Trusted sources, fake installers and bundled software

Many of the problems that people bring to a repair shop started with a download. The program they wanted was real, but the page they got it from was not, or the installer carried extra software they never asked for. Criminals make fake download pages because they know people are in a hurry. In this lesson you will learn what these pages look like and a short routine that protects you. The examples are educational simulations with fictional names; no real company is meant.

Why downloading is risky

When you install a program, you give it the power to run on your computer, often with your approval. A program that is malicious or careless can read your files, show you adverts, slow the computer, or steal passwords. This kind of harmful software is called Malware. The most reliable defence is not a clever tool but a habit: get software only from places you can trust, and check before you click.

Remember the official stores from the last lesson. Software in them has been checked to some degree. Anything you fetch from elsewhere has not. This does not mean that every website is dangerous; it means the checking becomes your job.

Official sites and download portals

An official site is run by the people who make the software. A {{download-portal|download portal}} is a third-party site that collects links to many programs and earns money from adverts. Portals are not always criminal, but they have a weak spot: they may wrap the real program inside their own installer, which adds extras, or they may show adverts designed to look like the download button.

The easiest first check is the web address. A URL has a part called the domain name that tells you who runs the site. Read the domain from the right-hand side of the part before the first single slash. Fakes copy a famous name but put it in a different position, or change one letter.

Fake buttons and misleading pages

A fake download page often has several big green buttons that say Download, Start or Play, but only one of them, usually small, is the real link. Other buttons are adverts. Fake pages may also claim your computer is infected, or invent countdown timers, to hurry you. A real maker's page is calm. It names the program, the version, the licence and the system it is for.

Bundled software

Even a real installer can carry passengers. Bundled software is extra programs packed together with the one you wanted. Some are harmless trials, some change your browser's home page or search engine, and some show adverts all day. A well-behaved installer lets you decline extras with clearly labelled boxes. A poor one hides the choice behind a button called Recommended or Express that quietly accepts everything.

When you run an installer from outside a store, read each screen. Choose Custom or Advanced if offered. Untick extra offers. If you cannot tell what an offer is, decline it. If an installer insists on adding a program you did not ask for, cancel the installation and look for another source.

Publisher names and system warnings

A digital signature is a mark on a program, made with a secret key, that lets the system check who published it and whether it was changed afterwards. On Windows, the prompt that asks whether to allow changes shows a Verified publisher name when a file is signed, and warns about an unknown publisher if not. Windows may also show a blue screen saying “Windows protected your PC”, from a feature called SmartScreen, when a file is unusual or unknown. These warnings are not always right, but they are a reason to stop and check, not to click through.

A signature tells you who made the file, not that the maker is honest. Read the name: it should match the product's maker. On Ubuntu, packages from the official sources are checked by the system, and a file from a website should come with instructions from the maker.

Checking a download with a checksum

Some makers publish a Checksum next to their downloads: a long string of letters and numbers calculated from the file's contents. Change even one tiny part of the file and the string changes completely. You can calculate the checksum of your downloaded copy and compare. If the two strings match exactly, the file is the one the maker published, with no damage and no tampering in transit. If you got the checksum from the same page as the file, a criminal who controls the page could alter both, so the check proves the most when the checksum comes from the maker's own official site.

Here is a safe way to practise on your own computer, using a file that you create yourself, so nothing from the internet is involved. The command mkdir -p ~/practice makes the folder practice if it does not exist. The next command writes the word hello into a file. The command sha256sum then prints the file's checksum, using a method called SHA-256, followed by the file name.

mkdir -p ~/practice
echo hello > ~/practice/hello.txt
sha256sum ~/practice/hello.txt

New-Item -ItemType Directory -Force $HOME\practice | Out-Null
Set-Content $HOME\practice\hello.txt "hello"
Get-FileHash $HOME\practice\hello.txt