Why are many of the GNS3 packages scanning as malicious?

[shawn-ev]

As part of my org's security policies, we install all new applications onto a secured VM with our security service, ThreatLocker, who dissects the application into its components, runs malware scans, and references numerous security vendor services -- based on the hash of the file -- to determine if the application is safe.

The report for GNS3 came back with a surprising number of malicious threats. I originally posted this in the GNS3 forums and was advised by the moderator to post here. Yes, I downloaded the latest GNS3 from the GNS3 download page.

Here are the VirusTotal scan results for all packages in the application. GNS3 Scan Results.xlsx

Looking at just the results for the Putty module, we can see that 1 vendor reports it as malicious.

As you dig deeper into the report, you find this Putty file has been reported numerous times in the past

Click on putty.exe on the highlighted line and it shows all the security vendors who've tagged this file as malicious.

Similar information can be found for all the components listed in the Scan Results. We really want to adopt it for network design and were perplexed by these results as GNS3 is known as legitimate software. Why is GNS3 showing as malicious to so many malware scanners? Thank you for your time!

[eantowne]

I can see how this may look like GNS3 is riddled with malicious software. However, I think you may be applying some interpretation here without context. Are you a security engineer, or has a security engineer examined this report?

I would like to point out that "suspicious" result does not mean that the given file IS actually malware or infected with malware. Also, I am by no means stating that you should implicitly trust ANY software, to include an OS (you are using MS Windows, and there is plenty of data that show that the entire Windows platform could be classified as malware).

There are alternatives to adopting the use of GNS3 without being exposed to all of this reported "malicious" software.

1. Install GNS3 server on an Ubuntu server and use the Web-UI. None of what you report is included in the Linux installation for the GNS3 Server.

2. What are the results if you install only the GNS3 software during the install, without the additional tools? (this assumes you are running GNS3 server on a separate system)
   HAXM is not required in just about every situation.
   Putty can be installed separately or you can just use telnet/ssh from MS or whatever client you wish.
   NPCAP can be installed separately, and is only needed if you are capturing packets on the machine that the client is running on (I believe)
   Virt-Viewer is only required if you intend to use SPICE as the "remote" desktop protocol, it is not required

3. What are the results if you install these additional software separately as packages from the original developer, without GNS3?

The GNS3 development team is VERY small. They repackage and bundle tools and utilities from other projects to provide certain enhancements and capabilities to GNS3, but most of them are not required. They do not have the resources to perform deep security analysis of everything they bundle. Should they? I do not know, and only they can answer that. However you do have options to use GNS3 that might not present as much "risk"

[eantowne]

Ok, I initially just wanted to make sure there was context and correct interpretation of the results. Did not take it as you disparaging or anything. It can be hard to determine a persons knowledge level from an initial post ;)

Continuing the putty example:
There was a version of putty a few years back that was modified specifically for GNS3, I am not sure that it is still being used. I believe what is being used now is the putty executable that is installed/bundled with Solar-Putty (a free product from SolarWinds). GNS3 bundles some SolarWinds stuff with the Windows GNS3 client installed to help fund the project. SolarWinds has most likely compiled their own version of putty to be included with "SolarPutty" in order to provide whatever features/capabilities they want.
It is important to note that in the last year there have been some very malicious versions of putty floating around

The fact that the majority of the results for any of these files are only being reported by one scan engine as "suspicious" is a pretty good indicator of there relatively safe nature. Keep in mind that some of the results you are viewing when digging deeper are related reports (for instance puttty.exe (notice the 3 "t"s)), but not necessarily for the exact same file. These engines will compare by hash, but they can also correlate relations based on binary analysis.

The one that caught me really off guard was the hit for the HAXM files.

I would definitely recommend doing an install without the bundled tools. Conduct another scan, then add in whatever other tools you may need like wireshark, secureCRT/Putty whatever you may need, but install the packages from the actual maintainers and see the result.

Based on the environment you are describing, I would recommend using the Linux version of GNS3 (not just because it is my preference to always use Linux), both client and server. This would also allow you to use the Web-UI on Windows platforms, without being overly considered with a bunch of compliance requirements (or at least less). With that being said, I have not seen any kind of vulnerability scanning conducted on the Linux implementation, nor the Web-UI, so your mileage may vary. I would assume that there will be at least less issues with the Linux variant. Also keep in mind for Linux, the only "Official" package is the Ubuntu PPA and the PIP install. So any packages you find in any given distro's repository are not "official" and are maintained/compiled by the distro maintainers or some other third party.

[shawn-ev]

Thank you for the explanation. I apologize for the delay in replying, I had higher-priority tasking over the weekend from the REAL boss, in the form of honey-do lists ;)

Everything you said made sense. I too prefer Linux over every other OS. I came to this job from a Linux/Unix shop. I'll check the base Ubuntu install and add the components I need as required. At least I won't have to pay for another Windoze license for the VM.

Thank you for your time and explanation. Have a Merry Christmas and a Happy New Year.

[eantowne]

Please update this thread with the results of your continued testing. I am very curious. Might even have to spin up a sandbox environment for my own testing.

[spikefishjohn]

Please understand, I am not trying to disparage GNS3 in any way, and I am not saying that these components ARE, IN FACT malicious (we all know false positives happen all the time). We are a start-up in the Energy sector. We are subject to NERC and FERC requirements for the Energy industry, along with SOX and SOC compliance requirements because we went public in February of this year. We want to use GNS3, and I am performing my due diligence to ensure we are not introducing any malware into our systems. I am the Lead Systems Engineer. This report was compiled and reviewed by security engineers who advised us. They too were just as surprised as we were, given the popularity and widespread usage of GNS3. In fact, they are reaching out to other partners asking the same questions. You are correct, we tested only the Windows all-in-one package.

Some of the comments in the report are what is puzzling. Referencing Putty again, the report says, "Detects a putty version with a size different than the one provided by Simon Tatham (could be caused by an additional signature or malware)". Did the devs modify putty for use with GNS3? If so, that may be the reason for the "malicious" scan results. I downloaded the last 3 versions of putty and compared the hashes, none matched with the hash of the putty.exe included in GNS3. I cannot find which version of Putty the devs included.

Again, just doing my due diligence. I am not trying to disparage GNS3. Thank you for your time.

@grossmj I think the question on putty is worth answering since that isn't really in github that I can see.

Is it by chance this?

https://www.solarwinds.com/free-tools/solar-putty

I don't see any release info for solar putty, but i'll admit I haven't looked very hard.

[grossmj]

For info, Solar-PuTTY is only included in the installer for the versions you can download from gns3.com. There is nothing on GitHub.

I will provide more info in a reply below.

[grossmj]

Regarding HAXM, NPCAP and Virt-Viewer. There are all optional and I will update them to their latest version in our next release.

Now PuTTY requires more attention from us. We actually dealing with 3 different versions of PuTTY...

Solar-PuTTY comes with its own PuTTY which can be found in %APPDATA%\Solar-PuTTY-v4. I ran a scan on putty.exe in that directory with Virus Total and got no warning.

The version of PuTTY that is detected as malicious is the one bundled by GNS3 itself (putty.exe in the install dir), I know you assumed it comes from Solar-PuTTY because it shows "File distributed by SolarWinds Worldwide, LLC" in the Virtus Total scan, the reason is shows this is because we use a Solarwinds certificate to code sign our installer.

This bundled PuTTY version has been modified to support some custom options and shows as "Putty (custom deprecated version)" in the GNS3 GUI preferences. It is not the default terminal application when GNS3 installed, the default is Solar-PuTTY when present or a standalone version of PuTTY which is also bundled by GNS3 as standalone-putty.exe in the install directory)

The putty.exe binary is 10 years old(!) and for info here are the custom options it supports:

I don't think anyone use this deprecated version anymore and I should probably remove it.

The standalone version, 0.71, is from 2019 I believe and it needs to be updated to the latest v0.78:

Please, let me know if I need to change anything else. I will post a nightly release here soon to review.

Thanks for pointing out these problems.

[grossmj]

Here is the nightly release with the updated dependencies, I also removed the deprecated custom putty.exe: https://sourceforge.net/projects/gns-3/files/Nightly%20Builds/2022-12-24/2.2/GNS3-2.2.2022-12-24-all-in-one.exe/download

[shawn-ev]

Thank you very much for this expanded explanation and the nightly build. I am providing this info to our security folks. As eantowne suggested, I have started a Linux install onto an Ubuntu VM running in VirtualBox and will use the Web-UI to access it. I'm waiting on the Linux scan/test results. As it is, most of their scanning and testing efforts go towards Windows applications. I do not expect any malware hits from the Linux version, but I have to complete my due diligence.

edit: Changed KVM to VirtualBox. Said KVM by force of habit...