In association with heise online

06 December 2011, 15:37 accused of wrapping nmap in a "trojan installer"

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit installer screenshot
Zoom's installer has a "special offer", just click accept
The author of the network scanner Nmap has accused CBS Interactive and CNET's of wrapping the open source application in a proprietary installer. is a popular download site for both open source and proprietary applications. In the past, it has offered untouched downloads of applications from its servers, but over the last six months that has changed. According to Gordon "Fyodor" Lyon, who details his issues in a posting to the Nmap Hackers mailing list, the installer "does things like installing sketchy 'StartNow' toolbar", changes the default search engine to Bing and sets the home page to Microsoft's MSN.

Lyon describes this as the actions of a "trojan installer" and backs the claim up by showing that if the installer is unpacked and sent to VirusTotal it reports that ten of 42 scanners identify it as a trojan or adware installer. He also points out that the Nmap trademark is displayed next to offers to install the software, "as if we somehow endorsed or allowed this". He notes that this also breaks the licence of Nmap by wrapping the program in a proprietary installation program. Nmap is, he notes, not under the plain GPL but under an enhanced version which specifically prohibits aggregation into a proprietary executable installer. says its scheme is simple for developers to opt-out of: those that object to their software being bundled should email; the opt out is not automatic though. says "all opt-out requests are carefully reviewed on a case by case basis". Lyon is seeking a US copyright attorney and is looking to spread word to the hundreds of users who download Nmap from every week, "so that nobody else falls for this scheme".

This is not the first time the operation of CBS's site has been called into question. In August, ExtremeTech noted similar behaviour with the VLC media player. The installer software has been rolled out since July 2011 according to an FAQ from CBS. In a statement in October, Sean Murphy, VP, said "we understand that the model currently in market is not optimized for all of the community", but that "it is our #1 priority to evolve the Installer model so that developers benefit in a host of meaningful ways, and have direct influence over how users experience it."


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit