Latest Signal (.apk) direct download reporting Malware??

Sip_slowly_buddy

the latest Direct download of "Signal messeger" app (.apk) [version 6.35.4]
After scanning online via "Virustotal", its reporting :

TrendMicro-HouseCall
TROJ_GEN.R002V01IT23

And i just checked again, the newer version [6.35.5], same thing?

This was Never dispayed before on any previous versions !

im assuming, 1 or more of the [developers/ their workstations] are possibly Compromised, maybe even their github repo ??

odd....got the same report from a few other unrelated app (.apks) on F-droid.

other8026

Sip_slowly_buddy where did you download the apk from?

bayerelm

Can confirm. Just downloaded the latest apk directly from signal.org, virurstotal reports a trojan.

rufus

https://github.com/signalapp/Signal-Android/issues/13219

By checking old versions one-by-one found out the first version that was flagged as malicious. That's 5.19.4 from August, 6th, 2021. Since then every Signal version is shown as malicious by TrendMicro-HouseCall

GrapheneLover

If it turned out to be indeed Malware that would be huge and we will begin to hear a lot of people getting compromised from it, has always been a fear of mine. I hope that its just a false positive.

rufus

...since 2021... and nobody did care since these two years til now?
keep calm
Real dangerous malware will not be recognised by virustotal.

Sip_slowly_buddy

Here it is
https://signal.org/android/apk/

justAnotherGraphenInTheWall

Can you verify that the signing certificate of your downloaded APK matches SHA256 fingerprint from Signal site?

Sip_slowly_buddy

verifying signature does NOT prove safe an App, if the problem is within their Development division !

Possible internal problem via Compromise:
[1] Shady Personnel, auditable records of WHO submitted What Code, and exeactly When.
[2] Hardware firmware, pwned hard disk, or using MSI motherboards with know leaked fimware keys.
[3] Operating System used, are they using a security-harded Linux OS exclusively for this sensitive work?
[4] Third party software Supply Chain breach, intentional or not.
[5] Using a Bluetooth keyboard or bluetooth mouse, thats an easy attack vector.
[6] Using a fun new Ai based webcam, can do much more havoc that a random infected flash drive, but instead its covertly Persitent for months-to-years.
[7] Lookup video info on USB accessory cables in circulation, "HIDX SteathLink".

matchboxbananasynergy

This recently happened with Tor Browser and Windows Defender incorrectly detecting it as malware. Of course, as one would expect, it turned out to be a false positive. I suspect that the same will be the case here.

Instead of panic and wild theories here and elsewhere, I advise waiting for the Signal team to respond.

Bypass7212

Someone told me today there was a zeroday with the link previews. Disable to mitigate is what the dev told me.

matchboxbananasynergy

Bypass7212 Making claims like this without proof is counterproductive.

If this thread ends up becoming a hub for FUD and misinformation, we'll have to lock it.

de0u

Bypass7212 Someone told me today there was a zeroday with the link previews.

There may or may not be, but it is not responsible to amplify claims like that without providing some citation or proof: for example, the name of the hypothetical developer, or a CVE number, or a Signal issue number.

Meanwhile, by its nature, VirusTotal is extremely unlikely to report "a zeroday with link previews" as a malware hit.

Signal may or may not contain "a zeroday with link previews". Signal may or may not contain scannable malware. But meanwhile the high-probability scenario is that VirusTotal is just wrong (that happens all the time).

An issue has already been filed with Signal, and I think that issue would be the most appropriate place for further discussion.

Bypass7212

Yes, I totally understand and that makes sense. I was not trying to contribute to the misinformation or rumor mill but I can see how it was interpreted and will be more specific in the future. I could not find anything that substantiated that claim; only time will tell.

PintOfGuinness

Anyone know if any additional information has been made available about that potential malware report in the APK installer?

I contacted Signal Support earlier this week about this, and although they were quick to respond, they did not address the VirusTotal report. Instead, sometime last week, other users had been reporting that Google Play Protect was blocking Signal installs, which has now been corrected. This is the response received from Signal:

Thanks for reporting this.

This warning was shown in error due to a bug specific to Google Play. This message was not related to Signal.

Google has resolved the issue. You should now be able to download and install Signal without further problems.

If you need additional help, please let us know.

I would assume that, regarding the potential malware report, no news is good news?