Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CPU-Z and HWMonitor compromised

theregister.com

Post reply on HN
Print view View original

91–100 of 118 posts

Re: CPU-Z and HWMonitor compromised

#91

Post by briHass »

fuzzy2 wrote: post #37
kyrra wrote: post #14

For windows users, this is an advantage of using `winget` for installing things. It points to the installer hosted elsewhere, but it at least does a signature check. The config for the latest installer is listed here: https://github.com/microsoft/winget-pkgs/blob/master/manifes... which you can install with: winget install --exact --id CPUID.CPU-Z (there is a --version flag where you can specify "2.19", which the sig…

No, WinGet does not generally protect against this. While PRs to update package versions are verified in some way before going live, the necessary throughput can only be achieved with shallow checks. A determined actor could easily get a malicious update in, once they control the original source. Other than that, WinGet is mostly just "run setup.exe". It is not a package manager. It's basically MajorGeeks as a medioc…

Nonsense. WinGet has the ability to add repositories, just like any other package manager. If you want the 'approved' packages for the distro, that would be the msstore repository. If you want to use the 'community feed', which WinGet warns you about the first time you use it, it's less vetted, but still goes through Defender scans and community moderators.

If you go adding any old repo to APT, you have the same risk. You should look at how much code review goes into packages for major distros like Debian, hint, not much, especially once the initial package was accepted.

Re: CPU-Z and HWMonitor compromised

#92

Post by turpentine »

_slih wrote: post #3

same threat group hit filezilla last month with a fake domain. this time they didn't even need a fake domain, they compromised the real one's api layer. the attack is evolving from 'trick users into visiting the wrong site' to 'make the right site serve the wrong file.'

FileZilla has had a history of intentionally bunding adware/spyware, so aren't they the threat to begin with?

https://en.wikipedia.org/wiki/FileZilla#Bundled_adware_issue...

Re: CPU-Z and HWMonitor compromised

#93

Post by Gigachad »

vegadw wrote: post #74
quantummagic wrote: post #15

> after the download my Windows Defender instantly detecting a virus. > (because i am often working with programms which triggering the defender i just ignored that) This again shows the unfortunate corrosive effect of false-positives. Probably impossible to solve while aggressively detecting viruses though.

I think to an extent Microsoft is the guilty party here. For may cracks Windows Defender will trip saying "Win32/Keygen" even if there's no actual malware https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo... This trains people that do a lot of piracy to be used to turning off their antivirus to let something through, which is fine until it's not. It's like drugs, if we know a subset of the population will…

Software is the one thing I won't pirate since the risk of installing malware is extremely high. For media files, unless you are incredibly unlucky and someone is exploiting a bug in the media player, you are entirely safe. But for software you have no way of knowing how the software has been tampered with, and often there actually is malware in it.

Re: CPU-Z and HWMonitor compromised

#94

Post by SV_BubbleTime »

sysworld wrote: post #84
pseudosavant wrote: post #67

Earlier quoted context omitted.

Glad that they figured out the issue and fixed the links. When I first read this, I assumed it was actually the sketchy ads that are run on www.cpuid.com. These are the real ads I just saw on a single download page for CPU-Z: "Continue to Download", "Install For windows 10, 11 32/64 bit Get Fast!", "Download", "Download now from PC APP STORE", or "Download Now For windows 10, 11 32/64 bit". Many of them appeared mult…

Personally I'm fine with the scammy ads. I feel most people who would use CPU-Z are pretty technical and should be able to tell the difference between an ad download button vs the real one. That, and you should already be using an ad blocker.

What have they done to you? You do not need to be conditioned to accept this.

Re: CPU-Z and HWMonitor compromised

#95

Post by userbinator »

vegadw wrote: post #74
quantummagic wrote: post #15

> after the download my Windows Defender instantly detecting a virus. > (because i am often working with programms which triggering the defender i just ignored that) This again shows the unfortunate corrosive effect of false-positives. Probably impossible to solve while aggressively detecting viruses though.

I think to an extent Microsoft is the guilty party here. For may cracks Windows Defender will trip saying "Win32/Keygen" even if there's no actual malware https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo... This trains people that do a lot of piracy to be used to turning off their antivirus to let something through, which is fine until it's not. It's like drugs, if we know a subset of the population will…

Many years ago, even a "Hello World" binary that wasn't compiled by MSVC but by a GNU toolchain was detected as "suspicious" or "potentially unwanted", and in some cases automatically deleted. MS clearly has a different definition of "malware" than many people, and while it may overlap with a majority opinion (e.g. viruses and worms), where its opinion differs is used to push an agenda.

Re: CPU-Z and HWMonitor compromised

#96

Post by userbinator »

moomoo11 wrote: post #72

One interesting thing about all this stuff is that we may see a big swing towards paid/trusted solutions for all these type of things. Maybe the 5-10% of true nerds will go find the l33t open source solutions, but most people will just use some paid solution. Maybe Steam could build. Or in Windows. Or some SaaS solution for registry. In exchange you just share your HW info

If one were conspiratorially-minded, one would even be inclined to believe that these were deliberately done to push us towards that authoritarian dystopia of "trusted computing".

Re: CPU-Z and HWMonitor compromised

#97

Post by steve1977 »

herecomesthepre wrote: post #68
layer8 wrote: post #52

Earlier quoted context omitted.

I’m not one to chase the new and shiny, but how do you know a nominally months-old software package isn’t a newly compromised version at the time you download it?

Windows has this thing called digital signing with certificates that Linux users like to pretend doesn't exist or in the case of yesterday's Wireguard / VeraCrypt discussion, think it's an evil capitalist scheme to control the world. Digital signing on Windows predates Mac developer certificates by years but arguably wasn't widely used outside of security-paranoid organizations. Before someone says Linux offers GPG s…

> Before someone says Linux offers GPG signing it's mostly useless without a central PKI

One could also argue that GPG signing is useful exactly because it doesn't rely on a central PKI.

Re: CPU-Z and HWMonitor compromised

#98

Post by Barbing »

vntok wrote: post #66
daneel_w wrote: post #60

Earlier quoted context omitted.

And CSI: Miami, which kept the vibe alive through the 2000s and "educated the masses" on how IT works. Beep boop, I'm in.

The counter-hacker double-keyboarding sequence was inspiring.

wow https://youtube.com/watch?v=kl6rsi7BEtk

Re: CPU-Z and HWMonitor compromised

#99

Post by DarkUranium »

monocasa wrote: post #89
michaelt wrote: post #48

Earlier quoted context omitted.

Back in the 1990s, there was a tool called ‘tripwire’ that checked key files against expected checksums. As I recall, they recommended putting the expected values on a floppy disk and setting the ‘write protect’ tab, so the checksums couldn’t be changed.

A flash drive with a port on each side (one RO and the other RW) would be neat.

Why not a simple switch, not unlike on SD cards (but implemented on the device, not host/reader, and enforced by said device)?

Though yes, two USB ports would definitely work; it's just that the concept might be better served by providing two different connectors (e.g. USB-A & USB-C), as is common nowadays.

Re: CPU-Z and HWMonitor compromised

#100

Post by DarkUranium »

kjs3 wrote: post #70
Terr_ wrote: post #49

Earlier quoted context omitted.

Back in the 90s I fantasized about a hard drive bay with a physical write-protect switch on the cover plate.

Tenable makes some "read only" adapters for hard disks (SATA, PATA, SCSI & FW at least). They're usually sold as part of a forensic analysis kit. I have a couple and they definitely work. I believe there are a couple of other vendors (Wiebetech?) make similar devices. The alternative (tho not practical in many cases) would be RO media like RW-DVD.

You mean DVD-R? DVD-RW is rewritable, which means it's not really RO. The semi-obscure DVD-RAM takes this a step further by making it work a lot like a hard/flash drive (at the user level, not technical).
Post reply on HN