Untrusted signature on java app for downloading youtube, harmful?

Question

If you visit most of the "online youtube download" pages, you will get this message:

Why all these sites come up with this message? Is it a worm, or just an unharmfull app?

Answer 1

To download a YouTube video, you need to make a connection to Youtube masquerading as their Flash-based video player. Flash has some security controls that stop you doing that from inside another Flash file that isn't their video player, and connections from XMLHttpRequest, WebSocket, plain Java applets and Silverlight are deliberately limited in ways that also prevent the right kind of connection being made.

So to successfully download a video, you need to be able to make an arbitrary network connection. This is something that only a full native application, or a Java application with similar permissions, can do. This means there are two ways of providing a YouTube download service:

1. make connections from software on your own server to download the video;

2. provide the user with a native app or similarly-permissioned Java app to do it from their desktop.

Some services have provided (1) in the past, but it makes it fairly obvious to YouTube that something's up when loads of connections with an atypical viewing profile come in from a small range of IP addresses. These services tend to get blocked.

So most sites are currently using native-app downloads and Java apps instead. In the Java case that means you have to grant the applet suitable permissions before it will run. There is no guarantee that there isn't malware (most likely: a pay-per-install toolbar) in the applet, so this is exactly as dangerous as downloading and running a .EXE.

Up to you whether you think running it is a chance worth taking. I've always tested these things from a scratch VM, for what it's worth.

The message complaining about the digital signature is incidental. An elevation prompt from a properly-signed applet that does not have this warning, could have malware lurking behind it just the same. All the signature would mean would be that you know who to blame after getting infected. Many sites use unsigned applets because code-signing/time-stamping for Java is historically a bit of a pain.

Answer 2

Well, there's no way to know that for sure without looking into the application... Although, it does seem incredibly suspect.

This message lets you know that your browser is trying to launch an applet in trusted mode, which means that the Java code will have full control over your system. You probably shouldn't accept, unless you know (and trust) the publisher.

...Which is exactly what the warning says.

Answer 3

The message does not state anything about whether the applet is harmful or not. Java applets, by default, are severely constrained in what they can do, in particular what external hosts they may connect to. This is so that Java applets can be considered as harmless, as in "declawed".

A Java applet may request extended privileges, but the JVM will grant them only if the applet is signed. Moreover, if the signature key is not part of a digital certificate which links to the root certificates that the JVM knows intrinsically, then it will display the message you see.

So the message means that:

• the applet is signed, so it probably wants to do some operations that an unsigned Java applet is not permitted to;
• the applet developer did not bother buy a 100$ certificate which would have been blindly accepted by the JVM (whether the developer was poor, lazy, or wanted to remain anonymous, is not said);
• if you click "run" then the applet may potentially run whatever code it wants on your machine.

So this is like if a masked individual knocked at your door and requested very politely that you give him a copy of your door keys. This does not automatically means that the said individual has burglary in mind -- maybe he is the Masked Plumber, who took an Oath to fix faucets of ordinary citizens at no charge -- but you could be entitled to feel a tiny bit suspicious about the proceedings. If you click "run", you are on your own, and you have been warned.

Answer 4

In order for an applet to access the local file system (and more permissions) , it needs to be signed and your Java Security Settings need to be at Medium (Lowest leve). When an applet is signed , such a window pops up asking for permissions . Certificated Applets (Virus - Free for sure) run even at the Highest security level.