Sine is falsely flagged as a virus

[CosmoCreeper]

After being pinged almost every day about Sine being flagged as a virus by people's antiviruses, I have decided to make this issue and stop all the chaotic, separate, and unofficial issues regarding this matter. This issue will cover everything we know about why this happens, what we can do, and the actions we are taking to bring this to an end.

Report a false-positive

First of all, I would like to say that if your antivirus is flagging Sine as a virus, please let us know here, but only if it is not flagged as one of the known types listed below. If the type of virus your antivirus flags it as is listed below, then find the corresponding comment and like it. If it is not listed below, create a new comment and we will update this list.

If you are going to report a false-positive, please ensure that the virus type Sine's installer is flagged as, the antivirus you're using, and the OS you have are all listed in your report.

List of known false-positive flags

• Gen:Variant.Tedy.977415 - BitDefender
• Trojan:Win32/Kepavll!rfn - Microsoft Defender
• Trojan:Win32/Wacatac.B!ml - Microsoft Defender
• Malware.AI.3190729070 - Malwarebytes
• Riskware.Injector - Malwarebytes
• Win64/GenKryptik_AGen.DJQ - ESET
• TR/W64.Evo - Avira

What is happening?

For ages now, Sine has been flagged by several antiviruses as a trojan, or some other type of virus. We know this to be false, but to the casual new user, these reports are a massive red flag. Many antiviruses are flagging Sine, including but not limited to, some VirusTotal vendors, Microsoft Defender, Bitdefender, and Malwarebytes.

Just as a clarification, it is not Sine that is being flagged, but rather it's installer, which helps us narrow down the why.

Why is Sine being flagged as a virus?

While we'll never get a peek inside the code of these antiviruses to understand exactly why, we do have a pretty good guess. To help you understand our next points, here's how Sine's installer works:

user executes installer ->
  user enters several paths and parameters.
  installer launches a script ->
    updater.bat on Windows *or*
    updater.sh on Linux and macOS ->
      updater script modifies the user's profile folder for Firefox, containing Sine's main code.
      updater script opens up another instance of itself asking for admin permissions ->
        if the user accepts, the updater script will then modify the user's Firefox installation folder to include Sine's bootloader.
installer closes out.

We have also noticed that most virus flags of Sine occur on Windows. This enables us to believe that the existence and the execution of a batch script is a high red flag for many antiviruses, but it doesn't stop there. If an antivirus is skilled enough to look forwards into the batch script and recognize that the batch script requests admin permissions and makes modifications to existing programs (Firefox, to install Sine's bootloader), it most likely will not be happy with that.

When you pair both of these red flags together with the fact that Sine's installer is not code-signed (would cost money), an antivirus would be inclined to flag Sine as a virus.

What steps are we taking to fix this?

• We have applied for a code signing certificate from SignPath, and you can stay up-to-date on that in this issue. (this is the most likely option to reduce trojan and virus false-positives)
• We have improved our release provenance and ensured that every release step is traceable and verifiable. (Improve Release Provenance #475)
• We have switched to using immutable releases from now on, so public release assets cannot be changed after being published. (Improve Release Provenance #475)

How can you know Sine is safe?

Great question. We open-source all of our code, so you can take deep dives into it and fully understand what the installer does and what Sine does in it's entirety. Nothing is private. Even our release process is publicized.

Sine GitHub organization (official): https://github.com/sineorg
Installer source code: https://github.com/sineorg/installer
Bootloader source code: https://github.com/sineorg/bootloader
Store source code: https://github.com/sineorg/store
Sine source code: https://github.com/CosmoCreeper/Sine

What steps can I take to help?

The best thing you can do is report these false-positives in their entirety to both us and your antivirus. Share proof to them about how it's safe and ask that they take a look into it. If they can do no more but tell you why it is being flagged, then send it to us. We need to know how to move forwards and how to fix these false-positives, especially from the maintainers of the antiviruses themselves.

[darenrue]

windows 11 bitdefender Gen:Variant.Tedy.977415 already reported to bd for now

[CosmoCreeper]

The most commonly flagged virus by Microsoft Defender appears to be Trojan:Win32/Kepavll!rfn. The full Microsoft description of this virus is as follows:

Trojan:Win32/Kepavll!rfn heuristic detection label for malicious software based on the behavior associated with the trojan-type malware. It spreads via software installs that piggybacks from legitimate software installers. Many legitimate apps online are repackaged to include installation of drive-by apps. The "!rfn" suffix means that the detection was based on monitoring the device for suspicious activities and behavioral heuristics rather than traditional virus signature matching.

Every attempt to instantiate detection of Kepavll can often result in false positives, as it behaves similar to game modding tools, legit system utilities, and software development apps. This makes Kepavll very difficult to identify post-infection, it can also function as loaders or downloaders, to retrieve additional malicious payloads from a remote command and control (C2) servers. This causes full system compromise opening the device to more malware and backdoor infections.

Even Microsoft claims that this type of virus can commonly be a false positive as certain programs behave like it. I'm going to combine malware descriptions from different vendors to see if I can determine the source of these flags. My best guess is it's either the batch script or modification of program files.

[CosmoCreeper]

I'm not sure exactly what the AI in Malwarebytes detected falsely in our software, but at least we know it's an artificial intelligence, which can also be prone to false positives.

Note

I have just now reported this false positive to Malwarebytes.

Type: Malware
Name: Malware.AI.3190729070 (reproduced locally as well)
Vendor: Malwarebytes

Type description:

Malware.AI.(id-nr) are detection names created by our automated signature system, run by one of our proprietary detection engines. Our various engines provide different layers of protection that rely on machine learning technology with autonomous learning, harnessing the compute power of Artificial Intelligence to make near real-time decisions. This is especially helpful in spotting zero-minute malware as the detection system looks at small components and file behavior to quickly parse the files to spot known bad (or good) elements, making a highly accurate determination on the file. Malwarebytes has been using this technology for nearly a decade to quickly spot malware, adware, and other threat tactics. Our experts provide another layer of protection, investigating additional contextual information, guiding the machine learning and AI tools, and providing regular updates to improve detection capabilities.

[spectrum705]

i got this threat message. what should i do ?

[CosmoCreeper]

@spectrum705 I have listed the false positive that your antivirus found in the original issue, but if you're having trouble installing Sine because of this, you can simply add an exception to it in Microsoft Defender, as long as the installer you fetched is from https://github.com/CosmoCreeper/Sine/releases/download/v2.3.3/sine-win-x64.exe exactly. (otherwise it's not official, and may contain actual malware)

[CosmoCreeper]

Also an update on this issue. I've made a change to future installers that should bring the VirusTotal scan results from 44 vendors flagging it as malware, to just 9. At least that's what VirusTotal tells me. The full scans are listed below.

This link is a scan of the v2.3.3 installer:
https://www.virustotal.com/gui/file/5cc6bc9d4e00a78059aa47217b0a0db3e52438354d1988c35ddf8aebda3a8dde/detection
While this link is a scan of the new installer that isn't out yet:
https://www.virustotal.com/gui/file/6e1c0de23348b6f5713f9f808ffb3e252f7278108e8105aeddbf7e158a0162e4/detection

However, these results may change, especially when they are published on the release, as it can change certain data that may change antivirus results. Not entirely sure why, just know that it happens.

[lishaduck]

And @spectrum705, you can check that it's the right installer from the hash: sha256:5cc6bc9d4e00a78059aa47217b0a0db3e52438354d1988c35ddf8aebda3a8dde.

Cosmo: Just curious, what tweaks did you make?

[spectrum705]

And @spectrum705, you can check that it's the right installer from the hash: sha256:5cc6bc9d4e00a78059aa47217b0a0db3e52438354d1988c35ddf8aebda3a8dde.

Cosmo: Just curious, what tweaks did you make?

how do i check with the hash?

[spectrum705]

@spectrum705 I have listed the false positive that your antivirus found in the original issue, but if you're having trouble installing Sine because of this, you can simply add an exception to it in Microsoft Defender, as long as the installer you fetched is from https://github.com/CosmoCreeper/Sine/releases/download/v2.3.3/sine-win-x64.exe exactly. (otherwise it's not official, and may contain actual malware)

yeah i only remember getting these from github releases so

[CosmoCreeper]

Cosmo: Just curious, what tweaks did you make?

I added an app.manifest and rc file to the installer. It basically tells Windows and other programs details about your executable. Most of the time, CMake automatically generates one, but by making it myself I can specify details that clarify the publisher to AVs as well as clarifying the original executable name so AVs can confirm it's the same.

[darenrue]

Bitdefender has responded and the file was found to be clean

[CosmoCreeper]

Nice. I'm still waiting for a response from Malwarebytes.

[maltsea]

Got pinged by Malwarebytes as "Riskware.Injector"
Using W11.
I don't even get a specific one, just generic. :(