CPU-Z and HWMonitor compromised
https://old.reddit.com/r/pcmasterrace/comments/1sh4e5l/warni...
https://www.bleepingcomputer.com/news/security/supply-chain-...
- john_strinlai - 17767 sekunder sedansome comments purportedly (i did not verify) from one of the maintainers:
>Dear All, I'm Sam and in I'm working with Franck on CPU-Z (I'm doing the validator). Franck is unfortunately OOO for a couple weeks. I'm just out of bed after worked on Memtest86+ for most the night, so I'm doing my best to check everything. As very first checks, the file on our server looks fine (https://www.virustotal.com/gui/file/6c8faba4768754c3364e7c40...) and the server doesn't seems compromised. I'm investigating further... If anyone can tell me the exact link to the page where the malware was downloaded, that would help a lot
>Thank you. I found the biggest breach, restored the links and put everything in read-only until more investigation is done. Seems they waited Franck was off and I get to bad after working on Memtest86+ yesterday :-/
>The links have been compromised for a bit more than 6 hours between 09/04 and 10/04 GMT :-/
so, it appears that the cpuid website was compromised, with links leading to fake installers.
- quantummagic - 16169 sekunder sedan> after the download my Windows Defender instantly detecting a virus.
> (because i am often working with programms which triggering the defender i just ignored that)
This again shows the unfortunate corrosive effect of false-positives. Probably impossible to solve while aggressively detecting viruses though.
- jl6 - 15721 sekunder sedanTo our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.
- cachius - 18267 sekunder sedanIt's HWMonitor https://www.cpuid.com/softwares/hwmonitor.html and not HWInfo https://www.hwinfo.com/
So two programs from CPUID. I wonder if there are more affected.
Same topic on Reddit at https://news.ycombinator.com/item?id=47718830 @dang
- orthogonal_cube - 17998 sekunder sedanSeems the installers hosted by them are fine. The links on the site have been changed to direct people towards Cloudflare R2 storage with various copies of malicious executables.
Looking forward to information down the line on how this came about.
- kyrra - 16373 sekunder sedanFor windows users, this is an advantage of using `winget` for installing things. It points to the installer hosted elsewhere, but it at least does a signature check. The config for the latest installer is listed here: https://github.com/microsoft/winget-pkgs/blob/master/manifes...
which you can install with:
(there is a --version flag where you can specify "2.19", which the signature there is a month old, so it should be safe to install that way)winget install --exact --id CPUID.CPU-Z - kevincloudsec - 19241 sekunder sedansame threat group hit filezilla last month with a fake domain. this time they didn't even need a fake domain, they compromised the real one's api layer. the attack is evolving from 'trick users into visiting the wrong site' to 'make the right site serve the wrong file.'
- cachius - 18883 sekunder sedanThis is bad. I like to install software with winget. Are the versions there also compromised?
v1.63 updated 6 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.HWMonitor
v2.19 updated 15 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.CPU-Z
- amatecha - 17571 sekunder sedansome good details here https://xcancel.com/vxunderground/status/2042483067655262461
- kevincloudsec - 19342 sekunder sedansame threat group hit filezilla last month. they're specifically targeting utilities that tech-savvy users trust and download from official sources. the attack surface is the the api layer that generates download links, not the binary itself
- moomoo11 - 2321 sekunder sedanOne interesting thing about all this stuff is that we may see a big swing towards paid/trusted solutions for all these type of things.
Maybe the 5-10% of true nerds will go find the l33t open source solutions, but most people will just use some paid solution.
Maybe Steam could build. Or in Windows. Or some SaaS solution for registry.
In exchange you just share your HW info
- cachius - 16019 sekunder sedanGrok post linking further sources: https://x.com/i/grok/share/3b870ceb9b424c01bf89afbe0de3bd81
- BoredPositron - 13518 sekunder sedan"Bug fixes and general improvements."
Supply chain attacks are easier because changelogs for most software are useless now if they are provided at all.
- - 11203 sekunder sedan
- unethical_ban - 16093 sekunder sedanI've wondered about this while using CachyOS and their package installer. I don't know what repos do what, I don't really understand the security model of the AUR, and I wonder, if I download a package, how can I know it's legitimate or otherwise by some trusted user of the community vs. some random person?
- wang_li - 18236 sekunder sedanJesus. I see that post and comment section and I immediately expect to hear Joey telling me about how this ATM is Idaho started spraying cash after his hack of the Gibson. That is a real-life reproduction of the perception of hackers in films in the '90s.
- - 17672 sekunder sedan
Nördnytt! 🤓