On 05/09/17 09:15, Samuli Seppänen wrote: > On 04/09/2017 16:32, Igor Bozovic wrote: >> Hello, >> >> I downloaded openvpn-install-2.4.3-I602.exe from >> https://openvpn.net/index.php/open-source/downloads.html and uploaded >> the file to https://www.virustotal.com. >> >> Baidu and TrendMicro-HouseCall reported a virus: >> https://www.virustotal.com/#/file/f722ff1d187951c4e7454e2d845ba6d0d43d505112e073fa60b67b350fd6bc87/detection >> >> I used gpg to check the file integrity: >> >> -------------------- >> gpg -v --verify openvpn-install-2.4.3-I602.exe.asc >> gpg: armor header: Version: GnuPG v1 >> gpg: assuming signed data in `openvpn-install-2.4.3-I602.exe' >> gpg: Signature made петак, 14. јул 2017. (this means Friday, 14th July) >> 15:28:49 CEST using RSA key ID 8CC2B034 >> gpg: using subkey 8CC2B034 instead of primary key 2F2B01E7 >> gpg: using PGP trust model >> gpg: Good signature from "OpenVPN - Security Mailing List >> <[email protected] <mailto:[email protected]>>" >> gpg: WARNING: This key is not certified with a trusted signature! >> gpg: There is no indication that the signature belongs to the >> owner. >> Primary key fingerprint: F554 A368 7412 CFFE BDEF E0A3 12F5 F7B4 2F2B 01E7 >> Subkey fingerprint: B596 06E2 D8C6 E10B 80BE 2B31 D72A F344 8CC2 B034 >> gpg: binary signature, digest algorithm SHA1 >> -------------------- >> >> I assume it's a false positive, but I would appreciate if you could >> confirm this. I guess that the exe file could be infected at compile time. >> >> Many thanks, >> >> Igor Božović >> > > Hi, > > Almost every installer of ours triggers one or two of the virus scanners > at VirusTotal. If the the installer were really infected, I'm sure that > our users' personal virus scanners would also start showing red, and we > would get more than one report (that is, yours). > > So yes, this is certainly yet another false positive. >
Also considering the GPG fingerprint: $ gpg --fingerprint [email protected] pub 4096R/0x12F5F7B42F2B01E7 2017-02-09 [expires: 2027-02-07] Key fingerprint = F554 A368 7412 CFFE BDEF E0A3 12F5 F7B4 2F2B 01E7 uid OpenVPN - Security Mailing List <[email protected]> sub 4096R/0xF80E8008F6D9F8D7 2017-02-09 [expires: 2018-03-06] sub 4096R/0xD72AF3448CC2B034 2017-02-09 [expires: 2018-03-06] The signing key fingerprints I have matches the one from the signature verification. So the installer is quite unlikely modified by any external party. And that signing key is signed by the same key as this e-mail. If that adds more confidence for you. -- kind regards, David Sommerseth OpenVPN Technologies, Inc
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
