A few days ago we reported on a Free Download Manager site that had been redirecting Linux users to malware for years! A reported attack on the Free Download Manager supply chain redirected Linux users to a malicious Debian package repository that was installing information-stealing malware. It appears that Free Download Manager, after being notified by Kaspersky about the issue, has been investigating and trying to identify the problem.
The company Free Download Manager contacted us and after conducting research, came to the following conclusions:
Our investigation showed that hackers exploited a vulnerability in a script on our website to insert a malicious file that they used to alter the page https://www.freedownloadmanager.org/download-fdm-for-linux.htm.
To investigate this issue, we accessed data from our project backups dating back to 2020 and found this modified page, which contained an algorithm that chose whether to give users the correct download link or one that led to the fake deb.fdmpkg.org domain containing a malicious .deb file. It had an “exception list” of IP addresses from various subnets, including those associated with Bing and Google. Visitors from these IP addresses were always given the correct download link.
We are truly sorry for what happened and we ask again our users who downloaded FDM for Linux in 2020-2022 to check their computers for malware. We also want to assure all Windows and Mac users that our website was safe for them.
The Free Download Manager company also says that it has prepared a bash script that you can use to check for the presence of malware on your system:
1. Download the linux_malware_check.sh and give it execution permissions. You can do this by running:
chmod +x linux_malware_check.sh.
2. Run the script by running: ./linux_malware_check.sh.
Please note that this script only determines whether the listed potential threats are present on your computer, but does not remove them. If malware is detected, a system reinstallation is highly recommended.
Read the original article here.
