Re: User reporting anti-virus warning on wdi-simple

Hello Pete,

thank you for your detailed answer and for writing libwdi, sorry I 
posted in the wrong place.

I had no recollection about compiling wdi-simple and was assuming I got 
it at the same time as the libsub-win32 system files. It turns out I 
compiled it from libwdi-1.2.2.

We must get around to signing aerodrums and our wdi-simple (and also 
tidying up how our files are organized...), time has been scarce before 
and after we launched.

Sincerely,

Yann


On 2014/12/31 05:39 PM, Pete Batard wrote:
> Hi Yann,
>
> On 2014.12.31 16:40, Yann Morvan wrote:
>> we have been using libusbwin32 and libwdi via wdi-simple in our product
>> (aerodrums, motion capture based air drums).
> I assume that you are recompiling wdi-simple yourself and not merely
> using a version that you picked on the internet, right?
>
>> Today a user reported that their anti-virus is warning them about
>> wdi-simple.exe. They provided a link to the following AV diagnostic
>> aggregator:
>>
>> https://www.virustotal.com/de/file/cab29e9988af08995fffa1b41ac7e9048cd9cf6c48284674d32c0d65d9090790/analysis/1420041380/
>>
>> Has anyone come across this before? Is it safe to assume those are just
>> false positives?
> I'm the main author of libwdi (as well as wdi-simple) and I don't
> remember providing a binary version of wdi-simple.exe.
>
> The only binary I do provide, that's related to libwdi, is Zadig [1],
> which does the same thing as wdi-simple (through a friendlier UI) and
> which I do digitally sign, to enable users to confirm that it has not
> been maliciously modified between the time it was compiled on my machine
> and the time it is being executed on theirs.
>
> What this means is: I do not know who produced the wdi-simple.exe(s?)
> that were analysed by the AV vendors (it's Open Source so _anybody_ can
> modify, compile and distribute their own version if they want), and if
> it isn't digitally signed or doesn't originate from a source you trust
> (the copyright and URL info from an exe are meaningless, and can NEVER
> be used as an indication of provenance), there is a real chance that
> someone may have inserted something nasty in the executable.
> You should be all the more careful as libwdi-based apps are good targets
> to insert nasties, since their nominal execution paths requires elevation.
>
> Thus, if you want to install an USB driver using a libwdi-based
> application, there are only 2 options you can actually trust:
> - Zadig, from http://zadig.akeo.ie, as long as its digital signature
> says "Akeo Consulting" (as mentioned on the homepage).
> - Something that you recompiled yourself from the libwdi sources. This
> could be wdi-simple or another sample, but it needs to have been
> compiled in an environment that you can trust.
>
> Anything besides this should be considered potentially nasty, and even
> I, the main author of the original app, can not take position as to
> whether the AV reports are false postives or not, because there's really
> no telling where these exe's came from, and what might have been added
> to them.
>
> It may also be a good opportunity to educate your end-users with regards
> to Windows security: if an application requires elevated privileges to
> run, they should either make sure it is digitally signed with a
> signature that matches the name of the official developer or verify that
> it was obtained from a source they can trust.
>
> Regards,
>
> /Pete
>
> PS: While related, the libusb-win32 mailing list is probably not the
> best place to inquire about pure libwdi matters such as this one - If
> needed, you'll find information of how to access the libdwi mailing list
> at [2].
>
> [1] http://zadig.akeo.ie
> [2] https://lists.sourceforge.net/lists/listinfo/libwdi-devel
>
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming! The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is your
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a
> look and join the conversation now. http://goparallel.sourceforge.net
> _______________________________________________
> Libusb-win32-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/libusb-win32-devel


------------------------------------------------------------------------------
Dive into the World of Parallel Programming! The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net