7 ms·
CPU-Z and HWMonitor compromised
https://xcancel.com/vxunderground/status/2042483067655262461 https://xcancel.com/vxunderground/status/2042483067655262461
https://old.reddit.com/r/pcmasterrace/comments/1sh4e5l/warning_hwmonitor_163_download_on_the_official/ https://old.reddit.com/r/pcmasterrace/comments/1sh4e5l/warni...
https://www.bleepingcomputer.com/news/security/supply-chain-attack-at-cpuid-pushes-malware-with-cpu-z-hwmonitor/ https://www.bleepingcomputer.com/news/security/supply-chain-...
- _slih 6mo ago[flagged]
- _slih 6mo agosame threat group hit filezilla last month with a fake domain. this time they didn't even need a fake domain, they compromised the real one's api layer. the attack is evolving from 'trick users into visiting the wrong site' to 'make the right site serve the wrong file.'
- turpentine 6mo agoFileZilla has had a history of intentionally bunding adware/spyware, so aren't they the threat to begin with? https://en.wikipedia.org/wiki/FileZilla#Bundled_adware_issues https://en.wikipedia.org/wiki/FileZilla#Bundled_adware_issue...
- cachius 6mo agoThis is bad. I like to install software with winget. Are the versions there also compromised? v1.63 updated 6 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifests/c/CPUID/HWMonitor/1.63 https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.HWMonitor https://winstall.app/apps/CPUID.HWMonitor v2.19 updated 15 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifests/c/CPUID/CPU-Z/2.19 https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.CPU-Z https://winstall.app/apps/CPUID.CPU-Z
- deleted 6mo ago[deleted]
- cachius 6mo agoIt's HWMonitor https://www.cpuid.com/softwares/hwmonitor.html https://www.cpuid.com/softwares/hwmonitor.html and not HWInfo https://www.hwinfo.com/ https://www.hwinfo.com/ So two programs from CPUID. I wonder if there are more affected. Same topic on Reddit at https://news.ycombinator.com/item?id=47718830 https://news.ycombinator.com/item?id=47718830 @dang
- wang_li 6mo agoJesus. I see that post and comment section and I immediately expect to hear Joey telling me about how this ATM is Idaho started spraying cash after his hack of the Gibson. That is a real-life reproduction of the perception of hackers in films in the '90s.
- metalliqaz 6mo agosomeone has some l33t sk1llz
- vntok 6mo agoFrom the thread: > Q: Why the heck did you hyperlink [the malware installer]? > A: If someone reads this and they still click the download then they kind of deserve the virus tbh
- daneel_w 6mo agoAnd CSI: Miami, which kept the vibe alive through the 2000s and "educated the masses" on how IT works. Beep boop, I'm in.
- orthogonal_cube 6mo agoSeems the installers hosted by them are fine. The links on the site have been changed to direct people towards Cloudflare R2 storage with various copies of malicious executables. Looking forward to information down the line on how this came about.
- 1970-01-01 6mo agoNot exactly a supply chain compromise, as devs should be smart enough to update via a package manager such as winget and chocolatey, but it certainly fits for a watering hole attack.
- Terr_ 6mo agoI suppose one could view it as a supply-chain compromise of an alternate chain that's very short.
- john_strinlai 6mo agosome comments purportedly (i did not verify) from one of the maintainers: >Dear All, I'm Sam and in I'm working with Franck on CPU-Z (I'm doing the validator). Franck is unfortunately OOO for a couple weeks. I'm just out of bed after worked on Memtest86+ for most the night, so I'm doing my best to check everything. As very first checks, the file on our server looks fine (https://www.virustotal.com/gui/file/6c8faba4768754c3364e7c400a9d79ccbece156087be607583619f11a09cb064 https://www.virustotal.com/gui/file/6c8faba4768754c3364e7c40...) and the server doesn't seems compromised. I'm investigating further... If anyone can tell me the exact link to the page where the malware was downloaded, that would help a lot >Thank you. I found the biggest breach, restored the links and put everything in read-only until more investigation is done. Seems they waited Franck was off and I get to bad after working on Memtest86+ yesterday :-/ >The links have been compromised for a bit more than 6 hours between 09/04 and 10/04 GMT :-/ so, it appears that the cpuid website was compromised, with links leading to fake installers.
- BoredPositron 6mo agoIt's the third time that I've read something about availability notifications on discord and other chats getting abused for timed attacks in the last few weeks.
- magicalhippo 6mo agoAfter my Wordpress site got hacked way back through an exploit in one of the WP files, I set up a cron job that compared the hash of the static files with expected hash, and would fire off an email if they differed. The script lived above the web root, so they'd have to escape that to tamper with it, and was generated by another script. Saved me a couple of times since, well worth the 15 minutes I spent on setting it up.
- embedding-shape 6mo ago> Saved me a couple of times since Wait, how often does your Wordpress site get successfully hacked like that?
- deleted 6mo ago[deleted]
- deleted 6mo ago[deleted]
- amatecha 6mo agosome good details here https://xcancel.com/vxunderground/status/2042483067655262461 https://xcancel.com/vxunderground/status/2042483067655262461
- kyrra 6mo agoFor windows users, this is an advantage of using `winget` for installing things. It points to the installer hosted elsewhere, but it at least does a signature check. The config for the latest installer is listed here: https://github.com/microsoft/winget-pkgs/blob/master/manifests/c/CPUID/CPU-Z/2.19/CPUID.CPU-Z.installer.yaml https://github.com/microsoft/winget-pkgs/blob/master/manifes... which you can install with: winget install --exact --id CPUID.CPU-Z (there is a --version flag where you can specify "2.19", which the signature there is a month old, so it should be safe to install that way)
- eviks 6mo agoThis manifest only shows sha checks, which wouldn't help if the manifest is updated during the site compromise. How does it do the signature check?
- actionfromafar 6mo agoPresumably the manifest is in github and won't auto-update when something on the CPU-Z website changes?
- eviks 6mo agoWhat do you mean, how would it get the new version name/hash if not following the changes on the website?
- kyrra 6mo agoI think you should spend the 5 minutes it takes to look at the winget-pkg repo to see how it works. There's lots of great documentation. All updates are manual, and are done via pull requests. Check everything in-queue: https://github.com/microsoft/winget-pkgs/pulls https://github.com/microsoft/winget-pkgs/pulls Existing versions don't tend to have their metadata updated (I'm not sure winget would accept it). Only new versions are supported. You can see all the checks that go into cpu-z updates with the latest PR: https://github.com/microsoft/winget-pkgs/pull/349095 https://github.com/microsoft/winget-pkgs/pull/349095
- quantummagic 6mo ago> after the download my Windows Defender instantly detecting a virus. > (because i am often working with programms which triggering the defender i just ignored that) This again shows the unfortunate corrosive effect of false-positives. Probably impossible to solve while aggressively detecting viruses though.
- pshirshov 6mo agoBut sorta possible to solve with source-based distribution and totally possible to solve with pure reproducible builds.
- daveguy 6mo agoWhat systems have pure reproducible builds? Does Nix? Any others? From what I understand, it is a very difficult problem.
- pshirshov 6mo agohttps://stal-ix.github.io/ https://stal-ix.github.io/ and Guix, but the definitions of purity are different for them. Yes, a very difficult problem, compilers must be pure functions with thin effectful wrappers.
- gertop 6mo agoIt's entirely possible to ship malware in source form... Just look at the numerous supply chain attacks. Nix is a cute project but entirely irrelevant here.
- miniBill 6mo agoIt is possible but visible, and it means burning an identity, so it's not irrelevant
- Thorrez 6mo agoBurning an identity? Instead of hacking the server that serves the binary, you have to hack the developer's machine and commit a malicious source change. I wouldn't consider either of them to burn an identity.
- unethical_ban 6mo agoI've wondered about this while using CachyOS and their package installer. I don't know what repos do what, I don't really understand the security model of the AUR, and I wonder, if I download a package, how can I know it's legitimate or otherwise by some trusted user of the community vs. some random person?
- cephi 6mo agoTo provide some quick information (I implore others to correct me here): - CachyOS packages should be coming from known, trusted CachyOS and Arch Linux maintainers. There is still potential for them or their original packages to get compromised (See XZ backdoor) however they are pulling source code from trusted sources so you can generally trust these as much as your trust the OS itself. - AUR packages are a complete wild west. AUR packages are defined by PKGBUILD files and I highly recommend learning how to read PKGBUILDs and always reading them before installation and re-reading them when they are updated. PKGBUILDs for AUR packages can be treated as untrusted shell scripts and to a certain extent an arbitrary actor can make and upload any PKGBUILD to the AUR. Feel free to use them, but make sure A) they are downloading from trusted sources like the original git repo and B) they are running commands that are expected. EDIT: Improved accuracy.
- cachius 6mo agoGrok post linking further sources: https://x.com/i/grok/share/3b870ceb9b424c01bf89afbe0de3bd81 https://x.com/i/grok/share/3b870ceb9b424c01bf89afbe0de3bd81
- jl6 6mo agoTo our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.
- deleted 6mo ago[deleted]
- mikestorrent 6mo agoIs there a tool out there that you can put software releases into and it will tell you how safe it is? I don't seem to be able to buy anything to do this. Crowdstrike and other modern antivirus may react to it once it's on a device, SAST / SCA tooling will help with CVEs, but there's nothing I can give my users where they can put in some piece of random software and get a reputation metric out the other side, is there?
- Foobar8568 6mo agoBeside Virus Total, I am unsure https://www.virustotal.com/ https://www.virustotal.com/
- mikestorrent 6mo agoThanks, that's helpful
- __natty__ 6mo agoNot exactly for software (although there is such section) but I use end of life [0] website. Besides time when certain software will be outdated it also tells you their release time. [0] https://endoflife.date/ https://endoflife.date/
- seanw444 6mo agoYou could put it into an LLM, since that's what we do for everything else nowadays.
- vladvasiliu 6mo ago> put in some piece of random software and get a reputation metric out the other side Well, the enterprise version of ms defender will not only react to it if it does something "weird", but will specifically look at its "reputation" before it runs at all. However, as another commenter pointed out, this generates a ton of false positives. Basically everything that's "brand new" is liable to trigger it. Think your freshly compiled hellow_world.exe. So, all in all, people may no longer pay attention to it and just click through all warnings.
- BoredPositron 6mo ago"Bug fixes and general improvements." Supply chain attacks are easier because changelogs for most software are useless now if they are provided at all.
- ziml77 6mo ago"Fix for a critical issue when querying the CPU that could lead to data corruption in other processes executing at the same time" Or, "hey ChatGPT generate me a changelog for updates and fixes I could make to the software CPU-Z" Expecting a more detailed changelog doesn't help at all (I'm not even sure you'd need to prompt an LLM around guardrails like I did here, it would probably happily spit out a fake changelog even if you were explicit about it not being real as long as you don't tell the LLM you're planning to trick people with malware)
- linzhangrun 6mo ago[flagged]
- deleted 6mo ago[deleted]
- moomoo11 6mo agoOne interesting thing about all this stuff is that we may see a big swing towards paid/trusted solutions for all these type of things. Maybe the 5-10% of true nerds will go find the l33t open source solutions, but most people will just use some paid solution. Maybe Steam could build. Or in Windows. Or some SaaS solution for registry. In exchange you just share your HW info
- userbinator 6mo agoIf one were conspiratorially-minded, one would even be inclined to believe that these were deliberately done to push us towards that authoritarian dystopia of "trusted computing".
- linzhangrun 6mo ago[flagged]
- ASalazarMX 6mo agoJust my luck that I needed and downloaded CPU-Z yesterday at work, after not needing it for years. Fortunately my download is not detected as malicious by Virustotal, but what a scare.
- VimEscapeArtist 6mo agoWait, people still download unsigned exes from PHP-era websites in 2026? And then act surprised when the download link starts pointing to malware? At this point if your software isn't distributed through a repo with verifiable builds, you're basically running a malware lottery for your users. The only question is when, not if. CPUID got lucky it was only 6 hours. Imagine if the attackers had better taste in filenames than "HWiNFO_Monitor_Setup.exe" lmao
- mjmas 6mo ago> PHP-era PHP-era is still today
- redoh 6mo ago[flagged]
- hybirdss 6mo ago[dead]
- hawk_aa 6mo ago[dead]
- Leomuck 6mo agoIs anything not potentially compromised these days? Wow.