VirusTotal False Positive? 3/62 Detections

[sharpjs]

VirusTotal reports 3 detections for ripgrep-14.1.0-x86_64-pc-windows-msvc.zip and 4 detections for the rg.exe within. A single detection by a lesser-known vendor is usually a false positive, but here we have multiple detections including one by Google. Therefore I will ask before installing: is this file safe?

[BurntSushi]

Therefore I will ask before installing: is this file safe?

Your question poses an interesting philosophical conundrum. If the file weren't safe, the implication there is that I have done something to insert some kind of trojan or malicious code into it. Yet, I clearly do not advertise ripgrep as unsafe. Thus, I would be duplicitous, and one would wonder as to the value in my answering a question like this. How can you trust me?

The sincere answer is that I have not knowingly inserted any malicious code into ripgrep. While I am pretty scrupulous about the dependencies I use in ripgrep, in theory, nobody is completely immune from supply chain attacks. After all, I do not actually audit every single line of code that is in ripgrep. Instead, I rely on trust and heuristics. You can either do the same or audit ripgrep yourself to determine whether what you're seeing is a false positive. Although neither is completely bullet proof. Assuming you're human of course. You are human, right?

TL;DR - Yes, it's a false positive.

[sharpjs]

Thanks. I was not concerned that you had inserted malicious code. I was mildly concerned about other vectors, like dependencies. In the unlikely event of a dependency adding malicious code, a GitHub discussion like this one might be how the alarm gets raised. Mostly, though, I thought that you ought to be made aware of the situation in case you wanted to take any action related to it. This also puts VirusTotal detections into the topics that users can find via search.

I am mostly, but not completely, human. There are some aftermarket parts installed.

[BurntSushi]

Sure... The problem is that these virus programs specifically bias toward false positives. And by filing issues on the projects they're reporting, you are putting the burden on volunteers to disprove a claim. But in actuality, what really should happen, is these sorts of issues should be filed against VirusTotal (or whoever is flagging the false positives) and ask them to confirm whether it's a false positive or not. After all, this is a report based on their threat model, not mine. So it's just overall not really fair to be posting these sorts of issues and asking volunteers to figure it out for you (or others).

But okay, I'll play along. One time. Here's how you can find all of ripgrep's dependencies (including transitive dependencies) that are used for the normal release build (including PCRE2):

$ cargo tree --features pcre2 -e normal --prefix none | rg '^\S+' -o | sort -u
aho-corasick
anyhow
bstr
cfg-if
crossbeam-deque
crossbeam-epoch
crossbeam-utils
encoding_rs
encoding_rs_io
globset
grep
grep-cli
grep-matcher
grep-pcre2
grep-printer
grep-regex
grep-searcher
ignore
itoa
lexopt
libc
log
memchr
memmap2
pcre2
pcre2-sys
regex-automata
regex-syntax
ripgrep
ryu
same-file
serde
serde_json
termcolor
textwrap
walkdir

Of those dependencies, I personally have written many of them. Since you trust me not to intentionally put malicious code in ripgrep, and presumably also trust me not to accidentally put something malicious in it (the worst possible conveivable thing is maybe an infinite loop or some kind of vulnerability), then it seems reasonable to remove all dependencies I have written. So that leaves these:

anyhow
cfg-if
crossbeam-deque
crossbeam-epoch
crossbeam-utils
encoding_rs
itoa
lexopt
libc
log
memmap2
ryu
serde
serde_json
textwrap

While this removes pcre2, that just removes the crate that wraps it (which I wrote). I of course did not write PCRE2. So that's a whole extra bundle of code. Other bundles of code not explicitly listed above include Rust's standard library and also maybe musl if you're using the release binary off of GitHub for Linux. On Windows, I suppose that would be Microsoft's Windows API libraries that come with the OS.

Of the dependencies above, several of them are authored by David Tolnay. He's on the Rust libs-api team with me. I trust him almost as much as I do myself not to put malicious code in his projects. So let's remove them too. While we're at it, let's remove crates that are officially maintained by the Rust project. Because if they're putting out malicious code, then there's really no hope given that they maintain rustc itself. Now we're down to these:

crossbeam-deque
crossbeam-epoch
crossbeam-utils
encoding_rs
lexopt
memmap2
textwrap

All of these crates are very widely used. Crossbeam is a respectable project with good stewardship. encoding_rs is used in Firefox. lexopt isn't too popular, but I have personally read the source code of that particular crate. memmap2 and textwrap are also extremely popular.

I don't see much of a reason to worry here. Trust definitely isn't an issue here, and ripgrep doesn't have so many dependencies that it isn't possible to actually trust all of their authors.

Probably the main attack vector is that someone's GitHub account gets compromised and a crate from the above list gets published with malicious code in it. Is it possible that has happened? Sure. Am I going to spend the time (how much time? days? weeks?) trying to look for it? Nah. The VirusTotal people can if they want though. I'm fine relying on the imperfect heuristic that if one of the above crates' authors had their account compromised, I would have heard about it by now.

[sharpjs]

Thanks again. Your answer was far above and beyond (in a positive way) any for which I had hoped. You've shown conclusively that a user need not be worried about this instance, and that similar detection levels in future are extremely, extremely likely to be false positives as well.

I take your point that the issue should be raised to VirusTotal and/or the offending vendors (there's a band name for you). One way to help is to vote positively with one's VirusTotal account to increase a file's "community score". I have done so and encourage others with accounts to do so as well. If the false positives continue, I'll do my best (which might not be much) to report them to the vendors, though I suspect that's much easier said than done.