If you download java from <a href="http://java.com">java.com</a>, you will get the installers with the bundled toolbar. If you go to Oracle's java site or ftp site, you will get installers that don't have bundled toolbars. <div>
<br></div><div>e.g., <a href="http://www.oracle.com/technetwork/java/javase/downloads/index.html">http://www.oracle.com/technetwork/java/javase/downloads/index.html</a><div><br></div><div>Also, on Windows, the toolbar installer can be disabled with a switch to setup.exe I think. <div>
<br></div><div>-Rob</div><div><br><br><div class="gmail_quote">On Mon, Dec 5, 2011 at 8:27 PM, Justin Krejci <span dir="ltr"><<a href="mailto:jus@krytosvirus.com">jus@krytosvirus.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Seems kind of shameful to me. I don't think I remember the last time I downloaded anything from <a href="http://download.com" target="_blank">download.com</a> either, too many ads and misleading links from the looks of it to me.<br>
<br>
I love nmap and feel sad for any infected with other junk, looking at you Java JRE installer for Windows and the Yahoo search bar crap. If I wanted Yahoo search bar its pretty likely I would have installed on my own. Its not like they are even related programs.<br>
<br>
Of course I don't use nmap on windows but its cool its a supported OS family.<br>
<br>
<br>
Jason, does Swift have nmap installed by default?<br>
<br>
<br>
-----Original Message-----<br>
From: Fyodor <<a href="mailto:fyodor@insecure.org">fyodor@insecure.org</a>><br>
Sender: <a href="mailto:nmap-hackers-bounces@insecure.org">nmap-hackers-bounces@insecure.org</a><br>
Date: Mon, 5 Dec 2011 14:35:30<br>
To: <<a href="mailto:nmap-hackers@insecure.org">nmap-hackers@insecure.org</a>><br>
Subject: C|Net Download.Com is now bundling Nmap with malware!<br>
<br>
Hi Folks. I've just discovered that C|Net's Download.Com site has<br>
started wrapping their Nmap downloads (as well as other free software<br>
like VLC) in a trojan installer which does things like installing a<br>
sketchy "StartNow" toolbar, changing the user's default search engine<br>
to Microsoft Bing, and changing their home page to Microsoft's MSN.<br>
<br>
The way it works is that C|Net's download page (screenshot attached)<br>
offers what they claim to be Nmap's Windows installer. They even<br>
provide the correct file size for our official installer. But users<br>
actually get a Cnet-created trojan installer. That program does the<br>
dirty work before downloading and executing Nmap's real installer.<br>
<br>
Of course the problem is that users often just click through installer<br>
screens, trusting that <a href="http://download.com" target="_blank">download.com</a> gave them the real installer and<br>
knowing that the Nmap project wouldn't put malicious code in our<br>
installer. Then the next time the user opens their browser, they<br>
find that their computer is hosed with crappy toolbars, Bing searches,<br>
Microsoft as their home page, and whatever other shenanigans the<br>
software performs! The worst thing is that users will think we (Nmap<br>
Project) did this to them!<br>
<br>
I took and attached a screen shot of the C|Net trojan Nmap installer<br>
in action. Note how they use our registered "Nmap" trademark in big<br>
letters right above the malware "special offer" as if we somehow<br>
endorsed or allowed this. Of course they also violated our trademark<br>
by claiming this download is an Nmap installer when we have nothing to<br>
do with the proprietary trojan installer.<br>
<br>
In addition to the deception and trademark violation, and potential<br>
violation of the Computer Fraud and Abuse Act, this clearly violates<br>
Nmap's copyright. This is exactly why Nmap isn't under the plain GPL.<br>
Our license (<a href="http://nmap.org/book/man-legal.html" target="_blank">http://nmap.org/book/man-legal.html</a>) specifically adds a<br>
clause forbidding software which "integrates/includes/aggregates Nmap<br>
into a proprietary executable installer" unless that software itself<br>
conforms to various GPL requirements (this proprietary C|Net<br>
<a href="http://download.com" target="_blank">download.com</a> software and the toolbar don't). We've long known that<br>
malicious parties might try to distribute a trojan Nmap installer, but<br>
we never thought it would be C|Net's Download.com, which is owned by<br>
CBS! And we never thought Microsoft would be sponsoring this<br>
activity!<br>
<br>
It is worth noting that C|Net's exact schemes vary. Here is a story<br>
about their shenanigans:<br>
<br>
<a href="http://www.extremetech.com/computing/93504-download-com-wraps-downloads-in-bloatware-lies-about-motivations" target="_blank">http://www.extremetech.com/computing/93504-download-com-wraps-downloads-in-bloatware-lies-about-motivations</a><br>
<br>
It is interesting to compare the trojaned VLC screenshot in that<br>
article with the Nmap one I've attached. In that case, the user just<br>
clicks "Next step" to have their machine infected. And they wrote<br>
"SAFE, TRUSTED, AND SPYWARE FREE" in the trojan-VLC title bar. It is<br>
telling that they decided to remove that statement in their newer<br>
trojan installer. In fact, if we UPX-unpack the Trojan CNet<br>
executable and send it to VirusTotal.com, it is detected as malware by<br>
Panda, McAfee, F-Secure, etc:<br>
<br>
<a href="http://bit.ly/cnet-nmap-vt" target="_blank">http://bit.ly/cnet-nmap-vt</a><br>
<br>
According to Download.com's own stats, hundreds of people download the<br>
trojan Nmap installer every week! So the first order of business is<br>
to notify the community so that nobody else falls for this scheme.<br>
Please help spread the word.<br>
<br>
Of course the next step is to go after C|Net until they stop doing<br>
this for ALL of the software they distribute. So far, the most they<br>
have offered is:<br>
<br>
"If you would like to opt out of the Download.com Installer you can<br>
submit a request to <a href="mailto:cnet-installer@cbsinteractive.com">cnet-installer@cbsinteractive.com</a>. All opt-out<br>
requests are carefully reviewed on a case-by-case basis."<br>
<br>
In other words, "we'll violate your trademarks and copyright and<br>
squandering your goodwill until you tell us to stop, and then we'll<br>
consider your request 'on a case-by-case basis' depending on how much<br>
money we make from infecting your users and how scary your legal<br>
threat is.<br>
<br>
F*ck them! If anyone knows a great copyright attorney in the U.S.,<br>
please send me the details or ask them to get in touch with me.<br>
<br>
Also, shame on Microsoft for paying C|Net to trojan open source<br>
software!<br>
<br>
Cheers,<br>
Fyodor<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>
<a href="mailto:tclug-list@mn-linux.org">tclug-list@mn-linux.org</a><br>
<a href="http://mailman.mn-linux.org/mailman/listinfo/tclug-list" target="_blank">http://mailman.mn-linux.org/mailman/listinfo/tclug-list</a><br>
</blockquote></div><br></div></div></div>