Open Source

31088 readers

785 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Posts must be relevant to the open source ideology
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago

MODERATORS

[email protected]

200

Malicious Plugin in Pidgin (Chat Application) (pidgin.im)

submitted 2 months ago by [email protected] to c/[email protected]

16 comments fedilink hide all child comments

Greetings everyone. It is with much regret that I am writing this post. A plugin, ss-otr, was added to the third party plugins list on July 6th. On August 16th we received a report from 0xFFFC0000 that the plugin contained a key logger and shared screen shots with unwanted parties.

We quietly pulled the plugin from the list immediately and started investigating. On August 22nd Johnny Xmas was able to confirm that a keylogger was present.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 2 months ago

To be fair, if your app has its own plugin list and installler, its probably going to be vulnerable to download malicious plugins.

I don't know of an in-app plugin installers that actually cryptographically verify signatures on downloads like apt does.