Your machine runs a little slower, your bandwidth gets a little thinner, and someone halfway around the world is routing traffic through your home IP. It's a fundamentally different threat model and most endpoint protection isn't looking for it because the behavioral signatures look like normal network activity.
Is it even possible for a prosumer home router like OPNsense or OpenWRT to detect this?
I wish in 2026 the default on new computers (Windows + Mac) was not only "inbound firewall on by default" but also outbound and users having to manually select what is allowed.
I know it is possible, it's just not the default and more of a "power user" thing at the moment. You have to know about it basically.
An article from 2018:
https://www.bleepingcomputer.com/news/security/fake-websites...
And uBlock Origin's "Badware" filter blocks it:
https://github.com/uBlockOrigin/uAssets/blob/master/filters/...
Search results can be gamed by SEO, there were also cases of malware developers buying ads so links to the malware download show up above legitimate ones. Wikipedia works only for projects prominent enough to have a Wikipedia page.
What are the other mechanisms for finding out the official website of a software?
There are risks in everything you do. If the average user doesn't know where the application he wants to download _actually_ comes from then maybe the average user shouldn't use the internet at all?
I dunno, if you type "download 7zip" into Google, the top result is the official website.
Also, 7zip.com is nowhere on the first page, and the most common browsers show you explicitly it's a phishing website.
This is actually a pretty good case of the regular user being pretty safe from downloading malware.
Are the search removals and phishing warnings reactive or proactive? Because if it is the former then we don't really know how many users are already affected before security researchers got notified and took action.
Also, 7zip is not the only software to be affected by similar domain squatting "attacks." If you search for PuTTY, the unofficial putty.org website will be very high on the list (top place when I googled "download putty.") While it is not serving malware, yet, the fact that the more legitimate sounding domain is not controlled by the original author does leave the door open for future attacks.
Until someone puts an ad above it.
So the advice is to install it from the extension store.
In incognito window, for me, it's 3rd result
Lookalike websites serving malware have always existed. So this isn't exactly news. But the browsers are blocking them like they should.
Did they change it because of the negative publicity (Reddit) and will probably change back soon to the malware links?
[1] https://learn.microsoft.com/en-us/windows/package-manager/pa...
WinGet is not only unreliable, it is but one step removed from Remote Code Execution as a Service. Well, maybe one-and-a-half, if package repo maintainers were to pay attention, but that’s not realistic.
Modern Windows and OS X and Android and iOS are all worse than the old ones.
I imagine an electron rewrite, with DirectX 12 and Copilot buttons everywhere
But I'm sure people blindly click through the "Unknown author" prompt just as they would ignore a certificate error.
Maybe it's high time for a free-as-in-beer CA for non-profit open source developers funded by donations?
Edit: I was wrong.
Prices on code signing certificates have skyrocketed to in excess of $500/year, due in part to continuing meddling by the CA/B forum which increased the requirements of standard certs to be the same as EV certs, and requiring the key to be stored in a hardware token—which must now be re-issued yearly.
This makes it near impossible to provide free or affordable certificates to developers. Thanks CA/B forum, lots of help as usual.
Note that the certificate itself is only for 1 year regardless of how long you buy one for and you need to go through the renewal process each year just without payment.
Whether Authenticode provides a sufficient authenticity check is yet another question, of course. Still, file integrity verification is just a side-effect.