26
submitted 7 months ago* (last edited 7 months ago) by Garrytianomorph@lemmy.world to c/privacy@lemmy.ml

windows10 keepassxc.exe, ‎11.‎03.‎2024 ‏‎18:40:26, 52509, 140.82.121.5, lb-140-82-121-5-fra.github.com, 443 (https), tcp, Outbound, [B] Internal\BlockConnection

all 14 comments
sorted by: hot top controversial new old
[-] LWD@lemm.ee 13 points 7 months ago* (last edited 7 months ago)

Can you rewrite the question without the word "itself"? Because I am confused by it.

PS unlike Reddit, you can edit titles on posts

Edit: actually I wasn't too clear myself: I didn't know if you were referencing a Windows update or a KeePass update

[-] Gooey0210@sh.itjust.works 11 points 7 months ago

Maybe it's trying to get favicons?

[-] UID_Zero@infosec.pub 8 points 7 months ago

Is that it's update check?

[-] Garrytianomorph@lemmy.world 4 points 7 months ago

it's disabled

[-] itsnotits@lemmy.world 3 points 7 months ago

its* update check

[-] Squire1039@lemm.ee 6 points 7 months ago* (last edited 7 months ago)

VirusTotal doesn't indicate keepassxc.exe 2.7.7 contacts this address. I'd be careful. Check the binaries' signatures. Try a full install to see if that behaves differently.

keppassxc.exe: https://www.virustotal.com/gui/file/fea4df5024f83155f6742a3372a801fc6cc97ed82627b36fce6f0caed54506cf/relations

KeePassXC-2.7.7-Win64.msi: https://www.virustotal.com/gui/file/9c3dab957db0f769c4e67bfdf4f0134a65ecfa65c5569718a36aa88e649158cd

[-] Garrytianomorph@lemmy.world 3 points 7 months ago
[-] Squire1039@lemm.ee 3 points 7 months ago

140.82.121.5

Well, apparently, this is an A record for api.github.com. This name resolves to a different IP around the globe. See https://www.whatsmydns.net/#A/api.github.com

The IP is detected as "clean" on VirusTotal: https://www.virustotal.com/gui/ip-address/140.82.121.5/detection , although apparently (probably not surprising as it is github) is also a favorite address for everything including malware.

Maybe you can ask in the keepassxc discussion forum on github.

[-] Matt@lemdro.id 6 points 7 months ago* (last edited 7 months ago)

There is a setting to automatically check for updates. I would see if that is enabled.

[-] Garrytianomorph@lemmy.world 4 points 7 months ago

keepassxc is blocked by the firewall and updates are disabled, so calling the firewall confused me

[-] Turbo@lemmy.ml 5 points 7 months ago

Did you get the app from trusted source? Did you check the md5 / sha512 hash after downloading to ensure no tamper?

That would freak me out also..

[-] fizzyvelcro@lemmy.world 0 points 7 months ago

Checking the hash is only useful to confirm a correct download. If someone can change what binary you download, they can also change the hash and would be stupid not to…

[-] Turbo@lemmy.ml 1 points 7 months ago

Forsure, but if you still had the download and went to the sites official page today and could check if it matches to alleviate fear you downloaded a fake version etc.

this post was submitted on 11 Mar 2024
26 points (88.2% liked)

Privacy

31601 readers
612 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS