Bittorrent Blocked By Norton

[Ophelia Gurin]

Malwarebytesalso detected and reported a programme called Muse.Service.exe as contacting a compromised web site. I've pasted the details below. As a temporary measure, I've uninstalled Musehub and Musescore.

The service was answered right above your post, it is used to run the auto updates.

The unknown IPs (not necessarily malicious) are likely those from other users, turn of the "community acceleration" setting from MuseHub if you do not wish to make use of it.

I get that it's used to run auto updates, but I feel like it's expected that when you "exit" a program, it should actually exit it. I feel like this is how most programs work in general, even those with auto updates.

Especially if a non-technical person is trying out Musescore and downloaded Muse Hub, I don't think it's a good look for Muse when their ISP (Xfinity in my case, as it gave me notifications via their app) to be telling them that these outside IPs are trying to access my computer.

I also feel that no non-technical user would enable the peer-to-peer function if it is disabled by default. But I think an approach as was used by Telemetry in 3.x could satisfy both: just ask it on first launch.

But the main concern is not the torrent stuff.

The biggest security problem here is that this service runs with a privileged account (admin, root).

I am surprised that nobody sees this as a problem.

Basically, the Muse group can install anything they want on your computers, without you knowing about it.

I definitely see it as a problem. MuseScore is slowly becoming proprietary software, through the introduction of third-party proprietary tools that "solve" problems introduced by regressions in MuseScore. It may be overly cynical of me to point this out, but it really looks like a way to circumvent GNU GPL.

The whole concept of software checking for updates is absurd to any Linux user. We have package managers that do that for us. But this means less control for the software proprietors. Having such "update" software closed source and running with root privileges is a huge red flag. And you're incentivised into using this software (which would in any other circumstance rightly be described as malware) by getting a shiny present like MuseSounds: "oh no, you can't download this soundfont unless you give full control of your system to our proprietary updater". In what alternate reality does that make any sense? If this is not Defective-By-Design, what is?

If you allow a third party you know nothing about (as i understand it: a 'mailbox' company based in Cyprus, but located in Kaliningrad, Russia) to have root access to your system: this is bad security.

Especially because there is really no need to have this running as root.

Note you can unmask the service to bring it back to life. Masking prevents it from restarting at boot time.

Perhaps the developers can consider security a bit closer. Musescore is great, but this makes it dangerous.

As mentioned numerous times, issues with Muse Hub are discussed on their support site at musehub.zendesk.com. Muse Hub is an installer and it installs files into folders like /usr/lib so obviously needs to have appropriate privileges - it should't be a security problem at all. But out of an abundance of caution, alternative solutions are being investigated.

This is just a lie. The right way to do this is to at install time make a single folder in /usr/lib that doesn't require root privileges to add files and folders in and then run the background service without root permissions which will mean that it can only mess around with it's own folder rather than being able to mess with arbitrary system files. Making a torrent client run as root in the background is a massive security hole you're opening in your system and the fact that no one at MuseHub has acknowledged that makes me incredibly skeptical that the team is competent.

There is no need to assume at this moment that MuseHub is malware - there is no indication that it is, nor that it isn't. We simply don't know. Nor do we know the intentions of the team. They may very well act in good faith.

But that is not the point. MuseHub is just as dangerous as if it were malware. And the risk of its bittorrent function being hacked, a real risk that others have already pointed out, is not even the greatest danger.

Let me just sketch one scenario, entirely possible. Assume someone manages to replace the mother copy of MuseHub on the MuseHub server with a version that does contain malware. Let's say it's a ransomware, that encrypts all files on your computer and asks you to donate, say, $300 to get the decryption key.

Thanks to unchecked installation that malware would be silently installed on all computers receiving a copy. Thanks to bittorrent, distribution of that version would be lightning fast. Millions of computers would be infected overnight. How many users would grudgingly pay to have their files restored? One in ten? One in hundred? Think of the numbers involved.

Note that it is not necessary to suspect the MuseHub company. A would-be attacker could hack the MuseHub server. Or they could bribe an employee. A determined attacker with enough resources can get in almost everywhere. And money would not be a problem with this kind of payoff.

I advise everybody who has MuseHub running to uninstall it immediately, and then to verify that it is indeed gone. And hope and pray it has left no backdoors. If you want to be really safe, reinstall your operation system.

This doomsday scenario is entirely predicated on the notion that some criminal would be able to replace the download package on the server. And you're right, of course it's theoretically possible. just as they could replace the download package for any other program in the world. And yet this is virtually never how malware is distributed, because there are so many better ways. There isn't anything particularly unusual about Muse Hub as installers go, except the torrent bit. So, If you're concerned that someone might pull this off and use the torrent technology to spread the malware, no need to uninstall Muse Hub - simply disable the automatic updates and/or community acceleration. if you're feeling extra paranoid, you could shut down the service entirely. But thinking that merely having it installed is somehow inviting catastrophe - now that's naive.

There is something very unusual about MuseHub. It runs with root privileges as a background task. That is precisely the thing that makes it dangerous. Pretty much every other installer will ask for root privileges once and then use those privileges to set up a folder for a non root process to manage. MuseHub by contrast holds on to its ability to do arbitrarily bad things to your system for ever.

You (Marc Sabatella) are misinformed about third party installers. Those do not have root permissions, instead they normally delegate the install task to a system installer. Which would be the proper way for MuseHub too.

Those installers do have root permission and are usually part of the operating system, and with good reason. They are developed by teams with intimate knowledge of their operating system, and of the latest attack routes on its safety. They are equipped with all kinds of safeguards to minimize the risk of installing malware. With MuseHub there is no such safeguard.

That's a completely irrelevant distinction. Whether it asks for root access or not, how many times does the average person say "no"? If you download software, it asks for permission to install, and you normally say yes - that's the whole reason you downloaded the program.

So, we're hypothesizing a world in which someone both determined and clever enough to pull the rest of this off is somehow also short-sighted enough to not see the many easy ways around that, and this therefore stops them?

Indeed, just saying what you're saying doesn't make it true - if you want to convince anyone of any of this, you'll need to respond with meaningful words and actually address the points I've made. Until then, no point in continuing the discussion.

If this is so normal, why does no one else do things this way? (seriously. Name one other program that uses this install process) I understand you don't think there's anything wrong here, and to me that's probably the scariest part. Musescore is asking for root permissions on my computer to install software in a non-standard way, and the developers don't see this a potential security issue, even when the avenue of attack has been repeatedly pointed out.

In any case, I'm not on the team developing Muse Hub, and if I were, I might have chosen to do things differently. And I'd be perfectly happy to see them make some changes to address these concerns. I'm merely pointing out that it's irresponsible to be scaring away users by drumming up fear of an incredibly unlikely event - one that, if it were to happen, would be much more likely to occur through entirely different means that don't involve Muse Hub at all. It's just harmful to the MuseScore community to be spreading such misinformation, and my goal here it to help users, not harm them.

What is irresponsible and unacceptable is to have a closed source program, running as root, when it doesn't need to run as root. On Linux, I have a package manager which installs stuff. I don't need some proprietary program installing stuff on my computer. If you wanted to give me these sounds for free, you would have given them for free, not require that I give you control over my computer.

A certain David from MuseHub then said soothing words. He agreed to an open discussion on the issue. In the beginning it went fine. But once a well argued case was made to drop the root access, citing warnings from both Apple and Microsoft, and again very respectfully, communication stopped and nothing was heard from David again.

The vast majority of programs ever written in the history of computing are closed source. If we took the position that closed source = no one should ever trust it, then we might as well just go back to abacuses.

3a8082e126