Sine Mod pinging "ddl-warez.cc"

[spendoge]

Hey guys, I've had Sine mod for a little while now, but recently I've been flagged by my works IT department for accessing the piracy website "ddl-warez.cc". They've found that its coming from running the sine-win-x64.exe. Any ideas? This never happened when I originally downloaded and ran Sine, only recently when i went to uninstall it.

[CosmoCreeper]

I have no knowledge of the installer reaching a piracy site. It pings GitHub several times, but the only reason for the piracy site ping i can think of would be if you installed a malicious installer.

https://github.com/sineorg/installer - Source code of installer.

[spendoge]

The "sine-win-x64.exe" installer is what I used from the Sine Releases link on the home page of this GitHub

[spendoge]

This exact installer is now getting flagged by Windows Defender as a severe threat too, just so you know. I'm not sure if the installer is compromised somehow or has been exploited but may be worth looking into, I dont remember having these issues when I installed it previously.

[CosmoCreeper]

As long as you are installing from v2.3.3, it is not possible for it to be compromised. We use immutable releases, so only a severe GitHub hack could edit the release. (Even if they hacked my account, it would still be impossible.)

Please take a look at #506 regarding the virus flagging issue.

[spendoge]

Thanks for all the replies. Is it possible then that one of the mods in the Sine Marketplace has been exploited? I know you don't have control over these, just a thought

[CosmoCreeper]

It is possible for one of the marketplace mods to become exploited on it's end, but since the version of the mod that you install on the marketplace is reviewed and verified, it is very rare for this to reach production. As such, we have no known history of anything of this happening.

[CosmoCreeper]

Looking into this more, it is possible that despite the installer only downloading our official assets from GitHub, the IT software may be looking into the GitHub IP and seeing that it hosts several other malicious files (potentially linking to ddl-warez.cc), even though that is not what Sine's installer directly downloaded.