Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CPU-Z and HWMonitor compromised

theregister.com

Post reply on HN
Print view View original

101–110 of 118 posts

Re: CPU-Z and HWMonitor compromised

#101

Post by DarkUranium »

tranceylc wrote: post #83
vladvasiliu wrote: post #47

Earlier quoted context omitted.

> put in some piece of random software and get a reputation metric out the other side Well, the enterprise version of ms defender will not only react to it if it does something "weird", but will specifically look at its "reputation" before it runs at all. However, as another commenter pointed out, this generates a ton of false positives. Basically everything that's "brand new" is liable to trigger it. Think your fres…

Worked on a minecraft clone on steam that would falsely get flagged by defender as a “bitcoin miner” for YEARS.

Well, they got one half of that label right...

Re: CPU-Z and HWMonitor compromised

#102

Post by nineteen999 »

michaelt wrote: post #48
magicalhippo wrote: post #33

Earlier quoted context omitted.

After my Wordpress site got hacked way back through an exploit in one of the WP files, I set up a cron job that compared the hash of the static files with expected hash, and would fire off an email if they differed. The script lived above the web root, so they'd have to escape that to tamper with it, and was generated by another script. Saved me a couple of times since, well worth the 15 minutes I spent on setting it…

Back in the 1990s, there was a tool called ‘tripwire’ that checked key files against expected checksums. As I recall, they recommended putting the expected values on a floppy disk and setting the ‘write protect’ tab, so the checksums couldn’t be changed.

A different "network-aware" concept of this was "aide", that allowed the checksums to be stored on a server, for mutiple clients. [1]

Had some drawbacks compared to using offline media of course, but in day to day operation on an air-gapped network it had its uses.

Also worth knowing is the "-V" (for very parameter) of rpm.

[1] https://docs.redhat.com/en/documentation/red_hat_enterprise_...

Re: CPU-Z and HWMonitor compromised

#104

Post by mjmas »

VimEscapeArtist wrote: post #85

Wait, people still download unsigned exes from PHP-era websites in 2026? And then act surprised when the download link starts pointing to malware? At this point if your software isn't distributed through a repo with verifiable builds, you're basically running a malware lottery for your users. The only question is when, not if. CPUID got lucky it was only 6 hours. Imagine if the attackers had better taste in filenames…

> PHP-era

PHP-era is still today

Re: CPU-Z and HWMonitor compromised

#106

Post by edp »

cwizou wrote: post #56
john_strinlai wrote: post #9

some comments purportedly (i did not verify) from one of the maintainers: > Dear All, I'm Sam and in I'm working with Franck on CPU-Z (I'm doing the validator). Franck is unfortunately OOO for a couple weeks. I'm just out of bed after worked on Memtest86+ for most the night, so I'm doing my best to check everything. As very first checks, the file on our server looks fine ( https://www.virustotal.com/gui/file/6c8faba4…

For what it's worth - I used to write CPU reviews a while back - I can vouch for both Sam and Franck. Franck is the guy behind CPUID and Sam is a close friend of his, who was known for working at Canard PC on top of his work on Memtest : https://x86.fr/about-me/

So strange to see you commenting on HN, I was an avid reader of Joystick back in the day !

Re: CPU-Z and HWMonitor compromised

#107

Post by ziml77 »

Gigachad wrote: post #93
vegadw wrote: post #74

Earlier quoted context omitted.

I think to an extent Microsoft is the guilty party here. For may cracks Windows Defender will trip saying "Win32/Keygen" even if there's no actual malware https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo... This trains people that do a lot of piracy to be used to turning off their antivirus to let something through, which is fine until it's not. It's like drugs, if we know a subset of the population will…

Software is the one thing I won't pirate since the risk of installing malware is extremely high. For media files, unless you are incredibly unlucky and someone is exploiting a bug in the media player, you are entirely safe. But for software you have no way of knowing how the software has been tampered with, and often there actually is malware in it.

Same. I used to pirate software but even way back I kept it limited to very popular software and established downloads (where if they were malware they were almost certain to be in a signature database by that point). And I absolutely never pirated an OS. I thought anyone doing that was out of their freaking mind because any malware there had ultimate access to block its own detection and do whatever else it pleased.

Now I don't do it at all. It's not worth the risk when I have the money to pay for the proprietary software that I like and when the ecosystem of open source software is very good.

Re: CPU-Z and HWMonitor compromised

#108

Post by ziml77 »

BoredPositron wrote: post #30

"Bug fixes and general improvements." Supply chain attacks are easier because changelogs for most software are useless now if they are provided at all.

"Fix for a critical issue when querying the CPU that could lead to data corruption in other processes executing at the same time"

Or, "hey ChatGPT generate me a changelog for updates and fixes I could make to the software CPU-Z"

Expecting a more detailed changelog doesn't help at all

(I'm not even sure you'd need to prompt an LLM around guardrails like I did here, it would probably happily spit out a fake changelog even if you were explicit about it not being real as long as you don't tell the LLM you're planning to trick people with malware)

Re: CPU-Z and HWMonitor compromised

#109

Post by JohnTHaller »

mikestorrent wrote: post #32
jl6 wrote: post #19

To our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.

Is there a tool out there that you can put software releases into and it will tell you how safe it is? I don't seem to be able to buy anything to do this. Crowdstrike and other modern antivirus may react to it once it's on a device, SAST / SCA tooling will help with CVEs, but there's nothing I can give my users where they can put in some piece of random software and get a reputation metric out the other side, is ther…

I run software downloads through VirusTotal before installing or using. And I scan all releases I make on PortableApps.com through it as well. (Except those that are bigger than the max size in which case those get scanned with Defender, ClamAV, and at least one commercial Windows antivirus.)

Re: CPU-Z and HWMonitor compromised

#110

Post by kjs3 »

DarkUranium wrote: post #100
kjs3 wrote: post #70

Earlier quoted context omitted.

Tenable makes some "read only" adapters for hard disks (SATA, PATA, SCSI & FW at least). They're usually sold as part of a forensic analysis kit. I have a couple and they definitely work. I believe there are a couple of other vendors (Wiebetech?) make similar devices. The alternative (tho not practical in many cases) would be RO media like RW-DVD.

You mean DVD-R? DVD-RW is re writable, which means it's not really RO. The semi-obscure DVD-RAM takes this a step further by making it work a lot like a hard/flash drive (at the user level, not technical).

I think it's clear what I meant, even with a typo.
Post reply on HN