DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org CAD9D3858C53
Message-ID: <b9aa82b2-f9e8-db8e-de79-1de03ab3884c@Shaw.ca>
Date: Tue, 22 Aug 2023 15:54:18 -0600
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.14.0
Subject: Re: Virus Total scan
Content-Language: en-CA
To: cygwin@cygwin.com
References: <LO3P123MB334069FD42052E97C5917179811FA@LO3P123MB3340.GBRP123.PROD.OUTLOOK.COM>
Organization: Inglis
In-Reply-To: <LO3P123MB334069FD42052E97C5917179811FA@LO3P123MB3340.GBRP123.PROD.OUTLOOK.COM>
Precedence: list
From: Brian Inglis via Cygwin <cygwin@cygwin.com>
Reply-To: cygwin@cygwin.com
Cc: Brian Inglis <Brian.Inglis@Shaw.ca>, Dom Woods - BGS <domw@bgs.ac.uk>
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Errors-To: cygwin-bounces+archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>
Content-Transfer-Encoding: 8bit

On 2023-08-22 08:12, Dom Woods - BGS via Cygwin wrote:
> I scanned your application through Virus Total as per our company policy and
noticed that the installation process calls out to a suspicious Microsoft IP
13.107.4.50, this ip has been flagged by 8 vendors as malicious, I get varying
responses for what it is used for (an os updater or a file distributer) and
wanted to ask what does Cygwin use it for? I can't seem to contact it with
nslookup or ping it and Virus Total says that it gives a 'status 400' results so
it might not be in use anymore anyway but just wanted to check.
> 
> Here is your Virus Total graph results: https://www.virustotal.com/graph/6bad4555154b3b348d1bfb633a2e9d6086aa46e36952f456a434ecef5b0010e0
> Here is the scan of the IP address' results: https://www.virustotal.com/gui/url/3397a00da1c5aa448611892c12d38fee37fcd60321720a6e242cb0167e381901/detection

Can not see VT graph without registering - please attach if relevant.

Which Cygwin application did you scan, and how did you scan it?
Cygwin has thousands of packages with many executables in each, plus thousands 
of libraries which may have many DLLs, all developed or packaged by volunteers.

Did you get the application from the cygwin.com site, or install it using the 
installer downloaded from the site home page URL, accessing an official Cygwin 
mirror?
Any other process is entirely at your own risk and may contain malware!

It is extremely unlikely any Cygwin package attampted to access any MS address 
or resources, as the newlib libc is BSD or compatible licensed, and Cygwin is 
GPL or compatible licensed, so packages have to be limited in what they are 
allowed to do on networks during install.

Your company may have filters intercepting library and system DLLs, and much 
else on the internet, and may proxy cache downloads, which could interfere with 
anything else you do.
It would be advisable to ask your network security folks about such anomalous 
results.

-- 
Take care. Thanks, Brian Inglis              Calgary, Alberta, Canada

La perfection est atteinte                   Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter  not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer     but when there is no more to cut
                                 -- Antoine de Saint-Exupéry

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple