Pidgin: Open Source and Hidden Threat in One Plugin

[Friend]

Users did not even suspect that their actions were being tracked in real time.

An alarming situation has arisen in the community of users of the multi-protocol messenger Pidgin: a malicious component has been added to the list of third-party plugins. A plugin called "ss-otr" appeared in the list of available for download on July 6 and only on August 16 a message was received from a user with the nickname "0xFFFC0000" that he had found a built-in keylogger in the plugin - a program that records keystrokes. Moreover, it became known that the plugin also sent screenshots to third parties.

After the developers received this information, the plugin was immediately removed from the list of available downloads, and the Pidgin team began its own investigation. On August 22, a security specialist @johnnyxmas confirmed the presence of a keylogger in the plugin. Those who have installed "ss-otr" are advised to remove it immediately to avoid personal information leaks.

It also became known that when added to the list for download, the attacker did not provide the source code of the plugin, and users were offered to download only binary files. This is an obvious flaw on the part of the platform. In the future, Pidgin plans to tighten the requirements for moderation of plugins: all third-party plugins will have to have a license with the approval of the Open Source Initiative and undergo security checks.

Pidgin is a messaging program that allows you to use several different communication protocols simultaneously in a single interface. It supports networks such as XMPP, IRC, Gadu-Gadu, and more. Additionally, the functionality of the program can be expanded with the help of the above-mentioned plugins.

Pidgin is free and ad-free. All source code of the program is open and available for modification under the GNU General Public License, which allows users to adapt it to their needs and share improvements with the community. Pidgin is driven by user input, and regular updates include fixes to issues found and new features suggested by the community.

Source

 

[Friend]

Pidgin is a modular instant messaging client for GNU/Linux, Windows, and BSD. It is compatible out of the box with Jabber/XMPP, Bonjour, Gadu-Gadu, IRC, Novell GroupWise Messenger, Lotus Sametime, SILC, SIMPLE, and Zephyr.

Pidgin has removed the "ScreenShareOTR" plugin from its official list of third-party plugins after it was found to be used to install keyloggers, information stealers, and malware: https://www.bleepingcomputer.com/ne...pidgin-messengers-official-plugin-repository/

Greetings everyone. It is with great regret that I am writing this post. The ss-otr plugin was added to the list of third-party plugins on July 6. On August 16, we received a message from 0xFFFC0000 that the plugin contains a keylogger and shares screenshots with unwanted individuals.

We immediately removed the plugin from the list and began to investigate. On August 22, Johnny Hmas was able to confirm the presence of a keylogger.

If you accidentally install this plugin, uninstall it immediately.... Going forward, we will require that all plugins we reference have an OSI Approved Open Source License and that some level of plugin security testing be done for users.

- according to Pidgin's blog: https://pidgin.im/posts/2024-08-malicious-plugin/

A few days ago, Pidgin Instant Messenger published a notification about a malicious plugin (ScreenShareOTR) found in the list of third-party plugins. ESETResearch has investigated these plugins and confirms that they indeed contain malicious code...

- writes Eset Research: https://x.com/ESETresearch/status/1828114327976415445

ESET claims that the malicious plugin was set up to infect unsuspecting users with the DarkGate malware.

According to ESET, the plug-in installer is signed with a valid digital certificate issued by INTERREX - SP. Z O.O., a legitimate Polish company. The payload to be downloaded is either PowerShell scripts or DarkGate malware, which is also signed with an Interrex certificate. The same malicious server that has already been removed contained additional plugins named OMEMO, Pidgin Paranoia, Master Password, Window Merge, and HTTP File Upload.

These plugins were almost certainly also supplied by DarkGate, indicating that ScreenShareOTR was only a small part of a larger campaign.

- writes Bleeping.

Pidgin has not publicly released download statistics for ss-otr, so the exact number of victims is unknown. From now on, Pidgin will only approve third-party plugins that have the OSI Approved Open Source License, allowing for a thorough examination of their code and internal functionality.