search

Podshot / MCEdit-Unified

Combined MCEdit & Pymclevel repository.
http://podshot.github.io/MCEdit-Unified/
ISC License
479 stars 108 forks source link

Asking for access to Contacts and Calendar #997

Open Tilma11 opened 4 years ago

Tilma11 commented 4 years ago

MCEdit Unified bug report template. For MCEdit 2.0 bugs see here : https://github.com/mcedit/mcedit2

Possible trojan? Initial launch of v1.5.6.0 for macOS, downloaded from mcedit-unified.net (which appears to connect to https://github.com/Podshot/MCEdit-Unified/releases/download/1.5.6.0/MCEdit.v1.5.6.0.OSX.64bit.zip), results in a request for access to Contacts and Calendar

MCEdit Version: 1.5.6.0

Minecraft Version the world was last opened in: n/a

Operating System: macOS 10.14

A screenshot or full text of the error from the console: n/a

How to reproduce: Download macOS v1.5.6.0 zip from mcedit-unified.net; launch in macOS.

kyleplo commented 4 years ago

Yes i think this is some kind of virus

Podshot commented 4 years ago

@Tilma11 We have no code in the application that accesses either of these things, so it might be due to a security thing in macOS or the process our compiler uses to make it compatible with macOS. However, I don't have a Mac to reproduce this on, thus I cannot confirm if this is a one off issue or not, since we've not received many reports of this happening from our official downloads to my knowledge.

@kyleplo If you have a reason to suspect we have malicious code in our codebase, please refer me to it so I can look it over and remove it if necessary

fluxens commented 4 years ago

@Podshot Can confirm that the application requests calendar access on macOS 10.15.5 (19F101) when trying to open a world.

filename: MCEdit.v1.5.6.0.OSX.64bit.zip (md5 8952c169f7e51d3ff2e7ce1de0dd312b) Downloaded from http://podshot.github.io/MCEdit-Unified/