184

FBI warnings are true—fake file converters do push malware (www.bleepingcomputer.com)

submitted 2 months ago by RegularJoe@lemmy.world to c/technology@lemmy.world

39 comments fedilink hide all child comments

top 39 comments

sorted by: hot top controversial new old

[-] doctortofu@reddthat.com 89 points 2 months ago

“Users who in the past would type ‘free online file converter’ into a search engine are vulnerable, as the algorithms used for results now often include paid results, which might be scams.”

Nooo, you mean turning search engines into monetization and ad delivery engines had downsides? Who would have thought!

Fucking greed at the root of another goddamned issue...

[-] MemmingenFan923@feddit.org 56 points 2 months ago

That's why I always prefer an offline converter. Also if your upload a file somewhere the website can save it for their own purpose alhough they say they won't do it.

[-] dual_sport_dork@lemmy.world 32 points 2 months ago

Precisely, and this is why I've never trusted online "free" converters since day one. Who the fuck knows what they're actually doing with your file, and I always assumed that most of them were fronts to steal data and IP from users who are stupid enough to upload corporate and business stuff to them.

Anyway, there's vanishingly little I haven't been able to do over the years with ffmpeg or Imagemagick, their byzantine command line structures notwithstanding.

[-] catloaf@lemm.ee 2 points 2 months ago

Which is why I've been happy to trust them for files nobody cares about, like a random audio file that I got off the Internet. And it's very unlikely they'd be able to exploit my media player.

[-] gravitas_deficiency@sh.itjust.works 2 points 2 months ago

I tend to just whip up a script of some sort that employs widely used libraries for the conversion. I know that’s more technical than most people would have the tolerance or aptitude for, but for me, it’s the least ambiguous and most secure way to do stuff like that. And then I can squirrel it away in a utility scripts directory and use it later if I need it again.

[-] horrorslice@lemmy.zip 1 points 2 months ago* (last edited 2 months ago)

The website mentions that there are fake offline converters that push malware as well.

[-] MemmingenFan923@feddit.org 0 points 2 months ago

Yes this can also happen. I should have written open source offline converter

[-] amphy@lemmy.ca 0 points 2 months ago

What you recommend in terms of offline open-source converters?

[-] dreadbeef@lemmy.dbzer0.com 1 points 2 months ago

Pandoc for documents, ffmpeg for video , imagemagick for images

[-] AppearanceBoring9229@sh.itjust.works 0 points 2 months ago* (last edited 2 months ago)

What are you looking to convert?

Usually what i do is look for any converter and look for open source alternatives to it on alternativeto.net and hopefully one of the top 3 alternatives fits your use case

[-] quid_pro_joe@infosec.pub 1 points 2 months ago

Psst the URL is: https://alternativeto.net/ I always stop here first to research what software options there are available and also learning what other people are using. Extremely useful and trustworthy site!

[-] AppearanceBoring9229@sh.itjust.works 1 points 2 months ago

Thanks i dropped the "to"

[-] Ulrich@feddit.org 0 points 2 months ago

Which offline converter? I find myself often trying to convert:

PDF to JPEG
AVC to MP4
OPUS to MP3

etc. I have no idea how to do that but if I type it into a search engine there's usually tools there.

[-] T156@lemmy.world 8 points 2 months ago

FFmpeg and handbrake do the latter two quite handily. The latter even has a nice program interface, rather than needing commands.

ImageMagick is capable of the first. I've had it go the other way before, and I should be most surprised if it couldn't convert a PDF to a jpg.

[+] Ulrich@feddit.org -6 points 2 months ago

I don't have the knowledge or the time to learn to use these tools.

[-] captain_aggravated@sh.itjust.works 11 points 2 months ago

Then I suppose you're up shit creek.

[-] Ulrich@feddit.org -1 points 2 months ago

Thanks for that deep analysis.

[-] captain_aggravated@sh.itjust.works 1 points 2 months ago

Let me tell you a little bit about all those various file converter tools, be it ffmpeg, pandoc, imagemagick, whatever.

The majority of them can be used like this: magick inputfile.bmp outputfile.jpg. If all you need is this file in that format, that's how you do it. They're ridicluously capable, you can do editing and compositing and such with them and whatever. If you have a use case where you do that a lot, like you just always put a watermark on images or you always desaturate them or whatever, you can write a script, then just run that script.

They're basically all like that. Fairly simple to use for basic format translation, shockingly capable if you want to write a script.

[-] Ulrich@feddit.org -2 points 2 months ago

magick inputfile.bmp outputfile.jpg.

[-] Ulrich@feddit.org -2 points 2 months ago

I don't think it worked.

[-] photonic_sorcerer@lemmy.dbzer0.com 1 points 2 months ago

They're command line tools. If you want to get something done you have to put in a little effort.

[-] Ulrich@feddit.org 0 points 2 months ago

Strange, those online tools don't require any "effort".

[-] TheBlackLounge@lemm.ee 2 points 2 months ago

This is learned helplessness. Especially for someone who took the time to go waste time on Lemmy in stead of Reddit, you could have learned it in the time it took to complain about it taking effort.

[-] sugar_in_your_tea@sh.itjust.works 4 points 2 months ago

Handbrake has a GUI, and it's relatively straightforward to use. VLC also works well. You can also use ffmpeg on the CLI like so:

ffmpeg -i input_video.mp4 output_video.avi

imagemagick isn't really that hard, in most cases it's:

convert <file1> <file2>

For example:

convert file.pdf file.jpg

If that doesn't work, try pdftoppm:

pdftoppm input.pdf outputname -png

I don't know of a good GUI for it, I recommend just learning to use either imagemagick or pdftoppm.

[+] Ulrich@feddit.org -8 points 2 months ago

Handbrake has a GUI, and it's relatively straightforward to use

I downloaded it and it immediately did not work so I'm gonna have to disagree with you there, champ.

You can also use ffmpeg on the CLI like so:

I've lost far too many hours to the CLI. I don't fall for that trick anymore.

[-] sugar_in_your_tea@sh.itjust.works 4 points 2 months ago

You do you, I guess. Those are incredibly simple commands I provided, and you can intuit pretty easily how to tweak them for other formats.

I guess it's up to you. You can gamble with random services online, or you can spend a few minutes and learn to use a tool that's all but guaranteed to not have malware.

[+] Ulrich@feddit.org -6 points 2 months ago* (last edited 2 months ago)

or you can spend a few minutes

This is just a fucking lie and I'm tired of hearing it. What did I just say?

I've lost far too many hours to the CLI.

I've tried to learn this shit. It's a fucking rabbit hole. I type these commands, letter for letter, the terminal returns some completely useless error that provides me with no diagnostic information whatsoever, I spend hours searching and trying to understand why and come up empty-handed. I don't have time for that anymore. I already have multiple jobs. It's not how I prefer to spend my free time. And frankly, I don't believe it anymore when software engineers feed me this bullshit.

You know what those web services do? I just click a button and it does what the button says. Why is that so hard?

[-] sugar_in_your_tea@sh.itjust.works 5 points 2 months ago

You know what those web services do? I just click a button and it does what the button says. Why is that so hard?

There's also a pretty big chance that they'll do more than what the button says, like inject malware. That's the whole point of the article.

[-] Ulrich@feddit.org -4 points 2 months ago

I understand that but that's beside the point. It does what they advertise. It's incredibly simple and easy to use. Why can no one make something comparable that's FOSS?

[-] sugar_in_your_tea@sh.itjust.works 4 points 2 months ago

They did, it's often a CLI interface because it's incredibly flexible. ffmpeg and imagemagick are quite easy for basic things.

Building a cross-platform GUI is a pain, and hosting a website costs money. Building a cross-platform CLI is incredibly easy, which is why it's so popular.

Some of these tools have GUI frontends or alternatives, some don't. The more niche you go, the harder it'll be to find a reasonable GUI, and I consider PDF to JPEG pretty niche.

[-] Ulrich@feddit.org -4 points 2 months ago* (last edited 2 months ago)

CLI interface

quite easy

No. This does not compute.

hosting a website costs money

You don't have to host a website. Just make software that works like the website and runs locally.

I consider PDF to JPEG pretty niche.

But not niche enough that these websites don't exist.

[-] gnuhaut@lemmy.ml 1 points 2 months ago* (last edited 2 months ago)

Making a GUI is more work than making a CLI tool. GUIs are not cross-platform, a pure CLI is more portable. You can code a CLI with any programming language you like, while there are many restrictions on what kind of GUI is available on what programming languages and platforms.

The GUI code is tedious and boring to write. That code can become outdated and broken and might need fixing to run on newer platforms. The CLI has essentially no extra dependencies and the interface hasn't changed much since like the 70s.

The sort of person who develops free software usually knows and likely prefers to use the CLI. They're not doing it for users like you, first and foremost. They're doing it themselves, or because they need it for their job. The CLI tool might be exactly what they want, because the file conversion is part of some backend stuff, something that's run from a script, so you can automatically run it on all the files.

Anybody with basic web dev skills can then take these tools, slap together web fronted and try and make some quick bucks. They're basically incentivized to not care about security, privacy or anything like that. Of course that space attracts scammers.

The incentives just aren't there for it to be any other way. You can either learn the CLI commands, written by people who care about their reputations and professional pride and want to share their tools. Or you can trust anonymous internet randos wanting to make a quick buck. And while I sympathize not wanting to have to learn new shit, I swear using a shell isn't actually more complicated than using a web browser, you're just not used to it.

[-] zerofk@lemm.ee 1 points 2 months ago

I can’t comment on the others, but PDF to JPEG should be easy enough. ImageMagick, which another commenter suggested, is possible but not user friendly. However you can just open the PDF in many applications and export it as an image. Adobe Acrobat and Photoshop can do it. GIMP probably too.

I’m a last ditch effort you can even just open the file and screenshot it.

[-] shottymcb@lemm.ee 2 points 2 months ago

Open/Libreoffice can do that too

[-] AwesomeLowlander@sh.itjust.works 25 points 2 months ago

“Users who in the past would type ‘free online file converter’ into a search engine are vulnerable, as the algorithms used for results now often include paid results, which might be scams.”

Mm hmm.

[-] aaron@lemm.ee 10 points 2 months ago

I refuse to believe that the free service I've been using for years has been exploiting my behavior for money.. what kind of world is this?? What kind of psychopathic organization would do such a thing? Why isn't capitalism working for me? Why?

[-] djmikeale@lemm.ee 21 points 2 months ago

Protip: ask your favourite llm to write you a python script to convert between the formats you're interested in. Bonus benefit: simultaneously learn a bit about programming!

[-] AceFuzzLord@lemm.ee 1 points 2 months ago

As much as I'm not a fan of this, I'll at least admit it was helpful in helping me quickly learn how to scale videos using FFMPEG. That, combined with the documentation and now I have a command saved to a reference text document to help if I ever forget.

[-] Evotech@lemmy.world 5 points 2 months ago

The best is online CSR generators.

Yes, I know people who have implemented private keys they have been given from random websites.

this post was submitted on 25 Mar 2025

184 points (99.5% liked)

Technology

71313 readers

2770 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

L3s@lemmy.world

enu@lemmy.world

technopagan@lemmy.world

L4s@lemmy.world

L3s@hackingne.ws

L4s@hackingne.ws