Warning about RiskWare Ngrok

[mosk]

Hi. over the past two days, I installed Docker, WSL2, and DDEV so I can set up a more robust environment for building and testing my websites. This morning I received a warning about Riskware Ngrok. Wasn't sure if this was a problem and if I should quarantine these files - or if these are appropriately used by my new installations. I'm attaching a copy of the text file/warning to this message. Thanks in advance for any help.

MB_7-7-24_ngrok_warning.txt

[miekiemoes]

Hi,

This is a valid detection since it's also often (ab)used by malware. So if you have installed this yourself, you can set an exclusion for it. :)

[mosk]

Thanks for the response. I installed the things I mentioned (WSL2, Docker, and DDEV), but I don't know if I installed Ngrok per se. Is there a way to tell if this is a legitimate installation vs malware? Or is ngrok inherently subject to misuse once it's on your system?

I wasn't sure if its functionality was required by one of those things I installed and thus included/bundled into the installation.

I think I'll quarantine the two files listed for now just to be on the safe side.

Thanks for any additional information/recommendations you can provide.

 

[miekiemoes]

Hi,

It does look that ngrok gets installed along WSL2, Docker, and DDEV, so there's no need to worry here. 

https://ddev.readthedocs.io/en/stable/users/usage/cli/

• ddev share requires ngrok and at least a free account on ngrok.com so you can let someone in the next office or on the other side of the planet see your project and what you’re working on. ddev share -h gives more info about how to set up ngrok.

[mosk]

Hi - thanks so much for the follow-up and the link. I appreciate the great support that Malwarebytes provides!

[miekiemoes]

You're most welcome :)