I tried to install the DepthAI demo from the official luxonis github (https://github.com/luxonis/depthai/releases/tag/v3.6.1) but the installation gets interrupted by windows defender. It claims the file "depthai_viewer_bindings.pyd" is infected with a trojan. (Trojan:Win64/Bastdoor.MKV!MTB) Is this cause for concern, or a false positive from windows defender? I noticed there have been reports recently about infected ultralytics packages (8.3.45 and 8.3.46) on PyPi according to their discord channel - does this relate to this incident? Any help is much appreciated.

Same problem 30 seconds ago: [upl-image-preview uuid=c3e5ff59-0b2c-43a1-ba2d-9a38c6ec6773 url=https://discuss.luxonis.com/assets/files/2024-12-09/1733705419-375245-image.png alt={TEXT?}]

Also happened to me on Windows 11 [upl-image-preview uuid=32574298-63a0-4a95-a859-27cd238172df url=https://discuss.luxonis.com/assets/files/2024-12-10/1733795625-816834-threat.png alt={TEXT?}]

We're looking into it, I'll let you know once we have updates. It's possible that we use the same package as ultralytics, as we don't use ultralytics package itself.

I've seen the same issue, but on Windows 11. Its from the depthai-viewer tool, and I have posted about it quite a bit [on this issue for its GitHub repo](https://github.com/luxonis/depthai-viewer/issues/78), as I just bought an OAK-D Lite, and wanted to trace down if this is a real issue or a false positive before I installed the tools myself to play around with. Here's a quick summary of what I've found so far. * From running scans on VirusTotal, it seems to affect all versions of depthai-viewer from 0.1.5 through the latest (0.2.7). * VirusTotal only detects it on Windows builds. * Only 13 AV products are detecting it on VirusTotal, and I've been re-queuing the file to VirusTotal on a daily basis to see if that number changes. It has not. * The specific threat signature was only added to Microsoft Defender in November, and Microsoft has little detail on it right now, and I get almost no relevant hits for the signature name on google. I've not posted this bit on the bug yet as I'm still working on this, but here's some info on what I've done in the past day or two: Just today I've set up a Windows 11 VM and tried compiling the tool myself (by manually replicating the steps in the github actions definition file), which indeed triggered windows defender (Meaning the exploit *method* is not the same as the previously mentioned ultralytics breach, which from what I can tell, would only affect builds made on GitHub's pipeline, but that means nothing about what the actual exploit is). Interestingly enough, the none of the intermediate compilation objects are setting off windows defender. If it did trigger on one of those, it would suggest that the issue is with a dependency. Since it did not, I'm back to square one of wondering exactly what is triggering this. @"erik"#175 Microsoft has a way for[ developers themselves to submit files for more in-depth analysis](https://www.microsoft.com/en-us/wdsi/filesubmission?msockid=2192eae0684165843924f933692a64b4). I don't know what (if any) information they would share from that analysis, but it might be worth submitting it to them.

@"marsfan"#3159 thanks for the info, `zrezke` (developer of viewer) plans to update the viewer with newer rust version which apparently doesn't cause a warning.

@"erik"#175 I saw that reply from him on the GitHub thread, which sounds like a great simple solution. I'm still spending some effort trying to trace down exactly what's causing the AV detection, because I'm not entirely sure why updated the Rust version would fix that. I know he was planning to bump it to rust 1.74. If he can, he should bump it to at least 1.77.2, because that version fixed a 10/10 CVE related to the potential for escaping and executing remote code.

is there a work around or a solution? We bought this camera and would like to test it, but our IT would not let me run it without some confirmation it is indeed not a trojan

yep - working a big project using ToF POE sensor in a POC and very frustrating that i cant install this at the moment. I also have no option to simply ignore (and i don't think anyone should). Is there an ETA please?

@"JFgarcia"#p27868 to be honest - i have found luxonis customer support very bad, sent multiple questions and noone ever seems to reply. Honestly would have expected an issue likes this that effectively blocks depthai viewer install for all windows 10/11 users to a be top priority…

@"JFgarcia"#p27868 Should be fixed in the next release with updated rust toolchain. We are just making some final fixes. ETA this week. > @"jjb2"#p27871 I have found luxonis customer support very bad, sent multiple questions and noone ever seems to reply. Where was this sent? Thanks, Jaka

DepthAI installation on WIN10 triggers threat protection

Dams

It looks like we have a little bit more info on the threat :

https://threatlibrary.zscaler.com/?threatname=Bastdoor

https://www.virusview.net/malware/Trojan/Win64/Bastdoor

It looks like this trojan was also a keylogger and an infostealer.

Now, as I am not a security guy, and I don t know these sources, I'm not sure how accurate these information are.

I would still wait for the Microsoft report to be sure.

Regardeless, anyone that got infected really needs to change all of their passwords.

« Previous Page