Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CPU-Z and HWMonitor compromised

theregister.com

Post reply on HN
Print view View original

31–40 of 118 posts

Re: CPU-Z and HWMonitor compromised

#31

Post by daveguy »

pshirshov wrote: post #24
quantummagic wrote: post #15

> after the download my Windows Defender instantly detecting a virus. > (because i am often working with programms which triggering the defender i just ignored that) This again shows the unfortunate corrosive effect of false-positives. Probably impossible to solve while aggressively detecting viruses though.

But sorta possible to solve with source-based distribution and totally possible to solve with pure reproducible builds.

What systems have pure reproducible builds? Does Nix? Any others? From what I understand, it is a very difficult problem.

Re: CPU-Z and HWMonitor compromised

#32

Post by mikestorrent »

jl6 wrote: post #19

To our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.

Is there a tool out there that you can put software releases into and it will tell you how safe it is? I don't seem to be able to buy anything to do this. Crowdstrike and other modern antivirus may react to it once it's on a device, SAST / SCA tooling will help with CVEs, but there's nothing I can give my users where they can put in some piece of random software and get a reputation metric out the other side, is there?

Re: CPU-Z and HWMonitor compromised

#33

Post by magicalhippo »

BoredPositron wrote: post #13
john_strinlai wrote: post #9

some comments purportedly (i did not verify) from one of the maintainers: > Dear All, I'm Sam and in I'm working with Franck on CPU-Z (I'm doing the validator). Franck is unfortunately OOO for a couple weeks. I'm just out of bed after worked on Memtest86+ for most the night, so I'm doing my best to check everything. As very first checks, the file on our server looks fine ( https://www.virustotal.com/gui/file/6c8faba4…

It's the third time that I've read something about availability notifications on discord and other chats getting abused for timed attacks in the last few weeks.

After my Wordpress site got hacked way back through an exploit in one of the WP files, I set up a cron job that compared the hash of the static files with expected hash, and would fire off an email if they differed.

The script lived above the web root, so they'd have to escape that to tamper with it, and was generated by another script.

Saved me a couple of times since, well worth the 15 minutes I spent on setting it up.

Re: CPU-Z and HWMonitor compromised

#34

Post by Foobar8568 »

mikestorrent wrote: post #32
jl6 wrote: post #19

To our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.

Is there a tool out there that you can put software releases into and it will tell you how safe it is? I don't seem to be able to buy anything to do this. Crowdstrike and other modern antivirus may react to it once it's on a device, SAST / SCA tooling will help with CVEs, but there's nothing I can give my users where they can put in some piece of random software and get a reputation metric out the other side, is ther…

Beside Virus Total, I am unsure https://www.virustotal.com/

Re: CPU-Z and HWMonitor compromised

#35

Post by eviks »

actionfromafar wrote: post #28
eviks wrote: post #23

Earlier quoted context omitted.

This manifest only shows sha checks, which wouldn't help if the manifest is updated during the site compromise. How does it do the signature check?

Presumably the manifest is in github and won't auto-update when something on the CPU-Z website changes?

What do you mean, how would it get the new version name/hash if not following the changes on the website?

Re: CPU-Z and HWMonitor compromised

#36

Post by kyrra »

eviks wrote: post #35
actionfromafar wrote: post #28

Earlier quoted context omitted.

Presumably the manifest is in github and won't auto-update when something on the CPU-Z website changes?

What do you mean, how would it get the new version name/hash if not following the changes on the website?

I think you should spend the 5 minutes it takes to look at the winget-pkg repo to see how it works. There's lots of great documentation.

All updates are manual, and are done via pull requests. Check everything in-queue: https://github.com/microsoft/winget-pkgs/pulls

Existing versions don't tend to have their metadata updated (I'm not sure winget would accept it). Only new versions are supported.

You can see all the checks that go into cpu-z updates with the latest PR: https://github.com/microsoft/winget-pkgs/pull/349095

Re: CPU-Z and HWMonitor compromised

#37

Post by fuzzy2 »

kyrra wrote: post #14

For windows users, this is an advantage of using `winget` for installing things. It points to the installer hosted elsewhere, but it at least does a signature check. The config for the latest installer is listed here: https://github.com/microsoft/winget-pkgs/blob/master/manifes... which you can install with: winget install --exact --id CPUID.CPU-Z (there is a --version flag where you can specify "2.19", which the sig…

No, WinGet does not generally protect against this. While PRs to update package versions are verified in some way before going live, the necessary throughput can only be achieved with shallow checks. A determined actor could easily get a malicious update in, once they control the original source.

Other than that, WinGet is mostly just "run setup.exe". It is not a package manager. It's basically MajorGeeks as a mediocre CLI.

Re: CPU-Z and HWMonitor compromised

#38

Post by __natty__ »

mikestorrent wrote: post #32
jl6 wrote: post #19

To our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.

Is there a tool out there that you can put software releases into and it will tell you how safe it is? I don't seem to be able to buy anything to do this. Crowdstrike and other modern antivirus may react to it once it's on a device, SAST / SCA tooling will help with CVEs, but there's nothing I can give my users where they can put in some piece of random software and get a reputation metric out the other side, is ther…

Not exactly for software (although there is such section) but I use end of life [0] website. Besides time when certain software will be outdated it also tells you their release time.

[0] https://endoflife.date/

Re: CPU-Z and HWMonitor compromised

#40

Post by pshirshov »

daveguy wrote: post #31
pshirshov wrote: post #24

Earlier quoted context omitted.

But sorta possible to solve with source-based distribution and totally possible to solve with pure reproducible builds.

What systems have pure reproducible builds? Does Nix? Any others? From what I understand, it is a very difficult problem.

https://stal-ix.github.io/ and Guix, but the definitions of purity are different for them.

Yes, a very difficult problem, compilers must be pure functions with thin effectful wrappers.

Post reply on HN