Fake Audiveris Website Scam

[bluechetti]

I almost got tricked by a fake version of Audiveris, the open-source sheet-music scanner. I thought I was downloading it from a legit site called “audiveris.com,” but it turns out the real project only exists on GitHub. The fake site copied the real GitHub page, used made-up contributor names, and had a clean “Download for Mac” button that actually linked to malware. The real Audiveris doesn’t have an installer—it’s a Java .jar file you get from the GitHub “Releases” section. If it’s not from github.com/Audiveris/audiveris, it’s fake.

This almost happened to me a second ago too with another software called finale.

[hbitteur]

@bluechetti
Thanks a lot for pointing to this fake site I never heard about.
It looks so real! Except the "Hepls" (sic) center.

FYI, the real Audiveris site on GitHub does have installers since release 5.5.3

But what can we do? I used to own the audiveris.com and audiveris.fr domains, I just kept the audiveris.org domain.
So anybody on earth can use audiveris.com for whatever purpose, that's the problem.

Do you have an idea on how we can fight this?

[jlpoolen]

Hervé, Alas, you are going to need legal counsel. I was an attorney for 40 years and resigned from all bars as I no longer have confidence in the judicial system of the United States. Therefore, I can no longer practice law. Were that I could help you, you have done so much good.

[hbitteur]

@bluechetti

I have reviewed again this audiveris.com site.
I can't tell for the macOS and the Linux downloads.

For Windows, the downloaded file is a Audiveris-5.7.1-windows-x86_64.zip file, which contains a Audiveris-5.7.1-windows-x86_64.rar file, which contains a Audiveris-5.7.1-windows-x86_64.msi file.
What is the purpose of wrapping a file into a .rar and a .zip???
Perhaps I'm naive.

I computed the SHA256 signature of the .msi file:
sha256:524e5701a3bd0a07d33df84adc5a53062949ca41ef833623c2adde39f7f7cb14

It's the same signature as the original Audiveris-5.7.1-windows-x86_64.msi asset of the 5.7.1 release on the github site.
So, is it really a malware?
I also checked the downloaded .zip file with my Avast antivirus, nothing detected.

Again, my remark applies only to the Windows download.