Chirp software site hacked

[Mikeam]

So I was upgrading my Chirp software and from their site I had three malware issues and my Spam protection now will not work, my question is has anyone had any issues with the Chirp site??

[Jaay]

Go with RT Systems software. Yes it costs a little, but it just works flawlessly. Chirp is free, sketchy software for radios you don't care if you brick.

[WRUE951]

I run all my download installs through VirusTotal.com and just ran the recent CHIRP download and it is safe..    

[WRUE951]

4 minutes ago, Jaay said:

Go with RT Systems software. Yes it costs a little, but it just works flawlessly. Chirp is free, sketchy software for radios you don't care if you brick.

Never had any issues with CHIRP out of the dozens of radios i've programed.. In fact, personally i prefer CHIRP over RT Systems

[Mikeam]

7 minutes ago, WRUE951 said:

I run all my download installs through VirusTotal.com and just ran the recent CHIRP download and it is safe..    

It was not the software but from the site itself, started with the download from the site and was real quick.. Thanks I will use something else as I program radios for friends.

[WRUE951]

2 minutes ago, Mikeam said:

It was not the software but from the site itself, started with the download from the site and was real quick.. Thanks I will use something else as I program radios for friends.

that test was ran from the downloaded file from the CHIRP website..    Apple and Windows 11 will place your download files in a 'Sandbox' which is a safe place for downloaded files..  from your download directory you would run your download through something like VirusTotal before executing your download.  

[Mikeam]

Thanks I have Windows 10 and my old laptop wont run the 11 version. My software did not catch the error PC Matic as I started the download file but I suspect that Windows 10 update interfered with things as at the time I was running a scan of the system. Too long of a reply but Windows restarted the Laptop before the scan was finished. I have the laptop off of the network and the WIFI shut down so it is contained until I can fix things. I will look at the RT software for the future.

[SteveShannon]

28 minutes ago, Jaay said:

Go with RT Systems software. Yes it costs a little, but it just works flawlessly. Chirp is free, sketchy software for radios you don't care if you brick.

Wrong on both counts. I have several seats of RT Software and there are some very serious bugs in those seats which manipulate linked tables of DMR zones and groups that can completely corrupt a codeplug. Having said that I will continue using RT Systems software, avoiding those features which corrupt memory. 
As far as Chirp goes although it is free, it is no sketchier than any other software I’ve used and the developer is very responsive. I’ll continue using it as well. 
As far as triggering malware detection software I’ve seen false positives on several different CPS programs by various antivirus programs. The reason is heuristic detection. It works by watching for snippets of software that resemble malware. Programs intended to program radios match that pattern, even though they don’t have actual malware embedded. That has been discussed before; it’s not new. 

[Mikeam]

The software download actually has disabled my running a scan on the PC MATIC software for now. The actual Chirp software has always worked fine for me it seems more like a phishing issue as Chirp indicated a update was in order but that did not happen for as soon as I hit the down load button things went sideways until I powered the laptop down. I have to leave town until next Thursday and then I will contact PC Matic and get their support on reinstalling their product and see where it takes me. hanks for all of the reply's. Mike

[SteveShannon]

From the Chirp page:

 

Warnings from AntiVirus and AntiMalware software about CHIRP

Users of CHIRP may experience false positives from their anti-virus/malware software, their browser, etc. Unfortunately, there are not easy solutions to this problem as CHIRP is a volunteer effort without the financial and legal resources to secure agreements with these companies. Further, CHIRP releases fixes and features very often, so that users get the latest stuff as soon as possible. That means the "reputation" for a given version of CHIRP may be lower, the newer it is.

For more information about false positives and AntiVirus in general, see some if these articles:

• What are antivirus false positives?
• How to tell if a virus is actually a false positive
• Still paying for antivirus? Experts say you probably don't need it

Below are some common examples of what you may see, and how to handle them.

Recommendation: Tell your antivirus provider that the file is not a virus! They won't know if you don't tell them and especially if you're paying for their services, make them get it right. If you can report the file as safe, it helps the other users of CHIRP because it decreases the likelihood of them seeing a warning and improves the general "reputation" of the CHIRP project.

 

(The webpage goes on, but due to advertising I didn’t copy it all. If you want to know more go to https://chirpmyradio.com/projects/chirp/wiki/AntiVirusWarnings

[Hoppyjr]

Wrong on both counts. I have several seats of RT Software and there are some very serious bugs in those seats which manipulate linked tables of DMR zones and groups that can completely corrupt a codeplug. Having said that I will continue using RT Systems software, avoiding those features which corrupt memory. 
As far as Chirp goes although it is free, it is no sketchier than any other software I’ve used and the developer is very responsive. I’ll continue using it as well. 
As far as triggering malware detection software I’ve seen false positives on several different CPS programs by various antivirus programs. The reason is heuristic detection. It works by watching for snippets of software that resemble malware. Programs intended to program radios match that pattern, even though they don’t have actual malware embedded. That has been discussed before; it’s not new. 

I’m also a fan of RT Systems software. While there may be occasional bugs, the company does work with the customer to resolve issues promptly when you contact them.

I had a code plug I like for the Icom 2730 and when I picked up the ID-50 I found issues when pushing that code plug to the handheld. RT claims the fields should populate to correct fields, but I didn’t find that to be so. A quick call to RT and a couple revisions over the next day, and problem solved.

Nothing is perfect but I’m a definitely planning on using them moving forward.

[WRUE951]

a topic in Gigaparts forum suggested using virustotal because of the false triggers and apparently it works.  Awhile back I got stupid and decided to try running a KeyGen for latest Autocad..  I almost executed the download but then decided to try running the download through VirusTotal, it lit up..  yea I did end up subscribing to Autocad 360  Ouch!!  

[wayoverthere]

2 hours ago, Hoppyjr said:

I had a code plug I like for the Icom 2730 and when I picked up the ID-50 I found issues when pushing that code plug to the handheld. RT claims the fields should populate to correct fields, but I didn’t find that to be so. A quick call to RT and a couple revisions over the next day, and problem solved.

Good to know...I have RT for my 2730, and I've been eyeing the id50/52 (not that I really need more radios, but the near repeater thing would be nice)

[marcspaz]

 

Here is a little trick I use when I am surfing the internet for anything and any reason... regardless of if you have a MAC or PC, you can create a virtual machine (VM) that cost $0 dollars to run.  I build/built a VM, put my anti-virus and firewall software on it and make it so the network interface can ONLY see the internet.  It can't see my private network at all.  Then, I make a backup (aka snapshot).

 

From there, I do 100% of my internet browsing from there.  When I am done, I shut the VM down and my system automatically restores my VM to its backup state.  I never, ever have to worry about viruses or malware.  If I have a file that I download and want to use, after I scan the file and confirm there are no viruses, I mount an isolated volume and turn off the VM.  One the VM is off (an restored) I mount the isolated volume on my main PC and transfer it to my permanently mounted secondary volume.

 

I know it sounds like a lot of work and a PITA, but once the initial setup is done, the hard work is over and you get pretty fast at the file transfer after you ave done it a few times.  If you want to get fancy, you can save all your favorite site's cookies and login information on the VM, write a script to do the rest of the work, making it take seconds.

[WRUE951]

Unless im missing something, a VM or Vertical Network is not particle for a single user.  We had to use a VN at work where everything was cloud based..  Nothing was installed as a separate operation on our desktops. Everything ran off the VN.. And it worked pretty well too.  It was funny how everyone had their own personal laptops setting next to their desktops so they could run their favorite programs on the side..   Of course those lap tops could not be connected to the network but they did set up  separate WiFI for Internet access.   

[marcspaz]

3 minutes ago, WRUE951 said:

Unless im missing something, a VM or Vertical Network is not particle for a single user.  We had to use a VN at work where everything was cloud based..  Nothing was installed as a separate operation on our desktops. Everything ran off the VN.. And it worked pretty well too.  It was funny how everyone had their own personal laptops setting next to their desktops so they could run their favorite programs on the side..   Of course those lap tops could not be connected to the network but they did set up  separate WiFI for Internet access.   

 

I'm referencing a virtual machine, not Vertical Network.  You can create a virtual computer in a local hypervisor on your PC or MAC, sharing your storage, RAM and CPU.

Here is a screen grab from my PC with the VM shown.

 

[WRUE951]

i'm just trying to wrap my hands around how a VM would benefit most everyday home computer users.  If just for testing/expermiting with software, Windows 11 and IOS have sandboxes for that purpose..   I can see for business pourpose on a larger scale how VM and VN is a huge benefit.   I run both Windows 11 and Linux on my Windows box through a separate boot.   Can you actually run both without rebooting with a VM?  Now that would be cool if you could, that might get my fancy.    

[SteveShannon]

10 minutes ago, WRUE951 said:

i'm just trying to wrap my hands around how a VM would benefit most everyday home computer users.  If just for testing/expermiting with software, Windows 11 and IOS have sandboxes for that purpose..   I can see for business pourpose on a larger scale how VM and VN is a huge benefit.   I run both Windows 11 and Linux on my Windows box through a separate boot.   Can you actually run both without rebooting with a VM?  Now that would be cool if you could, that might get my fancy.    

If you run something that infects your VM with malware you just blow it away and create a new one. 

[marcspaz]

2 hours ago, WRUE951 said:

i'm just trying to wrap my hands around how a VM would benefit most everyday home computer users.  If just for testing/expermiting with software, Windows 11 and IOS have sandboxes for that purpose..   I can see for business pourpose on a larger scale how VM and VN is a huge benefit.   I run both Windows 11 and Linux on my Windows box through a separate boot.   Can you actually run both without rebooting with a VM?  Now that would be cool if you could, that might get my fancy.    

 

 

Dual-boot is a blast, for sure.  I used to run a Windows / Ubuntu dual boot, which was helpful for doing design work for endpoint software and scripts.

 

With an OS-based hypervisor, you can run as many simultaneous virtual machines as your available resources allow, with whatever OS you want, without ever having to shutdown the host OS.  Also, as long as resources are managed correctly, none of the other VM's should ever impact performance or availability of the host OS nor any of the other VM's.  The only constraint is, if you shutdown or reboot your host OS (the main operating system instance on the computer), all of the guest virtual machines will also be restarted and/or shutdown.

 

With automatic dynamic resource allocation, I can run 7 to 10 guest virtual machines on my PC and not miss a beat.

The biggest benefit to the typical home user is complete isolation from the internet.  So there is no risk of virus or malware attacks, data loss or theft, or privacy violations (when combined with VPN service, anti-virus software and some common sense about what not to put on the VM.)  It is definitely a bit advanced for the average home user, but there are a ton of resources online that can provide step-by-step instructions.  And I know that since you are able to figure out a dual-boot system, which is much harder to accomplish IMHO, you should have no problem getting an OS-based Hypervisor setup.

[Hoppyjr]

Good to know...I have RT for my 2730, and I've been eyeing the id50/52 (not that I really need more radios, but the near repeater thing would be nice)

The latest update fixed it for me, so everything moved over nicely. Now when I update it’s much easier for both.

[Reloader762]

I've been running Linux Mint since Windows XP went dark, I install CHIRP on my machine back when I bought my first radio, and it's never given me any problems. On the occasion, I do have to use windows to program radios that CHIRP does not support, which is currently only two. I use my wife's Windows 11 PC I put together for her a couple of months ago when her Windows 10 PC HD died and use the radios factory software. 

Installing the new version of CHIRP on my Linux boxes, once the initial setup was completed, just requires me to do a terminal command of pip install.  Then copy and past the newest py3-none-any.whl version in the same line and hit enter. It deletes the old version and installs the new version.

[tcp2525]

13 hours ago, marcspaz said:

 

Here is a little trick I use when I am surfing the internet for anything and any reason... regardless of if you have a MAC or PC, you can create a virtual machine (VM) that cost $0 dollars to run.  I build/built a VM, put my anti-virus and firewall software on it and make it so the network interface can ONLY see the internet.  It can't see my private network at all.  Then, I make a backup (aka snapshot).

 

From there, I do 100% of my internet browsing from there.  When I am done, I shut the VM down and my system automatically restores my VM to its backup state.  I never, ever have to worry about viruses or malware.  If I have a file that I download and want to use, after I scan the file and confirm there are no viruses, I mount an isolated volume and turn off the VM.  One the VM is off (an restored) I mount the isolated volume on my main PC and transfer it to my permanently mounted secondary volume.

 

I know it sounds like a lot of work and a PITA, but once the initial setup is done, the hard work is over and you get pretty fast at the file transfer after you ave done it a few times.  If you want to get fancy, you can save all your favorite site's cookies and login information on the VM, write a script to do the rest of the work, making it take seconds.

It's refreshing to actually see someone else on this forum taking advantage of VMs. I've been doing it for many years and it's the only way for general surfing as you do, but the main benefit is it's the best way organize and use all your radio programming software. If you're using some of that antique Motorola software that will only work on 32-bit you can load Widows 7 or Windows 10 VM and it just works.

The best part of using VMs is when you are installing new software, you simply take a snapshop before you install it and if things go south, all you have to do is take one mouse click and you're back on the previous and clean version of the OS.

For the people that want to experiment with VMs, you can download and legally use VMware for free as a personal user.

[tcp2525]

10 hours ago, SteveShannon said:

If you run something that infects your VM with malware you just blow it away and create a new one. 

Way too much work and totally unnecessary. Just use the snapshot feature and take regular snapshots and mouse click once to return to the clean version before you got infected. And get into the habit of taking a snapshot prior to installing software you downloaded from the net and you'll waste time again.

[tcp2525]

7 hours ago, Hoppyjr said:

The latest update fixed it for me, so everything moved over nicely. Now when I update it’s much easier for both.

The one and only time I ever had problems with RT is when they had a buggy update for my Icom IC-7610. I e-mailed them and explained what happened and they got back to me in in a couple hours and told me to download the update again an it will fix the problem. They admitted to the mistake and apologized as it would have affected everyone with that radio. Great company to deal with! And it will be the best $25 you ever spent.

[WRUE951]

12 hours ago, marcspaz said:

 

With an OS-based hypervisor, you can run as many simultaneous virtual machines as your available resources allow

I've got it now.. the VM is really no different than running a Sandbox which i do.   The only problem with the Sandbox, you have to reload it every time you shut it down.  It sounds like the VM is the same but since you can set up several you leave them running and toggle as needed..  The Sandbox works for me as i don't venture to HTML sites that would put me in danger...  When i was doing the AutoCad KeyGen thing i did run all that in the Sandbox along with my browser for VirusTotal..  Before i executed the KeyGen, VirusTotal lit up like a Christmas Tree and interestingly the KeyGen came from a trusted source..  I also run any open source software through the sandbox and check it before i actually install on my machine..  I had originally thought  Sandbox was not available with Windows 10 but learned different last night, it is available under Windows 10 Professional.   The VM is interesting and i'll end up playing with it..   Thanks for the info.