Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

frpc.exe 0.34.1 detected as security risk by Symantec Endpoint Protection, submitted false positive, but they will not revoke the detection. What to do? #2166

Closed
2 tasks done
gitercn opened this issue Dec 25, 2020 · 1 comment

Comments

@gitercn
Copy link

gitercn commented Dec 25, 2020

[REQUIRED] hat version of frp are you using

Version: 0.34.1

[REQUIRED] What operating system and processor architecture are you using
OS: Windows
CPU architecture: x64

[REQUIRED] description of errors

confile

log file

Steps to reproduce the issue

  1. I have downloaded and used frpc.exe 0.34.1 on a computer with Symantec Endpoint Protection Version 14.3 build 558. It has no issues for a few weeks. Then yesterday it was reported as a security risk. The sha-256 hash is 20B89AFBC2F20A1239FC71CAAAFD861BAF626352BEEBE3B5EE4150273

Then I submitted a false positive report to Symantec at here: https://symsubmit.symantec.com/#fp_tab
I wrote:

Why this open source fast reverse proxy frp get identified as security risk? This file is download from Github release: https://github.com/fatedier/frp/releases/download/v0.34.1/frp_0.34.1_windows_amd64.zip It's source code is open on Github: https://github.com/fatedier/frp

Then today I received an email saying they will not revoke the detection:

In relation to submission 238882.

Upon further analysis and investigation we have determined that the file(s) in question meet the necessary criteria to be detected by our products and as such, the detection cannot be revoked.

For additional information on how to configure Symantec products to exclude specific drives, folders, and files from being scanned please see below.

Symantec Enterprise
- Information on exclusions: https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/Using-policies-to-manage-security/managing-exceptions-in-v36686987-d51e6/creating-exceptions-for-virus-and-spyware-scans-v39814459-d51e102/excluding-a-file-or-a-folder-from-scans-v39818564-d51e811.html#v39818564
- Support: https://support.broadcom.com/contact-support.html

Norton Consumer
- Information on real time exclusions can be found under the section 'Exclude files or folders from scan': https://support.norton.com/sp/en/us/norton-antivirus/19.0/solutions/kb20100222230832EN_EndUserProfile_en_us
- Support: https://support.norton.com/sp/en/au/home/current/info

Decisions made by Symantec are subject to change if alterations to the Software are made over time or as classification criteria and/or the policy employed by Symantec changes over time to address the evolving landscape.

Sincerely,
Symantec Security Response
https://www.broadcom.com/support/security-center

What to do?

Supplementary information

Can you guess what caused this issue

Checklist:

  • I included all information required in the sections above
  • I made sure there are no duplicates of this report (Use Search)
@fatedier
Copy link
Owner

Duplicate of #2095

  1. Do not use frp.
  2. Build it by yourself and write it to antivirus sofeware whitelist.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants