CPU-Z and HWMonitor compromised
1–10 of 118 posts
Re: CPU-Z and HWMonitor compromised
#2[flagged]
Re: CPU-Z and HWMonitor compromised
#3same threat group hit filezilla last month with a fake domain. this time they didn't even need a fake domain, they compromised the real one's api layer. the attack is evolving from 'trick users into visiting the wrong site' to 'make the right site serve the wrong file.'
Re: CPU-Z and HWMonitor compromised
#4This is bad. I like to install software with winget. Are the versions there also compromised?
v1.63 updated 6 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.HWMonitor
v2.19 updated 15 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.CPU-Z
Re: CPU-Z and HWMonitor compromised
#5It's HWMonitor https://www.cpuid.com/softwares/hwmonitor.html and not HWInfo https://www.hwinfo.com/
So two programs from CPUID. I wonder if there are more affected.
Same topic on Reddit at https://news.ycombinator.com/item?id=47718830 @dang
Re: CPU-Z and HWMonitor compromised
#6Jesus. I see that post and comment section and I immediately expect to hear Joey telling me about how this ATM is Idaho started spraying cash after his hack of the Gibson. That is a real-life reproduction of the perception of hackers in films in the '90s.
Re: CPU-Z and HWMonitor compromised
#7Seems the installers hosted by them are fine. The links on the site have been changed to direct people towards Cloudflare R2 storage with various copies of malicious executables.
Looking forward to information down the line on how this came about.
Re: CPU-Z and HWMonitor compromised
#8Jesus. I see that post and comment section and I immediately expect to hear Joey telling me about how this ATM is Idaho started spraying cash after his hack of the Gibson. That is a real-life reproduction of the perception of hackers in films in the '90s.
someone has some l33t sk1llz
Re: CPU-Z and HWMonitor compromised
#9some comments purportedly (i did not verify) from one of the maintainers:
>Dear All, I'm Sam and in I'm working with Franck on CPU-Z (I'm doing the validator). Franck is unfortunately OOO for a couple weeks. I'm just out of bed after worked on Memtest86+ for most the night, so I'm doing my best to check everything. As very first checks, the file on our server looks fine (https://www.virustotal.com/gui/file/6c8faba4768754c3364e7c40...) and the server doesn't seems compromised. I'm investigating further... If anyone can tell me the exact link to the page where the malware was downloaded, that would help a lot
>Thank you. I found the biggest breach, restored the links and put everything in read-only until more investigation is done. Seems they waited Franck was off and I get to bad after working on Memtest86+ yesterday :-/
>The links have been compromised for a bit more than 6 hours between 09/04 and 10/04 GMT :-/
so, it appears that the cpuid website was compromised, with links leading to fake installers.
Re: CPU-Z and HWMonitor compromised
#10Jesus. I see that post and comment section and I immediately expect to hear Joey telling me about how this ATM is Idaho started spraying cash after his hack of the Gibson. That is a real-life reproduction of the perception of hackers in films in the '90s.
From the thread:
> Q: Why the heck did you hyperlink [the malware installer]?
> A: If someone reads this and they still click the download then they kind of deserve the virus tbh