ftkimager

maintainer jskier · 9 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged FTK Imager is a legitimate forensic tool from AccessData/Exterro, and the CloudFront URL (d1kpmuwb7gvu1i.cloudfront.net) appears to be Exterro's own CDN distribution endpoint — the official download page URL in the PKGBUILD points to exterro.com. However, there is no way to independently verify that this CloudFront distribution belongs to Exterro, there is no GPG signature, and only an MD5 checksum is used (which is weak). The package installs a prebuilt closed-source binary directly to /usr/bin. This is a real supply-chain concern: if the CloudFront bucket is misconfigured or the distribution is hijacked, an arbitrary binary would be executed on the user's system. The pattern is consistent with a legitimate vendor binary distributed via CDN, but the lack of a verifiable chain of custody (no GPG, weak hash, unofficial-looking CDN hostname) keeps this at MEDIUM rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=(https://d1kpmuwb7gvu1i.cloudfront.net/${pkgname}.${pkgver}_fedora${ARCH}.tar.gz)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): FTK Imager is a legitimate forensic tool from AccessData/Exterro, and the CloudFront URL (d1kpmuwb7gvu1i.cloudfront.net) appears to be Exterro's own CDN distribution endpoint — the official download page URL in the PKGBUILD points to exterro.com. However, there is no way to independently verify that this CloudFront distribution belongs to Exterro, there is no GPG signature, and only an MD5 checksum is used (which is weak). The package installs a prebuilt closed-source binary directly to /usr/bin. This is a real supply-chain concern: if the CloudFront bucket is misconfigured or the distribution is hijacked, an arbitrary binary would be executed on the user's system. The pattern is consistent with a legitimate vendor binary distributed via CDN, but the lack of a verifiable chain of custody (no GPG, weak hash, unofficial-looking CDN hostname) keeps this at MEDIUM rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# FTK Imager CLI, Copyright 2006-2012 AccessData (accessdata.com)
    
      2# Submitted by: David Hunter <archlinux at synackrst dot net>
    
      3# Maintained by: Jay M. <jskier at gmail dot com>
    
      4pkgname=ftkimager
    
      5pkgver=3.1.1
    
      6pkgrel=3
    
      7pkgdesc="Closed source binary CLI forensic imaging software by Access Data"
    
      8arch=('i686' 'x86_64')
    
      9url="https://www.exterro.com/ftk-product-downloads/fedora-and-red-hat-version-x64-3-1-1"
    
      10license=('Commercial')
    
      11depends=("zlib" "openssl")
    
      12if [ "${CARCH}" = 'x86_64' ]; then
    
      13  ARCH='64'
    
      14  md5sums=('c604300050bdd1c88e83951d4f222e4e')
    
      15elif [ "${CARCH}" = 'i686' ]; then
    
      16  ARCH='32'
    
      17  md5sums=('0a27829a261e8ab8c69846bfe40733')
    
      18fi
    
      19source=(https://d1kpmuwb7gvu1i.cloudfront.net/${pkgname}.${pkgver}_fedora${ARCH}.tar.gz)
    
      20
    
      21package() {
    
      22	mkdir -p ${pkgdir}/usr/bin
    
      23	cp ${srcdir}/${pkgname} ${pkgdir}/usr/bin
    
      24}
    
      25
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2