7 ms·
CPU-Z and HWMonitor compromised
https://xcancel.com/vxunderground/status/2042483067655262461 https://xcancel.com/vxunderground/status/2042483067655262461
https://old.reddit.com/r/pcmasterrace/comments/1sh4e5l/warning_hwmonitor_163_download_on_the_official/ https://old.reddit.com/r/pcmasterrace/comments/1sh4e5l/warni...
https://www.bleepingcomputer.com/news/security/supply-chain-attack-at-cpuid-pushes-malware-with-cpu-z-hwmonitor/ https://www.bleepingcomputer.com/news/security/supply-chain-...
- _slih 5mo ago[flagged]
- _slih 5mo agosame threat group hit filezilla last month with a fake domain. this time they didn't even need a fake domain, they compromised the real one's api layer. the attack is evolving from 'trick users into visiting the wrong site' to 'make the right site serve the wrong file.'
- turpentine 5mo agoFileZilla has had a history of intentionally bunding adware/spyware, so aren't they the threat to begin with? https://en.wikipedia.org/wiki/FileZilla#Bundled_adware_issues https://en.wikipedia.org/wiki/FileZilla#Bundled_adware_issue...
- cachius 5mo agoThis is bad. I like to install software with winget. Are the versions there also compromised? v1.63 updated 6 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifests/c/CPUID/HWMonitor/1.63 https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.HWMonitor https://winstall.app/apps/CPUID.HWMonitor v2.19 updated 15 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifests/c/CPUID/CPU-Z/2.19 https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.CPU-Z https://winstall.app/apps/CPUID.CPU-Z
- deleted 5mo ago[deleted]
- wang_li 5mo agoJesus. I see that post and comment section and I immediately expect to hear Joey telling me about how this ATM is Idaho started spraying cash after his hack of the Gibson. That is a real-life reproduction of the perception of hackers in films in the '90s.
- vntok 5mo agoFrom the thread: > Q: Why the heck did you hyperlink [the malware installer]? > A: If someone reads this and they still click the download then they kind of deserve the virus tbh
- metalliqaz 5mo agosomeone has some l33t sk1llz
- daneel_w 5mo agoAnd CSI: Miami, which kept the vibe alive through the 2000s and "educated the masses" on how IT works. Beep boop, I'm in.
- cachius 5mo agoIt's HWMonitor https://www.cpuid.com/softwares/hwmonitor.html https://www.cpuid.com/softwares/hwmonitor.html and not HWInfo https://www.hwinfo.com/ https://www.hwinfo.com/ So two programs from CPUID. I wonder if there are more affected. Same topic on Reddit at https://news.ycombinator.com/item?id=47718830 https://news.ycombinator.com/item?id=47718830 @dang
- orthogonal_cube 5mo agoSeems the installers hosted by them are fine. The links on the site have been changed to direct people towards Cloudflare R2 storage with various copies of malicious executables. Looking forward to information down the line on how this came about.
- 1970-01-01 5mo agoNot exactly a supply chain compromise, as devs should be smart enough to update via a package manager such as winget and chocolatey, but it certainly fits for a watering hole attack.
- Terr_ 5mo agoI suppose one could view it as a supply-chain compromise of an alternate chain that's very short.
- deleted 5mo ago[deleted]
- deleted 5mo ago[deleted]
- john_strinlai 5mo agosome comments purportedly (i did not verify) from one of the maintainers: >Dear All, I'm Sam and in I'm working with Franck on CPU-Z (I'm doing the validator). Franck is unfortunately OOO for a couple weeks. I'm just out of bed after worked on Memtest86+ for most the night, so I'm doing my best to check everything. As very first checks, the file on our server looks fine (https://www.virustotal.com/gui/file/6c8faba4768754c3364e7c400a9d79ccbece156087be607583619f11a09cb064 https://www.virustotal.com/gui/file/6c8faba4768754c3364e7c40...) and the server doesn't seems compromised. I'm investigating further... If anyone can tell me the exact link to the page where the malware was downloaded, that would help a lot >Thank you. I found the biggest breach, restored the links and put everything in read-only until more investigation is done. Seems they waited Franck was off and I get to bad after working on Memtest86+ yesterday :-/ >The links have been compromised for a bit more than 6 hours between 09/04 and 10/04 GMT :-/ so, it appears that the cpuid website was compromised, with links leading to fake installers.
- BoredPositron 5mo agoIt's the third time that I've read something about availability notifications on discord and other chats getting abused for timed attacks in the last few weeks.
- magicalhippo 5mo agoAfter my Wordpress site got hacked way back through an exploit in one of the WP files, I set up a cron job that compared the hash of the static files with expected hash, and would fire off an email if they differed. The script lived above the web root, so they'd have to escape that to tamper with it, and was generated by another script. Saved me a couple of times since, well worth the 15 minutes I spent on setting it up.
- embedding-shape 5mo ago> Saved me a couple of times since Wait, how often does your Wordpress site get successfully hacked like that?
- amatecha 5mo agosome good details here https://xcancel.com/vxunderground/status/2042483067655262461 https://xcancel.com/vxunderground/status/2042483067655262461
- kyrra 5mo agoFor windows users, this is an advantage of using `winget` for installing things. It points to the installer hosted elsewhere, but it at least does a signature check. The config for the latest installer is listed here: https://github.com/microsoft/winget-pkgs/blob/master/manifests/c/CPUID/CPU-Z/2.19/CPUID.CPU-Z.installer.yaml https://github.com/microsoft/winget-pkgs/blob/master/manifes... which you can install with: winget install --exact --id CPUID.CPU-Z (there is a --version flag where you can specify "2.19", which the signature there is a month old, so it should be safe to install that way)
- ww520 5mo agoYes. Winget is getting better support on Windows apps. The other day I tried to download the latest version of ImageMagick but all the links on the official site were bad. I tried Winget and it had it!
- eviks 5mo agoThis manifest only shows sha checks, which wouldn't help if the manifest is updated during the site compromise. How does it do the signature check?
- actionfromafar 5mo agoPresumably the manifest is in github and won't auto-update when something on the CPU-Z website changes?
- eviks 5mo agoWhat do you mean, how would it get the new version name/hash if not following the changes on the website?
- kyrra 5mo agoI think you should spend the 5 minutes it takes to look at the winget-pkg repo to see how it works. There's lots of great documentation. All updates are manual, and are done via pull requests. Check everything in-queue: https://github.com/microsoft/winget-pkgs/pulls https://github.com/microsoft/winget-pkgs/pulls Existing versions don't tend to have their metadata updated (I'm not sure winget would accept it). Only new versions are supported. You can see all the checks that go into cpu-z updates with the latest PR: https://github.com/microsoft/winget-pkgs/pull/349095 https://github.com/microsoft/winget-pkgs/pull/349095
- quantummagic 5mo ago> after the download my Windows Defender instantly detecting a virus. > (because i am often working with programms which triggering the defender i just ignored that) This again shows the unfortunate corrosive effect of false-positives. Probably impossible to solve while aggressively detecting viruses though.
- pshirshov 5mo agoBut sorta possible to solve with source-based distribution and totally possible to solve with pure reproducible builds.
- daveguy 5mo agoWhat systems have pure reproducible builds? Does Nix? Any others? From what I understand, it is a very difficult problem.
- pshirshov 5mo agohttps://stal-ix.github.io/ https://stal-ix.github.io/ and Guix, but the definitions of purity are different for them. Yes, a very difficult problem, compilers must be pure functions with thin effectful wrappers.
- gertop 5mo agoIt's entirely possible to ship malware in source form... Just look at the numerous supply chain attacks. Nix is a cute project but entirely irrelevant here.
- miniBill 5mo agoIt is possible but visible, and it means burning an identity, so it's not irrelevant
- Thorrez 5mo agoBurning an identity? Instead of hacking the server that serves the binary, you have to hack the developer's machine and commit a malicious source change. I wouldn't consider either of them to burn an identity.
- unethical_ban 5mo agoI've wondered about this while using CachyOS and their package installer. I don't know what repos do what, I don't really understand the security model of the AUR, and I wonder, if I download a package, how can I know it's legitimate or otherwise by some trusted user of the community vs. some random person?
- cephi 5mo agoTo provide some quick information (I implore others to correct me here): - CachyOS packages should be coming from known, trusted CachyOS and Arch Linux maintainers. There is still potential for them or their original packages to get compromised (See XZ backdoor) however they are pulling source code from trusted sources so you can generally trust these as much as your trust the OS itself. - AUR packages are a complete wild west. AUR packages are defined by PKGBUILD files and I highly recommend learning how to read PKGBUILDs and always reading them before installation and re-reading them when they are updated. PKGBUILDs for AUR packages can be treated as untrusted shell scripts and to a certain extent an arbitrary actor can make and upload any PKGBUILD to the AUR. Feel free to use them, but make sure A) they are downloading from trusted sources like the original git repo and B) they are running commands that are expected. EDIT: Improved accuracy.
- cachius 5mo agoGrok post linking further sources: https://x.com/i/grok/share/3b870ceb9b424c01bf89afbe0de3bd81 https://x.com/i/grok/share/3b870ceb9b424c01bf89afbe0de3bd81
- jl6 5mo agoTo our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.
- deleted 5mo ago[deleted]
- mikestorrent 5mo agoIs there a tool out there that you can put software releases into and it will tell you how safe it is? I don't seem to be able to buy anything to do this. Crowdstrike and other modern antivirus may react to it once it's on a device, SAST / SCA tooling will help with CVEs, but there's nothing I can give my users where they can put in some piece of random software and get a reputation metric out the other side, is there?
- Foobar8568 5mo agoBeside Virus Total, I am unsure https://www.virustotal.com/ https://www.virustotal.com/
- mikestorrent 5mo agoThanks, that's helpful
- __natty__ 5mo agoNot exactly for software (although there is such section) but I use end of life [0] website. Besides time when certain software will be outdated it also tells you their release time. [0] https://endoflife.date/ https://endoflife.date/
- seanw444 5mo agoYou could put it into an LLM, since that's what we do for everything else nowadays.
- vladvasiliu 5mo ago> put in some piece of random software and get a reputation metric out the other side Well, the enterprise version of ms defender will not only react to it if it does something "weird", but will specifically look at its "reputation" before it runs at all. However, as another commenter pointed out, this generates a ton of false positives. Basically everything that's "brand new" is liable to trigger it. Think your freshly compiled hellow_world.exe. So, all in all, people may no longer pay attention to it and just click through all warnings.
- BoredPositron 5mo ago"Bug fixes and general improvements." Supply chain attacks are easier because changelogs for most software are useless now if they are provided at all.
- ziml77 5mo ago"Fix for a critical issue when querying the CPU that could lead to data corruption in other processes executing at the same time" Or, "hey ChatGPT generate me a changelog for updates and fixes I could make to the software CPU-Z" Expecting a more detailed changelog doesn't help at all (I'm not even sure you'd need to prompt an LLM around guardrails like I did here, it would probably happily spit out a fake changelog even if you were explicit about it not being real as long as you don't tell the LLM you're planning to trick people with malware)
- linzhangrun 5mo ago[flagged]
- deleted 5mo ago[deleted]
- moomoo11 5mo agoOne interesting thing about all this stuff is that we may see a big swing towards paid/trusted solutions for all these type of things. Maybe the 5-10% of true nerds will go find the l33t open source solutions, but most people will just use some paid solution. Maybe Steam could build. Or in Windows. Or some SaaS solution for registry. In exchange you just share your HW info
- userbinator 5mo agoIf one were conspiratorially-minded, one would even be inclined to believe that these were deliberately done to push us towards that authoritarian dystopia of "trusted computing".
- linzhangrun 5mo ago[flagged]
- ASalazarMX 5mo agoJust my luck that I needed and downloaded CPU-Z yesterday at work, after not needing it for years. Fortunately my download is not detected as malicious by Virustotal, but what a scare.
- VimEscapeArtist 5mo agoWait, people still download unsigned exes from PHP-era websites in 2026? And then act surprised when the download link starts pointing to malware? At this point if your software isn't distributed through a repo with verifiable builds, you're basically running a malware lottery for your users. The only question is when, not if. CPUID got lucky it was only 6 hours. Imagine if the attackers had better taste in filenames than "HWiNFO_Monitor_Setup.exe" lmao
- mjmas 5mo ago> PHP-era PHP-era is still today
- redoh 5mo ago[flagged]
- hybirdss 5mo ago[dead]
- hawk_aa 5mo ago[dead]
- Leomuck 5mo agoIs anything not potentially compromised these days? Wow.