Re: User reporting anti-virus warning on wdi-simple

Hi Yann,

On 2014.12.31 16:40, Yann Morvan wrote:
> we have been using libusbwin32 and libwdi via wdi-simple in our product
> (aerodrums, motion capture based air drums).

I assume that you are recompiling wdi-simple yourself and not merely 
using a version that you picked on the internet, right?

> Today a user reported that their anti-virus is warning them about
> wdi-simple.exe. They provided a link to the following AV diagnostic
> aggregator:
>
> https://www.virustotal.com/de/file/cab29e9988af08995fffa1b41ac7e9048cd9cf6c48284674d32c0d65d9090790/analysis/1420041380/
>
> Has anyone come across this before? Is it safe to assume those are just
> false positives?

I'm the main author of libwdi (as well as wdi-simple) and I don't 
remember providing a binary version of wdi-simple.exe.

The only binary I do provide, that's related to libwdi, is Zadig [1], 
which does the same thing as wdi-simple (through a friendlier UI) and 
which I do digitally sign, to enable users to confirm that it has not 
been maliciously modified between the time it was compiled on my machine 
and the time it is being executed on theirs.

What this means is: I do not know who produced the wdi-simple.exe(s?) 
that were analysed by the AV vendors (it's Open Source so _anybody_ can 
modify, compile and distribute their own version if they want), and if 
it isn't digitally signed or doesn't originate from a source you trust 
(the copyright and URL info from an exe are meaningless, and can NEVER 
be used as an indication of provenance), there is a real chance that 
someone may have inserted something nasty in the executable.
You should be all the more careful as libwdi-based apps are good targets 
to insert nasties, since their nominal execution paths requires elevation.

Thus, if you want to install an USB driver using a libwdi-based 
application, there are only 2 options you can actually trust:
- Zadig, from http://zadig.akeo.ie, as long as its digital signature 
says "Akeo Consulting" (as mentioned on the homepage).
- Something that you recompiled yourself from the libwdi sources. This 
could be wdi-simple or another sample, but it needs to have been 
compiled in an environment that you can trust.

Anything besides this should be considered potentially nasty, and even 
I, the main author of the original app, can not take position as to 
whether the AV reports are false postives or not, because there's really 
no telling where these exe's came from, and what might have been added 
to them.

It may also be a good opportunity to educate your end-users with regards 
to Windows security: if an application requires elevated privileges to 
run, they should either make sure it is digitally signed with a 
signature that matches the name of the official developer or verify that 
it was obtained from a source they can trust.

Regards,

/Pete

PS: While related, the libusb-win32 mailing list is probably not the 
best place to inquire about pure libwdi matters such as this one - If 
needed, you'll find information of how to access the libdwi mailing list 
at [2].

[1] http://zadig.akeo.ie
[2] https://lists.sourceforge.net/lists/listinfo/libwdi-devel

------------------------------------------------------------------------------
Dive into the World of Parallel Programming! The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net