Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CPU-Z and HWMonitor compromised

theregister.com

Post reply on HN
Print view View original

61–70 of 118 posts

Re: CPU-Z and HWMonitor compromised

#61

Post by kqgnkqgn »

Terr_ wrote: post #49
michaelt wrote: post #48

Earlier quoted context omitted.

Back in the 1990s, there was a tool called ‘tripwire’ that checked key files against expected checksums. As I recall, they recommended putting the expected values on a floppy disk and setting the ‘write protect’ tab, so the checksums couldn’t be changed.

Back in the 90s I fantasized about a hard drive bay with a physical write-protect switch on the cover plate.

In the mid-2000's I briefly worked for a company that did this at a firmware level ("write-blocked firmware") for USB drive adapters (IDE / SATA / whatever IDE variant laptops were using / etc). This was apparently very valuable for police and investigative services, so they could collect evidence, while being able to show that they did not tamper with the original drive.

Re: CPU-Z and HWMonitor compromised

#62

Post by Beretta_Vexee »

embedding-shape wrote: post #41
magicalhippo wrote: post #33

Earlier quoted context omitted.

After my Wordpress site got hacked way back through an exploit in one of the WP files, I set up a cron job that compared the hash of the static files with expected hash, and would fire off an email if they differed. The script lived above the web root, so they'd have to escape that to tamper with it, and was generated by another script. Saved me a couple of times since, well worth the 15 minutes I spent on setting it…

> Saved me a couple of times since Wait, how often does your Wordpress site get successfully hacked like that?

It depends on how long you've been using WordPress, whether you use plugins, whether they're well-maintained or not, and so on.

Back around 2010, there were security vulnerabilities in WordPress or its popular plugins almost every month.

Re: CPU-Z and HWMonitor compromised

#63

Post by cwizou »

john_strinlai wrote: post #59
cwizou wrote: post #56

Earlier quoted context omitted.

For what it's worth - I used to write CPU reviews a while back - I can vouch for both Sam and Franck. Franck is the guy behind CPUID and Sam is a close friend of his, who was known for working at Canard PC on top of his work on Memtest : https://x86.fr/about-me/

that is pretty cool! when i say i didnt verify, i just mean that i ripped these quotes out of reddit, and did not check whether the reddit username that posted the comments is known to be an identity of Sam.

I didn't talk to him to verify, but at the very least it's his username (and the account is old enough at this point : https://www.reddit.com/user/Doc_TB/comments/), and his very Belgian english.

I know both are close and Sam handles his website, so since the links are fixed, I have near zero doubt it's Sam here on reddit.

Re: CPU-Z and HWMonitor compromised

#64

Post by miniBill »

gertop wrote: post #51
pshirshov wrote: post #24

Earlier quoted context omitted.

But sorta possible to solve with source-based distribution and totally possible to solve with pure reproducible builds.

It's entirely possible to ship malware in source form... Just look at the numerous supply chain attacks. Nix is a cute project but entirely irrelevant here.

It is possible but visible, and it means burning an identity, so it's not irrelevant

Re: CPU-Z and HWMonitor compromised

#65

Post by xandrius »

jl6 wrote: post #19

To our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.

Not fair take, cpuz and hwmonitor are often used on new installations of PCs (or at least for me) to verify hw specs and stuff. Or when I need to do some upgrade work for a desktop computer.

I just go to the trusted site, download what's there and get going. This is not an npm package that a dev is updating on day 0 of its release for being a "human shield", it's literally the first version which comes up when DLing the new software.

Re: CPU-Z and HWMonitor compromised

#66

Post by vntok »

daneel_w wrote: post #60
wang_li wrote: post #6

Jesus. I see that post and comment section and I immediately expect to hear Joey telling me about how this ATM is Idaho started spraying cash after his hack of the Gibson. That is a real-life reproduction of the perception of hackers in films in the '90s.

And CSI: Miami, which kept the vibe alive through the 2000s and "educated the masses" on how IT works. Beep boop, I'm in.

The counter-hacker double-keyboarding sequence was inspiring.

Re: CPU-Z and HWMonitor compromised

#67

Post by pseudosavant »

john_strinlai wrote: post #9

some comments purportedly (i did not verify) from one of the maintainers: > Dear All, I'm Sam and in I'm working with Franck on CPU-Z (I'm doing the validator). Franck is unfortunately OOO for a couple weeks. I'm just out of bed after worked on Memtest86+ for most the night, so I'm doing my best to check everything. As very first checks, the file on our server looks fine ( https://www.virustotal.com/gui/file/6c8faba4…

Glad that they figured out the issue and fixed the links. When I first read this, I assumed it was actually the sketchy ads that are run on www.cpuid.com.

These are the real ads I just saw on a single download page for CPU-Z: "Continue to Download", "Install For windows 10, 11 32/64 bit Get Fast!", "Download", "Download now from PC APP STORE", or "Download Now For windows 10, 11 32/64 bit". Many of them appeared multiple times on the page.

The real download links don't even say they are download links.

I love the winget CLI in this situation. This is all you need: `winget install CPUID.CPU-Z`.

Re: CPU-Z and HWMonitor compromised

#68

Post by herecomesthepre »

layer8 wrote: post #52
jl6 wrote: post #19

To our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.

I’m not one to chase the new and shiny, but how do you know a nominally months-old software package isn’t a newly compromised version at the time you download it?

Windows has this thing called digital signing with certificates that Linux users like to pretend doesn't exist or in the case of yesterday's Wireguard / VeraCrypt discussion, think it's an evil capitalist scheme to control the world.

Digital signing on Windows predates Mac developer certificates by years but arguably wasn't widely used outside of security-paranoid organizations.

Before someone says Linux offers GPG signing it's mostly useless without a central PKI. Developers offer the public key for download on the same server as the software. If someone uploaded compromised software, surely they would replace the key with their own.

Re: CPU-Z and HWMonitor compromised

#69

Post by ndriscoll »

layer8 wrote: post #52
jl6 wrote: post #19

To our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.

I’m not one to chase the new and shiny, but how do you know a nominally months-old software package isn’t a newly compromised version at the time you download it?

I don't know about other managers, but nixpkgs has hashes of the package I'm installing, and is a git repo, so I can easily detect a history rewrite, and I have the full history of package changes over time. Since it's a git repo, I can also easily install things as of a given time.

Re: CPU-Z and HWMonitor compromised

#70

Post by kjs3 »

Terr_ wrote: post #49
michaelt wrote: post #48

Earlier quoted context omitted.

Back in the 1990s, there was a tool called ‘tripwire’ that checked key files against expected checksums. As I recall, they recommended putting the expected values on a floppy disk and setting the ‘write protect’ tab, so the checksums couldn’t be changed.

Back in the 90s I fantasized about a hard drive bay with a physical write-protect switch on the cover plate.

Tenable makes some "read only" adapters for hard disks (SATA, PATA, SCSI & FW at least). They're usually sold as part of a forensic analysis kit. I have a couple and they definitely work. I believe there are a couple of other vendors (Wiebetech?) make similar devices.

The alternative (tho not practical in many cases) would be RO media like RW-DVD.

Post reply on HN