Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CPU-Z and HWMonitor compromised

theregister.com

Post reply on HN
Print view View original

41–50 of 118 posts

Re: CPU-Z and HWMonitor compromised

#41

Post by embedding-shape »

magicalhippo wrote: post #33
BoredPositron wrote: post #13

Earlier quoted context omitted.

It's the third time that I've read something about availability notifications on discord and other chats getting abused for timed attacks in the last few weeks.

After my Wordpress site got hacked way back through an exploit in one of the WP files, I set up a cron job that compared the hash of the static files with expected hash, and would fire off an email if they differed. The script lived above the web root, so they'd have to escape that to tamper with it, and was generated by another script. Saved me a couple of times since, well worth the 15 minutes I spent on setting it…

> Saved me a couple of times since

Wait, how often does your Wordpress site get successfully hacked like that?

Re: CPU-Z and HWMonitor compromised

#42

Post by magicalhippo »

embedding-shape wrote: post #41
magicalhippo wrote: post #33

Earlier quoted context omitted.

After my Wordpress site got hacked way back through an exploit in one of the WP files, I set up a cron job that compared the hash of the static files with expected hash, and would fire off an email if they differed. The script lived above the web root, so they'd have to escape that to tamper with it, and was generated by another script. Saved me a couple of times since, well worth the 15 minutes I spent on setting it…

> Saved me a couple of times since Wait, how often does your Wordpress site get successfully hacked like that?

Keep in mind the first time was about 20 years ago.

One time the hosting provider got compromised, FTP server exploit IIRC, they ran a recursive search and replace from root directory of the server.

Re: CPU-Z and HWMonitor compromised

#44

Post by eviks »

kyrra wrote: post #36
eviks wrote: post #35

Earlier quoted context omitted.

What do you mean, how would it get the new version name/hash if not following the changes on the website?

I think you should spend the 5 minutes it takes to look at the winget-pkg repo to see how it works. There's lots of great documentation. All updates are manual, and are done via pull requests. Check everything in-queue: https://github.com/microsoft/winget-pkgs/pulls Existing versions don't tend to have their metadata updated (I'm not sure winget would accept it). Only new versions are supported. You can see all the c…

That would obviously be longer than 5 minutes; presumably you've done that and still can't answer the simple question

> All updates are manual, and are done via pull requests.

The pull requests can be and some are automated, so not all are manual. But more importantly, how would it help?

> Existing versions don't tend to have their metadata updated (I'm not sure winget would accept it). Only new versions are supported.

The attack is version update! How is the old manifest version relevant here?

> You can see all the checks that go into cpu-z updates with the latest PR:

> Description : Invoke an Azure Function > Static Analysis > Status: Started > Status: InProgress

Excellent, now how can I get the answer to the question from this valuable information?

Re: CPU-Z and HWMonitor compromised

#45

Post by seanw444 »

mikestorrent wrote: post #32
jl6 wrote: post #19

To our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.

Is there a tool out there that you can put software releases into and it will tell you how safe it is? I don't seem to be able to buy anything to do this. Crowdstrike and other modern antivirus may react to it once it's on a device, SAST / SCA tooling will help with CVEs, but there's nothing I can give my users where they can put in some piece of random software and get a reputation metric out the other side, is ther…

You could put it into an LLM, since that's what we do for everything else nowadays.

Re: CPU-Z and HWMonitor compromised

#46

Post by mikestorrent »

Foobar8568 wrote: post #34
mikestorrent wrote: post #32

Earlier quoted context omitted.

Is there a tool out there that you can put software releases into and it will tell you how safe it is? I don't seem to be able to buy anything to do this. Crowdstrike and other modern antivirus may react to it once it's on a device, SAST / SCA tooling will help with CVEs, but there's nothing I can give my users where they can put in some piece of random software and get a reputation metric out the other side, is ther…

Beside Virus Total, I am unsure https://www.virustotal.com/

Thanks, that's helpful

Re: CPU-Z and HWMonitor compromised

#47

Post by vladvasiliu »

mikestorrent wrote: post #32
jl6 wrote: post #19

To our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.

Is there a tool out there that you can put software releases into and it will tell you how safe it is? I don't seem to be able to buy anything to do this. Crowdstrike and other modern antivirus may react to it once it's on a device, SAST / SCA tooling will help with CVEs, but there's nothing I can give my users where they can put in some piece of random software and get a reputation metric out the other side, is ther…

> put in some piece of random software and get a reputation metric out the other side

Well, the enterprise version of ms defender will not only react to it if it does something "weird", but will specifically look at its "reputation" before it runs at all.

However, as another commenter pointed out, this generates a ton of false positives. Basically everything that's "brand new" is liable to trigger it. Think your freshly compiled hellow_world.exe. So, all in all, people may no longer pay attention to it and just click through all warnings.

Re: CPU-Z and HWMonitor compromised

#48

Post by michaelt »

magicalhippo wrote: post #33
BoredPositron wrote: post #13

Earlier quoted context omitted.

It's the third time that I've read something about availability notifications on discord and other chats getting abused for timed attacks in the last few weeks.

After my Wordpress site got hacked way back through an exploit in one of the WP files, I set up a cron job that compared the hash of the static files with expected hash, and would fire off an email if they differed. The script lived above the web root, so they'd have to escape that to tamper with it, and was generated by another script. Saved me a couple of times since, well worth the 15 minutes I spent on setting it…

Back in the 1990s, there was a tool called ‘tripwire’ that checked key files against expected checksums.

As I recall, they recommended putting the expected values on a floppy disk and setting the ‘write protect’ tab, so the checksums couldn’t be changed.

Re: CPU-Z and HWMonitor compromised

#49

Post by Terr_ »

michaelt wrote: post #48
magicalhippo wrote: post #33

Earlier quoted context omitted.

After my Wordpress site got hacked way back through an exploit in one of the WP files, I set up a cron job that compared the hash of the static files with expected hash, and would fire off an email if they differed. The script lived above the web root, so they'd have to escape that to tamper with it, and was generated by another script. Saved me a couple of times since, well worth the 15 minutes I spent on setting it…

Back in the 1990s, there was a tool called ‘tripwire’ that checked key files against expected checksums. As I recall, they recommended putting the expected values on a floppy disk and setting the ‘write protect’ tab, so the checksums couldn’t be changed.

Back in the 90s I fantasized about a hard drive bay with a physical write-protect switch on the cover plate.

Re: CPU-Z and HWMonitor compromised

#50

Post by Terr_ »

1970-01-01 wrote: post #27
orthogonal_cube wrote: post #7

Seems the installers hosted by them are fine. The links on the site have been changed to direct people towards Cloudflare R2 storage with various copies of malicious executables. Looking forward to information down the line on how this came about.

Not exactly a supply chain compromise, as devs should be smart enough to update via a package manager such as winget and chocolatey, but it certainly fits for a watering hole attack.

I suppose one could view it as a supply-chain compromise of an alternate chain that's very short.
Post reply on HN