Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Deleted user
0 / 0 points
Next:
badges earned

Your Points Tracker
Challenges
Leaderboard
  • Global
  • Feed

Badge for your thoughts?

You're enrolled in our new beta rewards program. Join our group to get the inside scoop and share your feedback.

Join group
Recognition
Give the gift of kudos
You have 0 kudos available to give
Who do you want to recognize?
Why do you want to recognize them?
Kudos
Great job appreciating your peers!
Check back soon to give more kudos.

Past Kudos Given
No kudos given
You haven't given any kudos yet. Share the love above and you'll see it here.

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Executable get infected with Trojan:MSIL/Masslogger.VN!MTB after uploading to Jira Edited

I uploaded unsigned executable (C# compiled with visual studio) to JIRA (tested with cloud and standalone)

Right after upload I downloaded and file was same.

However if I download file after 5-10 minutes, my antivirus (Defender) reported it contains Trojan:MSIL/Masslogger.VN!MTB

I turned off Defender real time protection and did BYTE COMPARISON of files (size was same) and FOUND DIFFERENCES in start sequence.

Does anyone have any logical explanation?

1 answer

1 accepted

0 votes
Answer accepted

I do not think we can offer anything logical that goes right down to the root cause, we are very short of infomation, and probably need a lot more from you

Your described behaviour says that your anti-virus is interfering.  There is nothing wrong with it doing that, it's protective.  But it sounds like something is inserting a virus into the file after you've downloaded it.  This is nothing Atlassian software can do, it's something else on your machines.

I'm afraid this is not the case. I've tried this on multiple computers in multiple separated environments and accounts. I do not believe all of them will have same virus. If I upload same executable on any other http/s storage (for example to GitLab or Google Drive) and download back it is clean. We are running standalone JIRA (but as I mentioned same behavior occurs on cloud JIRA...).

To sum up all points to that it is changed by JIRA.... :|

Can you help me to identify where are attachments stored in JIRA so we can monitor if it is changed directly on storage/DB level?

More information about executable: 

C# Windows form application (.exe) compiled without signing via Visual Studio.

P.S: I'm ok for live session where I can present the behavior and give you access to cloud Jira so you can download by yourself.

I'm sorry, but you exactly described a case where something is changing a file AFTER you've downloaded it from Jira.  Specifically:

"Right after upload I downloaded and file was same.

However if I download file after 5-10 minutes, my antivirus (Defender) reported it contains Trojan:MSIL/Masslogger.VN!MTB"

If the file on your local machine is changing, it can not be the Server you downloaded it from.  There is something on your machine changing it. Not Jira.

Even if I assume that your original report is not accurate, and the infection is actually happening on the Jira server, before download, you still have the problem that Jira has no code in it that writes to attachments.  All it can do is copy an upload stream to the attachment directory, and serve up previews of attached files. 

However, if the file really is being changed on the server, all that means is that your server has something on it that is infecting the files.  Whatever that is though, it's not Jira.

You also say you are on Cloud - that rules out any looking at the attachments on the storage, but also, if a virus were present on the Cloud service and doing this, it would have been found and shut down a long time ago.  If you are on Cloud, then it's an absolute fact that whatever is doing this is on your machines, not Jira.

Since you wrote this I'm not able to reproduce problem in cloud environment. So accepting this as solution

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Jira Service Management

JSM June Challenge #2: Share how your business teams became ITSM rockstars

For JSM June Challenge #2, share how your non-technical teams like HR, legal, marketing, finance, and beyond started using Jira Service Management! Tell us: Did they ask to start using it or...

326 views 9 7
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you