www.mingw.org is compromised and serving a trojaned installer

• Reporter: ascendr
• Owner: (None)
• Type: Issues
• Status: Closed
• Component: WEBSITE
• MileStone: (None)
• Priority: 9 - Highest
• Severity: 5 - Medium
• Resolution: Invalid
• File: None

Details

www.mingw.org is compromised and is serving a trojaned installer.

Trojaned mingw installer is being served from www.mingw.org/sites/www.mingw.org/files/releases/mingw-get-setup.exe

The trojan file is 470K instead of the expected 85K

The entire /sites child path has Index of (directory traversal) enabled.

The trojaned installer seems to install a Banking Trojan.

Ticket History (3/4 Histories)

2018-08-22 05:59 Updated by: ascendr

• New Ticket "www.mingw.org is compromised and serving a trojaned installer" created

2018-08-22 06:11 Updated by: ascendr

Comment

MD5 (mingw-get-setup.exe) = 15d6548423be7a23a516ba0fe4afd65a

https://www.virustotal.com/#/file/32d903bd0cfdad8cba650e0c643ced6e8c50479259073b587182f86a0912b208/detection

2018-08-22 06:59 Updated by: keith

• Component Update from INSTALLER to WEBSITE
• Resolution Update from None to Invalid
• Owner Update from keith to (None)
• Status Update from Open to Closed

Comment

Thank you for the report. I've closed it as invalid, for the following reasons:

1. It is not an "installer" issue, (as you've specified); it is a "website" issue, and mingw.org does not serve the installer.
2. You've exceeded your authority, by assigning to me, in spite of explicit instructions telling you that you must not do so.

Notwithstanding, I have removed the "Download Installer" button from the website; I don't know how, or where, to fix the bad action which is associated with it ... an action which, for me, delivers a zero-length file, (not the 470kb monster, to which you allude). The correct action would have been to invoke a download from https://osdn.net/projects/mingw/downloads/68260/mingw-get-setup.exe (size being 91kb, and 4 of 66 virus scanners report known false positives), but, as noted, I don't know how to make that happen.

2018-08-22 07:35 Updated by: ascendr

Comment

If you can assist in forwarding this information to the right people who support mingw.org website that would be great. The site is compromised and serving malware.