Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CPU-Z and HWMonitor compromised

theregister.com

Post reply on HN
Print view View original

21–30 of 118 posts

Re: CPU-Z and HWMonitor compromised

#21

Post by ww520 »

kyrra wrote: post #14

For windows users, this is an advantage of using `winget` for installing things. It points to the installer hosted elsewhere, but it at least does a signature check. The config for the latest installer is listed here: https://github.com/microsoft/winget-pkgs/blob/master/manifes... which you can install with: winget install --exact --id CPUID.CPU-Z (there is a --version flag where you can specify "2.19", which the sig…

Yes. Winget is getting better support on Windows apps. The other day I tried to download the latest version of ImageMagick but all the links on the official site were bad. I tried Winget and it had it!

Re: CPU-Z and HWMonitor compromised

#23

Post by eviks »

kyrra wrote: post #14

For windows users, this is an advantage of using `winget` for installing things. It points to the installer hosted elsewhere, but it at least does a signature check. The config for the latest installer is listed here: https://github.com/microsoft/winget-pkgs/blob/master/manifes... which you can install with: winget install --exact --id CPUID.CPU-Z (there is a --version flag where you can specify "2.19", which the sig…

This manifest only shows sha checks, which wouldn't help if the manifest is updated during the site compromise. How does it do the signature check?

Re: CPU-Z and HWMonitor compromised

#24

Post by pshirshov »

quantummagic wrote: post #15

> after the download my Windows Defender instantly detecting a virus. > (because i am often working with programms which triggering the defender i just ignored that) This again shows the unfortunate corrosive effect of false-positives. Probably impossible to solve while aggressively detecting viruses though.

But sorta possible to solve with source-based distribution and totally possible to solve with pure reproducible builds.

Re: CPU-Z and HWMonitor compromised

#25

Post by hypeatei »

kyrra wrote: post #14

For windows users, this is an advantage of using `winget` for installing things. It points to the installer hosted elsewhere, but it at least does a signature check. The config for the latest installer is listed here: https://github.com/microsoft/winget-pkgs/blob/master/manifes... which you can install with: winget install --exact --id CPUID.CPU-Z (there is a --version flag where you can specify "2.19", which the sig…

Package managers also saved people from the Notepad++ hijack that was disclosed a couple months ago.

I think devs should avoid distributing their software on first party sites unless they're willing to dedicate a bunch of time to making sure all the infra is secure. Not a lot of people verify signatures, but it's also good to have your PKI in order (signing keys should be available on multiple channels)

Re: CPU-Z and HWMonitor compromised

#27

Post by 1970-01-01 »

orthogonal_cube wrote: post #7

Seems the installers hosted by them are fine. The links on the site have been changed to direct people towards Cloudflare R2 storage with various copies of malicious executables. Looking forward to information down the line on how this came about.

Not exactly a supply chain compromise, as devs should be smart enough to update via a package manager such as winget and chocolatey, but it certainly fits for a watering hole attack.

Re: CPU-Z and HWMonitor compromised

#28

Post by actionfromafar »

eviks wrote: post #23
kyrra wrote: post #14

For windows users, this is an advantage of using `winget` for installing things. It points to the installer hosted elsewhere, but it at least does a signature check. The config for the latest installer is listed here: https://github.com/microsoft/winget-pkgs/blob/master/manifes... which you can install with: winget install --exact --id CPUID.CPU-Z (there is a --version flag where you can specify "2.19", which the sig…

This manifest only shows sha checks, which wouldn't help if the manifest is updated during the site compromise. How does it do the signature check?

Presumably the manifest is in github and won't auto-update when something on the CPU-Z website changes?

Re: CPU-Z and HWMonitor compromised

#29

Post by eviks »

quantummagic wrote: post #15

> after the download my Windows Defender instantly detecting a virus. > (because i am often working with programms which triggering the defender i just ignored that) This again shows the unfortunate corrosive effect of false-positives. Probably impossible to solve while aggressively detecting viruses though.

If only there were a great Windows app store or a package manager to help with the impossible...
Post reply on HN