Author Topic: Chilling effects on qBitTorrent...  (Read 3727 times)

Switeck

  • Forum addict
  • ****
  • Posts: 1520
  • Karma: +96/-0
    • View Profile
Chilling effects on qBitTorrent...
« on: July 23, 2017, 04:36:38 AM »
These represent a threat to all of us:
https://www.reddit.com/r/torrents/comments/6odsoa/win_blocking_qb_torrent_installbs_or_legit/
AV false-flagging open source BitTorrent software as malware is nothing new, but it still causes a chilling effect that scares away a LOT of people.
I've seen it a few times in the last couple years, and I don't know yet whether to blame it on a campaign to shut qBT down, sheer incompetence, or both.

https://www.reddit.com/r/torrents/comments/6obxsa/google_bans_bittorrent/
Google arbitrarily refusing to allow ads and ad revenue for BitTorrent software projects is more severe.

"Witness, the decline of society."
Where free speech and free expression ...that isn't liked by others ...can get shut down silently through back-door means.

Peter

  • Administrator
  • Forum addict
  • *****
  • Posts: 1614
  • Karma: +37/-2
    • View Profile
Re: Chilling effects on qBitTorrent...
« Reply #1 on: July 23, 2017, 08:14:16 AM »
The smart screen thing is just incompetence in my opinion. We have seen so many blunders since 10 came out...
This is the first Windows ever that is capable of breaking itself after a while.*

Smart screen has blocked like 90% of all my software installation when I forgot to turn it off on a new install. Will check if there is a lot for or something that would tell the reason why it blocked qBittorrent.

(Btw just check out Windows 10 S. Windows RT all over the place again.)


* It keeps updating itself but for some reason the drivers always lag behind. Lucky for me three computer was not old and I was able to update drivers by hand but not everyone can do that either. (I mean just try to update you Intel vga driver on a laptop. Good luck.)
« Last Edit: July 23, 2017, 08:16:52 AM by Peter »
- qBittorrent team - server and forum administrator.
- Hungarian translation reviewer/moderator (+ translator).

Join the official qBittorrent Discord!
https://discord.gg/ma66Vv4

Switeck

  • Forum addict
  • ****
  • Posts: 1520
  • Karma: +96/-0
    • View Profile
Re: Chilling effects on qBitTorrent...
« Reply #2 on: July 23, 2017, 06:14:48 PM »
It is little comfort that qBitTorrent's popularity suffers due to other software programmers' incompetence rather than its own real problems, because this is a real and worsening problem.

...But this is not the first instance of qBitTorrent being false-flagged as malware, which seems to happen often:
https://qbforums.shiki.hu/index.php/topic,2030.0.html
https://qbforums.shiki.hu/index.php/topic,2136.0.html
https://qbforums.shiki.hu/index.php/topic,3982.msg21804.html#msg21804
https://qbforums.shiki.hu/index.php/topic,4191.0.html
https://qbforums.shiki.hu/index.php/topic,4192.0.html
https://qbforums.shiki.hu/index.php/topic,4206.0.html
https://qbforums.shiki.hu/index.php/topic,4393.0.html
https://qbforums.shiki.hu/index.php/topic,4486.0.html
https://qbforums.shiki.hu/index.php/topic,4623.msg24135.html#msg24135
https://qbforums.shiki.hu/index.php/topic,4708.0.html
https://qbforums.shiki.hu/index.php/topic,4734.0.html
https://qbforums.shiki.hu/index.php/topic,4875.0.html
https://qbforums.shiki.hu/index.php/topic,4986.0.html
(This is only a partial list I got from a single search of the forum.)

Some of them claim to match some part of qBitTorrent's compressed executable installer's code with a particular malware "signature" -- often a snippet of bytes matching a known malware program's hostile code.
However...
Data that has been obfuscated or compressed should never be used as a candidate for a signature. (emphasis mine)

And if it's because many malware software use the same executable compression software...because it's popular...guilt by association is an even poorer means of detecting hostile software.

Many antivirus/antimalware products also claim to make the use of heuristics to detect malware by their behavior.
If that is how they claim to find malware in qBitTorrent...without revealing any of the criteria used to come to that conclusion -- such as "uses obfuscation or encryption to hide network traffic", "makes massed quantities of network connections", "encrypted executable of unknown nature", etc. ...You just have to wonder what they are trying to protect -- their users or their trade secrets, because their users won't have enough details to be able to react in an informed manner.

While likely not a coordinated effort, this could still be an unwitting conspiracy of dumbasses, bumbling their way into inadvertently discrediting and defaming qBitTorrent and its makers.

Many people take on faith that anti-virus/anti-malware software by "big name" companies in the industry is telling them the truth -- this makes their false positives immensely more damaging than if some random blogger claims something without proof.

But as I've seen 25 years of epic failures by "security" software and I've had to remove zero-day malware manually because dedicated anti-whatever software couldn't even detect it ...I do not trust them to not screw computers AND users over.

When in doubt, get a second opinion!
I highly recommend Process Explorer, Process Monitor, and TCP View (for Windows OSes) and even Windows built-in tools such as Task Manager and Netstat for finding unwanted software/network activity on a computer.