Hackers breach JDownloader's website to serve malware-laced downloads(www.neowin.net)
98 pointsby bundie7 hours ago8 comments
  • RandomGerm4n6 hours ago
    I wish there was finally a decent alternative to this junk. JDownloader pretends to be GPL, but parts of it are closed source. Plus, the Windows installer on the official site is a gamble, and you can only find a clean installer in the forum. The developers claim it’s "just adware", but since it’s a web-based installer, different things are offered depending on your IP address. Some of these install themselves even if you decline them, and some also contain real malware. It was actually to be expected that they wouldn't secure their website properly and that someone else would end up spreading malware as a result. The only reason to still use this software is that it works with every obscure filehoster out there. Alternatives like pyload are much less effective at bypassing all the security measures these sites put in place to block download managers. It also lets you download videos from streaming sites that other tools like yt-dlp refuse to support.
    • Lammy3 hours ago
      > you can only find a clean installer in the forum

      `winget install AppWork.JDownloader`

      Built in to Windows since Windows 10 v1809 :)

    • papichulo20234 hours ago
      Agree, I removed it from my selfhosted apps because for some reason it always has high cpu usage even when no downloading anything.
    • _aavaa_2 hours ago
      Were’s the AI rewrite when you need it.
    • skrebbel4 hours ago
      Protip, modern browsers (IE6 and later) have a built-in parallel download feature!
      • Lammy3 hours ago
        That's not why people use JDownloader. There are plugins for every popular file-sharing site that automate navigating download pages, handling countdown timers, and pausing for ratelimits.
  • nticompass5 hours ago
    I remember using download managers back in the day, and by "back in the day" I mean dial-up (and maybe early DSL). I liked being able to pause downloads and possibly split them up using multiple connections.

    Nowadays, are download managers even needed anymore? At least for me, the internet is fast enough that I don't need a separate download manager, plus browsers support the pausing (and maybe multiple connections?) feature already.

    I'm just curious why someone would need to use JDownloader.

    EDIT: I hadn't thought about "warez" sites in a while and sites like megaupload where you had to wait for a timer. Those are totally "valid" uses for a downloader like this, thanks.

    • dawnerd4 hours ago
      There's quite a lot of legit uses still. And also, it's not about speed, if I'm on a hotel wifi I don't want firefox giving up if I have multiple files queued up from my file server. Sure, browsers support pause/resume but they also fail pretty hard on spotty connections. With jdownloader you just set it and it'll do it's thing.

      Also nice if you're manually downloading game mods, some are hosted on file lockers that make you wait so many minutes. Again, jdownloader was built for that.

      I also say that as someone that really can't stand jdownloader, but the alternatives are... not great. Surge, the tui, is nice if you're just doing regular ol' http downloads.

    • garyfirestorm5 hours ago
      The ‘scene’ or warez sites are still up and running. Sharing cracked softwares, movies shows etc. through file hosting services. If say you wanted a Blu-ray movie with Dolby atmos sizing near 10 gig. Then you’d queue the file sharing site download links in jdownloader and let it automatically manage these downloads for you.
      • nticompass4 hours ago
        I guess it's been a while since I used those type of sites. I admit that I used to, and I do remember those sites like megaupload or whatever that had a timer.
      • parhamn5 hours ago
        This sent me down memory lane, what happened to warez-bb!
      • zamadatix2 hours ago
        [dead]
    • RandomGerm4n5 hours ago
      There are still warez sites that upload content in RAR archives, which are then split into individual parts. A download manager can then download them all one after another instead of having to do it manually. There are also hosting sites with weird CAPTCHAs or various waiting times.
      • wongarsu4 hours ago
        Dealing with all kinds of weird download sites is the main selling point for me. It's not just warez, you run into them in all kinds of weird places where a nontechnical person needs to share files with a larger audience (google drive etc only works for small audiences), or where somebody decides to monetize by making a couple cents off your download.

        With JDownloader you just throw the link in there, and the software deals with mandatory wait times, captchas, throttled downloads, "you exceeded your downloads for today, come back in 24 hours", etc. JDownloader makes sure it eventually succeeds without me having to baby-sit the process

      • nticompass5 hours ago
        Fair enough. I do remember using those sites back in the day, and the `.rar.000`, `.rar.001` file lists (or was it `.part1.rar`, `.part2.rar`?). I guess I haven't visited or thought about those sites in a while.
    • aqua_coder5 hours ago
      Not everyone have fast enough networks, there are places where people find it lucky to download something that is more than 2 GiBs without finding it to fail suddenly.
    • kogasa240p4 hours ago
      Used it once to pirate Infinity Train because someone put the episodes on MEGA.
    • rvnx5 hours ago
      [dead]
  • Existing41906 hours ago
    > As there has been a question about updates. Those are not compromised, different infra, protected by end-2-end digital signature.

    Phew!

    From: https://old.reddit.com/r/jdownloader/comments/1t6goqe/is_the...

  • raphinou5 hours ago
    When will we finally sign artifacts?

    I'm not only complaining, I also work on a solution (asfaload) that I want easy to use. As it is multisig, such platform breaches become impossible. Below is the doc of the CLI, i'm looking for testers and challengers of the solution!

    https://asfaload.com/doc/

  • hereme8884 hours ago
    Wasn't Jdownloader known in the past for bundling adware?
  • Our_Benefactors7 hours ago
    I’ve never run into a program that manages to disregard as many UX best practices as Jdownloader. It has more maddening features than I can count. Even stuff like sorting a column by date doesn’t work how you would want it to, because it applies some “package grouping”. It’s the epitome of nonsensical defaults, features that maybe 1% of the user base would want and care about but toggled on by default.
  • kristofferR6 hours ago
    What's new? Hasn't JDownloader already served malware with the default installer for years, you had to use specific adware-free installers to avoid it?

    https://board.jdownloader.org/showthread.php?t=54725

  • bundie7 hours ago
    u/rubi2333 uploaded the malicious files to virustotal.com

    JDownloader2Setup_windows-amd64_v1_8_0_482.exe: https://www.virustotal.com/gui/file/5a6636ce490789d7f26aaa86...

    JDownloader2Setup_windows-amd64_v11_0_30.exe: https://www.virustotal.com/gui/file/fb1e3fe4d18927ff82cffb3f...

    JDownloader2Setup_windows-amd64_v17_0_18.exe: https://www.virustotal.com/gui/file/04cb9f0bca6e0e4ed30bc927...

    JDownloader2Setup_windows-amd64_v21_0_10.exe: https://www.virustotal.com/gui/file/32891c0080442bf0a0c5658a...

    JDownloader2Setup_windows-x86_v1_8_0_472.exe: https://www.virustotal.com/gui/file/4ff7eec9e69b6008b77de1b6...

    JDownloader2Setup_windows-x86_v11_0_29.exe: https://www.virustotal.com/gui/file/de8b2bdfc61d63585329b8cf...

    JDownloader2Setup_windows-x86_v17_0_17.exe: https://www.virustotal.com/gui/file/e4a20f746b7dd19b8d9601b8...

    JDownloader2Setup_unix_nojre.sh: https://www.virustotal.com/gui/file/6d975c05ef7a164707fa3592...

    • salomonk_mur6 hours ago
      What? How would you know it was them?
      • Retr0id6 hours ago
        Comparing the hashes would be one way