MuseHub/Muse.Service reported by Malwarebytes - is it legit or a false positive?
Hi,
I accidentally downloaded some malware this week, and installed Malwarebytes to detect and remove it.
Malwarebytes also detected and reported a programme called Muse.Service.exe as contacting a compromised web site. I've pasted the details below. As a temporary measure, I've uninstalled Musehub and Musescore.
But I'm not sure if this was a genuine infection, or whether MuseHub legitimately tries to contact this IP and Malwarebytes is reporting it as a false positive. Any thoughts?
-Blocked Website Details-
Malicious Website: 1
, C:\Program Files\WindowsApps\Muse.MuseHub_0.9.10.559_x64__rb9pth70m6nz6\Muse.Service.exe, Blocked, -1, -1, 0.0.0, ,
-Website Data-
Category: Compromised
Domain:
IP Address: 185.65.134.164
Port: 6881
Type: Outbound
File: C:\Program Files\WindowsApps\Muse.MuseHub_0.9.10.559_x64__rb9pth70m6nz6\Muse.Service.exe
Comments
Muse Hub runs a background service to handle the automatic updates. It's not malware.
In reply to Muse Hub runs a background… by Marc Sabatella
Thank you Marc.
In reply to Muse Hub runs a background… by Marc Sabatella
How do we know it's not malware? We can't inspect the source code, since it is closed.
In reply to Muse Hub runs a background… by Marc Sabatella
Running Windows 10.
I wanted to simply upgrade to Musescore 4. It's late in my day , and the standalone musescore download was not obvious. So I wound up with the Musehub package.
Immediately after installing Musescore via Musehub, I realized my mistake and uninstalled Musehub.
Will that remove the background software running in the background that other ( more technical ) folk have mentioned here?
I want musehub and any services from it out of my system .
If the uninstall was not adequate, can you advise what I need to do to get there?
Thanks
-tom
Chiming in on this... ever since I downloaded Muse Hub, I seem to be getting notifications from my ISP that malicious IPs are trying to access my device.
Additionally when exiting Muse Hub in the tray (so that it does not appear in the tray anymore), it's still running services in the background that I have to kill manually via Task Manager.
What's going on here?
In reply to Chiming in on this... ever… by albert.avery
The service was answered right above your post, it is used to run the auto updates.
The unknown IPs (not necessarily malicious) are likely those from other users, turn of the "community acceleration" setting from MuseHub if you do not wish to make use of it.
In reply to The service was answered… by jeetee
I get that it's used to run auto updates, but I feel like it's expected that when you "exit" a program, it should actually exit it. I feel like this is how most programs work in general, even those with auto updates.
Regarding the unknown IPs and "community acceleration", that's deeply concerning. I think that feature should be disabled by default if that's the case.
Especially if a non-technical person is trying out Musescore and downloaded Muse Hub, I don't think it's a good look for Muse when their ISP (Xfinity in my case, as it gave me notifications via their app) to be telling them that these outside IPs are trying to access my computer.
Just my two cents - regardless I have uninstalled Muse Hub since the time I have made my comment.
In reply to I get that it's used to run… by albert.avery
I agree on the exit.
I also feel that no non-technical user would enable the peer-to-peer function if it is disabled by default. But I think an approach as was used by Telemetry in 3.x could satisfy both: just ask it on first launch.
In reply to I agree on the exit. I also… by jeetee
But the main concern is not the torrent stuff.
The biggest security problem here is that this service runs with a privileged account (admin, root).
I am surprised that nobody sees this as a problem.
Basically, the Muse group can install anything they want on your computers, without you knowing about it.
In reply to But the main concern is not… by graffesmusic
I definitely see it as a problem. MuseScore is slowly becoming proprietary software, through the introduction of third-party proprietary tools that "solve" problems introduced by regressions in MuseScore. It may be overly cynical of me to point this out, but it really looks like a way to circumvent GNU GPL.
The whole concept of software checking for updates is absurd to any Linux user. We have package managers that do that for us. But this means less control for the software proprietors. Having such "update" software closed source and running with root privileges is a huge red flag. And you're incentivised into using this software (which would in any other circumstance rightly be described as malware) by getting a shiny present like MuseSounds: "oh no, you can't download this soundfont unless you give full control of your system to our proprietary updater". In what alternate reality does that make any sense? If this is not Defective-By-Design, what is?
I am very worried about this and the future of MuseScore.
In reply to But the main concern is not… by graffesmusic
Yes, the can install anything; such as the updates, which is it's main purpose of existence.
In reply to Yes, the can install… by jeetee
If you allow a third party you know nothing about (as i understand it: a 'mailbox' company based in Cyprus, but located in Kaliningrad, Russia) to have root access to your system: this is bad security.
Especially because there is really no need to have this running as root.
In reply to But the main concern is not… by graffesmusic
@graffesmusic: Can you elaborate on that? I mean the privileged account issue?
On my Mac I see the following information on the binary ("ls -l"):
-rwxr-xr-x@ 1 my_userid admin 9158928 13 dec 23:55 /Applications/Muse Hub.app/Contents/MacOS/Muse Hub
There is one extended attribute, indicated by the "@": com.apple.quarantaine
No root owner. Can it run as root at all? Or with root privileges?
In reply to Can you elaborate on that? I… by user2442
Ic can and willcertainly run with root priviledges when started by root
In reply to I can run with root… by Jojo-Schmitz
But not in normal operation, right? When I run
ps auxon it I see:my_userid 752 0,0 0,0 34453592 6548 ?? Ss 3:46pm 0:00.02 /Applications/Muse Hub.app/Contents/XPCServices/HelperInstaller.xpc/Contents/MacOS/HelperInstallermy_userid 743 0,0 0,2 35163600 81796 ?? S 3:46pm 0:00.61 /Applications/Muse Hub.app/Contents/MacOS/Muse Hub launchedAtLoginAs far as I can tell, this is running with my user privileges. Which are not root privileges.
Am I missing something here?
In reply to But not in normal operation,… by user2442
I don't know anything about Macs.
But it surely looks that the service on your system is running as your own user.
Somebody should confirm this behaviour.
But if this is correct, then i can only conclude that Linux users are really screwed.
On Linux, if privileged are dropped by adding a no shell system user/group, the service refuses to run - by design.
how do i go about disabling this service? i don't want it running in the background
In reply to how do i go about disabling… by sills
I'm pretty shocked to discover this running, definitely as root, on my Ubuntu 20.04 system. Huge security hole and I had no idea it was there. Typing the following on a terminal stops it:
david@dm:~$ sudo systemctl stop muse-hub.service
david@dm:~$ sudo systemctl mask muse-hub.service
Created symlink /etc/systemd/system/muse-hub.service → /dev/null.
david@dm:~$ sudo systemctl start muse-hub.service
Failed to start muse-hub.service: Unit muse-hub.service is masked.
Note you can unmask the service to bring it back to life. Masking prevents it from restarting at boot time.
Perhaps the developers can consider security a bit closer. Musescore is great, but this makes it dangerous.
In reply to I'm pretty shocked to… by davidjmcq
As mentioned numerous times, issues with Muse Hub are discussed on their support site at musehub.zendesk.com. Muse Hub is an installer and it installs files into folders like /usr/lib so obviously needs to have appropriate privileges - it should't be a security problem at all. But out of an abundance of caution, alternative solutions are being investigated.
In reply to As mentioned numerous times,… by Marc Sabatella
Thank you...
In reply to As mentioned numerous times,… by Marc Sabatella
Thank you...
In reply to As mentioned numerous times,… by Marc Sabatella
This is just a lie. The right way to do this is to at install time make a single folder in /usr/lib that doesn't require root privileges to add files and folders in and then run the background service without root permissions which will mean that it can only mess around with it's own folder rather than being able to mess with arbitrary system files. Making a torrent client run as root in the background is a massive security hole you're opening in your system and the fact that no one at MuseHub has acknowledged that makes me incredibly skeptical that the team is competent.
In reply to This is just a lie. The… by oscardssmith
Concur. I've masked it out as recommended in this thread.