago

Fair enough. I do remember using those sites back in the day, and the `.rar.000`, `.rar.001` file lists (or was it `.part1.rar`, `.part2.rar`?). I guess I haven't visited or thought about those sites in a while.

aqua_coder•about 12 hours ago

Not everyone have fast enough networks, there are places where people find it lucky to download something that is more than 2 GiBs without finding it to fail suddenly.

kogasa240p•about 12 hours ago

Used it once to pirate Infinity Train because someone put the episodes on MEGA.

kanemcgrath•about 6 hours ago

I am always worried that popular software like this is getting compromised. But what about all the smaller stuff? I download and run a bunch of small programs, especially for game modding. Do the small tools not have the same risk because of their smaller scale invites less dedicated attacks? or do they get compromised and fly completely under the radar?

raphinou•about 13 hours ago

When will we finally sign artifacts?

I'm not only complaining, I also work on a solution (asfaload) that I want easy to use. As it is multisig, such platform breaches become impossible. Below is the doc of the CLI, i'm looking for testers and challengers of the solution!

https://asfaload.com/doc/

Our_Benefactors•about 14 hours ago

I’ve never run into a program that manages to disregard as many UX best practices as Jdownloader. It has more maddening features than I can count. Even stuff like sorting a column by date doesn’t work how you would want it to, because it applies some “package grouping”. It’s the epitome of nonsensical defaults, features that maybe 1% of the user base would want and care about but toggled on by default.

hereme888•about 11 hours ago

Wasn't Jdownloader known in the past for bundling adware?

kristofferR•about 13 hours ago

What's new? Hasn't JDownloader already served malware with the default installer for years, you had to use specific adware-free installers to avoid it?

https://board.jdownloader.org/showthread.php?t=54725

Cider9986•about 13 hours ago

Here is a guide to debloat JDownloader

(https://claraiscute.neocities.org/Guides/jdownloader2/)

dark theme (https://github.com/moktavizen/material-darker-jdownloader)

dopa42365•about 13 hours ago

Years ago I made my own "dark-ish mode" for it and holy hell, so annoying having to change 50 different more or less accurately labeled and named color settings that only take affect after restarting the program.

bundie•about 14 hours ago

u/rubi2333 uploaded the malicious files to virustotal.com

JDownloader2Setup_windows-amd64_v1_8_0_482.exe: https://www.virustotal.com/gui/file/5a6636ce490789d7f26aaa86...

JDownloader2Setup_windows-amd64_v11_0_30.exe: https://www.virustotal.com/gui/file/fb1e3fe4d18927ff82cffb3f...

JDownloader2Setup_windows-amd64_v17_0_18.exe: https://www.virustotal.com/gui/file/04cb9f0bca6e0e4ed30bc927...

JDownloader2Setup_windows-amd64_v21_0_10.exe: https://www.virustotal.com/gui/file/32891c0080442bf0a0c5658a...

JDownloader2Setup_windows-x86_v1_8_0_472.exe: https://www.virustotal.com/gui/file/4ff7eec9e69b6008b77de1b6...

JDownloader2Setup_windows-x86_v11_0_29.exe: https://www.virustotal.com/gui/file/de8b2bdfc61d63585329b8cf...

JDownloader2Setup_windows-x86_v17_0_17.exe: https://www.virustotal.com/gui/file/e4a20f746b7dd19b8d9601b8...

JDownloader2Setup_unix_nojre.sh: https://www.virustotal.com/gui/file/6d975c05ef7a164707fa3592...

salomonk_mur•about 14 hours ago

What? How would you know it was them?

Retr0id•about 14 hours ago

Comparing the hashes would be one way