PSA: Remove puush

Offline

Jan 2009

14180

Gogetters said:
It was infected with malware yesterday, latest version fixed that.

Was it from the Website http://puush.me/?

Was only one specific Version affected and did it get detected by the Anti-Virus Programs on VirusTotal? Also, was there a Possibility to disable Auto-Update Features or at least, decide to save the Setup first or where you screwed even on a previous Version, the Moment you had allowed Internet Access to that Tool?

♗

image source Z28.310

Mar 30, 2015 11:03 AM

Gogetters

Offline

Oct 2009

2988

Noboru said:

Gogetters said:
It was infected with malware yesterday, latest version fixed that.

The details they've given are on their twitter. https://twitter.com/puushme

Mar 30, 2015 12:26 PM

Offline

Jan 2009

14180

Doesn't say much, except that a certain Update that was pushed out in a specific Time Frame was infected with Malware.

Neither the exact Type of Malware (Rootkit, Backdoor, Keylogger, Spyware, etc.), nor the exact Infection Vector was mentioned, whether the Updates and/or Installation are automatic and on which Point you got infected (right when connecting to the Update Server or only when you've run the Setup).

♗

image source Z28.310

Mar 30, 2015 9:08 PM

-taeyeon

Offline

Aug 2014

140

The malware was a keylogger + grabbed your locally stored passwords in firefox/chrome, and yes the program updates automatically. If your computer was on when the infected update was puushed (heh see what i did there) then you should consider any browser saved password compromised, or ones you typed in for the few hours the update was live.

It's not really a big deal unless you used a credit card or something during that timeframe, otherwise they handled it pretty well all things considered. Just change your passwords for anything you care about to be safe.

Mar 31, 2015 7:48 AM

#10

Offline

Jan 2009

14180

Ok thanks, that answers most of my Questions, except the one how the automatic Updates are handled (does it automatically install the new Version or only remind you of it or respectively: can you set it like that) and whether you got compromised right when connecting to the Update Server or only during/after Installation.

btw.: I'm not using puush, but I'm just curious about this Incident. New Details should come out soon after going through the "Tweets & replies" Section and reading the Replies.

♗

image source Z28.310

Mar 31, 2015 12:10 PM

#11

-taeyeon

Offline

Aug 2014

140

Noboru said:
Ok thanks, that answers most of my Questions, except the one how the automatic Updates are handled (does it automatically install the new Version or only remind you of it or respectively: can you set it like that) and whether you got compromised right when connecting to the Update Server or only during/after Installation.

btw.: I'm not using puush, but I'm just curious about this Incident. New Details should come out soon after going through the "Tweets & replies" Section and reading the Replies.

Puush only has automatic updates and there's no way to turn it off, at least from my brief look in the setting. And I don't quite understand the second question but as far as I understand you only got infected if your PC was online and connected to the update server, like you only had the infection if your puush was running update r94 for any period of time.

If I had to guess they will probably make changes to the automatic updating after this incident lol.

Also personally I am still going to use puush, I think it's a good service and even with this hiccup like I said they did damage control very well, and I just changed my passwords so it's not really any harm done to me, I hardly had any saved. I was playing video games when it happened so if someone looked at my log from the keylogger I presume they would see "WASDASADADADAWDADAD". =]

Mar 31, 2015 12:44 PM

#12

Offline

Jan 2009

14180

-Haku said:
Puush only has automatic updates and there's no way to turn it off, at least from my brief look in the setting. And I don't quite understand the second question but as far as I understand you only got infected if your PC was online and connected to the update server, like you only had the infection if your puush was running update r94 for any period of time.

There are different Methods how Updates are handled. Some Programs inform you only about a new Version and link you to their Homepage or even to the direct Download URL, which usually downloads into the %temp% Folder, then. If it's the direct Download like with VLC-Mediaplayer, you can either decide to directly install the Setup or decline and move the Files to another Location first. In any Case, you normally need to have Admin Rights to have it installed and you have to explicitly allow the Installation (provided that the UAC is not disabled)
Browsers like Chrome and Firefox can update themselves completely automatically, so I guess it's something similar to that from your Description.

If I had to guess they will probably make changes to the automatic updating after this incident lol.

I hope so, too. It seems convenient, at least.

♗