CPU-Z and HWMonitor compromised | Hacker News Reader

CPU-Z and HWMonitor compromised

theregister.com

411 pointspashadee105 comments

https://xcancel.com/vxunderground/status/2042483067655262461

https://old.reddit.com/r/pcmasterrace/comments/1sh4e5l/warni...

https://www.bleepingcomputer.com/news/security/supply-chain-...

some comments purportedly (i did not verify) from one of the maintainers:

>Dear All, I'm Sam and in I'm working with Franck on CPU-Z (I'm doing the validator). Franck is unfortunately OOO for a couple weeks. I'm just out of bed after worked on Memtest86+ for most the night, so I'm doing my best to check everything. As very first checks, the file on our server looks fine (https://www.virustotal.com/gui/file/6c8faba4768754c3364e7c40...) and the server doesn't seems compromised. I'm investigating further... If anyone can tell me the exact link to the page where the malware was downloaded, that would help a lot

>Thank you. I found the biggest breach, restored the links and put everything in read-only until more investigation is done. Seems they waited Franck was off and I get to bad after working on Memtest86+ yesterday :-/

>The links have been compromised for a bit more than 6 hours between 09/04 and 10/04 GMT :-/

so, it appears that the cpuid website was compromised, with links leading to fake installers.

It's the third time that I've read something about availability notifications on discord and other chats getting abused for timed attacks in the last few weeks.

After my Wordpress site got hacked way back through an exploit in one of the WP files, I set up a cron job that compared the hash of the static files with expected hash, and would fire off an email if they differed.

The script lived above the web root, so they'd have to escape that to tamper with it, and was generated by another script.

Saved me a couple of times since, well worth the 15 minutes I spent on setting it up.

> Saved me a couple of times since

Wait, how often does your Wordpress site get successfully hacked like that?

Keep in mind the first time was about 20 years ago.

One time the hosting provider got compromised, FTP server exploit IIRC, they ran a recursive search and replace from root directory of the server.

It depends on how long you've been using WordPress, whether you use plugins, whether they're well-maintained or not, and so on.

Back around 2010, there were security vulnerabilities in WordPress or its popular plugins almost every month.

Back in the 1990s, there was a tool called ‘tripwire’ that checked key files against expected checksums.

As I recall, they recommended putting the expected values on a floppy disk and setting the ‘write protect’ tab, so the checksums couldn’t be changed.

Back in the 90s I fantasized about a hard drive bay with a physical write-protect switch on the cover plate.

In the mid-2000's I briefly worked for a company that did this at a firmware level ("write-blocked firmware") for USB drive adapters (IDE / SATA / whatever IDE variant laptops were using / etc). This was apparently very valuable for police and investigative services, so they could collect evidence, while being able to show that they did not tamper with the original drive.

Tenable makes some "read only" adapters for hard disks (SATA, PATA, SCSI & FW at least). They're usually sold as part of a forensic analysis kit. I have a couple and they definitely work. I believe there are a couple of other vendors (Wiebetech?) make similar devices.

The alternative (tho not practical in many cases) would be RO media like RW-DVD.

You mean DVD-R? DVD-RW is rewritable, which means it's not really RO. The semi-obscure DVD-RAM takes this a step further by making it work a lot like a hard/flash drive (at the user level, not technical).

I think it's clear what I meant, even with a typo.

tripwire was the orginal file integrity anti-virus/anti-tampering software from the security group (which turned into CERIAS) at Purdue led by Dr. Eugene "Spaff" Spafford.

https://docs.lib.purdue.edu/cstech/1084/

For some time a number of people and companies have been using OSSEC for that job. [1] There are a couple versions of it free open source and enterprise. There are a handful of other programs that also keep an eye on checksums.

If tinkering with OSSEC one of the first steps should be to configure whitelisting for IP ranges and CIDR blocks used by your company, SNAT addresses and bastion IP's so that someone does not lock everyone out. It does a lot more than checksums.

[1] - https://www.ossec.net/

A flash drive with a port on each side (one RO and the other RW) would be neat.

Why not a simple switch, not unlike on SD cards (but implemented on the device, not host/reader, and enforced by said device)?

Though yes, two USB ports would definitely work; it's just that the concept might be better served by providing two different connectors (e.g. USB-A & USB-C), as is common nowadays.

A different "network-aware" concept of this was "aide", that allowed the checksums to be stored on a server, for mutiple clients. [1]

Had some drawbacks compared to using offline media of course, but in day to day operation on an air-gapped network it had its uses.

Also worth knowing is the "-V" (for very parameter) of rpm.

[1] https://docs.redhat.com/en/documentation/red_hat_enterprise_...

Related: OpenBSD does this daily as part of running security(8) and its coverage can be expanded to include pretty much anything.

https://man.openbsd.org/security

Can you share what those other attacks were? It's helpful to study additional attacks to know what to look for.

For what it's worth - I used to write CPU reviews a while back - I can vouch for both Sam and Franck. Franck is the guy behind CPUID and Sam is a close friend of his, who was known for working at Canard PC on top of his work on Memtest : https://x86.fr/about-me/

that is pretty cool!

when i say i didnt verify, i just mean that i ripped these quotes out of reddit, and did not check whether the reddit username that posted the comments is known to be an identity of Sam.

I didn't talk to him to verify, but at the very least it's his username (and the account is old enough at this point : https://www.reddit.com/user/Doc_TB/comments/), and his very Belgian english.

I know both are close and Sam handles his website, so since the links are fixed, I have near zero doubt it's Sam here on reddit.

So strange to see you commenting on HN, I was an avid reader of Joystick back in the day !

Glad that they figured out the issue and fixed the links. When I first read this, I assumed it was actually the sketchy ads that are run on www.cpuid.com.

These are the real ads I just saw on a single download page for CPU-Z: "Continue to Download", "Install For windows 10, 11 32/64 bit Get Fast!", "Download", "Download now from PC APP STORE", or "Download Now For windows 10, 11 32/64 bit". Many of them appeared multiple times on the page.

The real download links don't even say they are download links.

I love the winget CLI in this situation. This is all you need: `winget install CPUID.CPU-Z`.

Personally I'm fine with the scammy ads. I feel most people who would use CPU-Z are pretty technical and should be able to tell the difference between an ad download button vs the real one.

That, and you should already be using an ad blocker.

What have they done to you? You do not need to be conditioned to accept this.

Any idea how the compromise was achieved?

i have no clue. i yoinked these quotes from the reddit thread where sam replied.

i am sure that we will see a write-up once the investigation concludes. it hasnt even been a day yet though, so i imagine sam is still in damage-control mode rather than root cause analysis mode.

> after the download my Windows Defender instantly detecting a virus.

> (because i am often working with programms which triggering the defender i just ignored that)

This again shows the unfortunate corrosive effect of false-positives. Probably impossible to solve while aggressively detecting viruses though.

But sorta possible to solve with source-based distribution and totally possible to solve with pure reproducible builds.

What systems have pure reproducible builds? Does Nix? Any others? From what I understand, it is a very difficult problem.

https://stal-ix.github.io/ and Guix, but the definitions of purity are different for them.

Yes, a very difficult problem, compilers must be pure functions with thin effectful wrappers.

It's entirely possible to ship malware in source form... Just look at the numerous supply chain attacks. Nix is a cute project but entirely irrelevant here.

It is possible but visible, and it means burning an identity, so it's not irrelevant

Burning an identity? Instead of hacking the server that serves the binary, you have to hack the developer's machine and commit a malicious source change.

I wouldn't consider either of them to burn an identity.

If only there were a great Windows app store or a package manager to help with the impossible...

I think to an extent Microsoft is the guilty party here. For may cracks Windows Defender will trip saying "Win32/Keygen" even if there's no actual malware

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo...

This trains people that do a lot of piracy to be used to turning off their antivirus to let something through, which is fine until it's not. It's like drugs, if we know a subset of the population will do them no matter what, we should make it safe for them to the extent we can. False positives, causing people to ignore actual positives, creates a market for these things.

I mean this is by design? It makes pirates more likely to get malware, and thus normal people more likely to pay for MS products rather than pirate? You may think its immoral but the incentives line up.

I don't think it's some conspiracy to make anyone more likely to get malware. Instead it's that for their business model of mostly being used on business PCs where the same dozen tools are installed all over the world they can be overzelous in protection and it is what most customers want. Really, they should leave the "piracy is malware" thing in defender, it should just be off by default if your PC isn't connected to a domain or setup as "work PC".

Software is the one thing I won't pirate since the risk of installing malware is extremely high. For media files, unless you are incredibly unlucky and someone is exploiting a bug in the media player, you are entirely safe. But for software you have no way of knowing how the software has been tampered with, and often there actually is malware in it.

Same. I used to pirate software but even way back I kept it limited to very popular software and established downloads (where if they were malware they were almost certain to be in a signature database by that point). And I absolutely never pirated an OS. I thought anyone doing that was out of their freaking mind because any malware there had ultimate access to block its own detection and do whatever else it pleased.

Now I don't do it at all. It's not worth the risk when I have the money to pay for the proprietary software that I like and when the ecosystem of open source software is very good.

Until recently the exception for me was music software/VSTs. I definitely did get a few infections over the years doing so, but after finding some safe sources it went pretty well. To some extent, I still see advise it, actually, just with purchasing first but never using the key, just because DRM in the music software world is so aggressively bad. iLok is a cancer on that industry.

There's always sandboxing/containers/VMs though. Even on Windows you have Sandboxie which is extremely powerful.

Many years ago, even a "Hello World" binary that wasn't compiled by MSVC but by a GNU toolchain was detected as "suspicious" or "potentially unwanted", and in some cases automatically deleted. MS clearly has a different definition of "malware" than many people, and while it may overlap with a majority opinion (e.g. viruses and worms), where its opinion differs is used to push an agenda.

To our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.

Is there a tool out there that you can put software releases into and it will tell you how safe it is? I don't seem to be able to buy anything to do this. Crowdstrike and other modern antivirus may react to it once it's on a device, SAST / SCA tooling will help with CVEs, but there's nothing I can give my users where they can put in some piece of random software and get a reputation metric out the other side, is there?

Beside Virus Total, I am unsure https://www.virustotal.com/

Thanks, that's helpful

Not exactly for software (although there is such section) but I use end of life [0] website. Besides time when certain software will be outdated it also tells you their release time.

[0] https://endoflife.date/

You could put it into an LLM, since that's what we do for everything else nowadays.

> put in some piece of random software and get a reputation metric out the other side

Well, the enterprise version of ms defender will not only react to it if it does something "weird", but will specifically look at its "reputation" before it runs at all.

However, as another commenter pointed out, this generates a ton of false positives. Basically everything that's "brand new" is liable to trigger it. Think your freshly compiled hellow_world.exe. So, all in all, people may no longer pay attention to it and just click through all warnings.

Worked on a minecraft clone on steam that would falsely get flagged by defender as a “bitcoin miner” for YEARS.

Well, they got one half of that label right...

I run software downloads through VirusTotal before installing or using. And I scan all releases I make on PortableApps.com through it as well. (Except those that are bigger than the max size in which case those get scanned with Defender, ClamAV, and at least one commercial Windows antivirus.)

Thanks the web that produced css programmers who have been taught latest is greatest and shiny gets money.

"new, shiny" has never been a problem with CSS. Either browsers support some CSS attribute or they don't.

You're probably thinking about Javascript programmers.

I’m not one to chase the new and shiny, but how do you know a nominally months-old software package isn’t a newly compromised version at the time you download it?

Windows has this thing called digital signing with certificates that Linux users like to pretend doesn't exist or in the case of yesterday's Wireguard / VeraCrypt discussion, think it's an evil capitalist scheme to control the world.

Digital signing on Windows predates Mac developer certificates by years but arguably wasn't widely used outside of security-paranoid organizations.

Before someone says Linux offers GPG signing it's mostly useless without a central PKI. Developers offer the public key for download on the same server as the software. If someone uploaded compromised software, surely they would replace the key with their own.

> Windows has this thing called digital signing with certificates that Linux users like to pretend doesn't exist

...or, much more likely, any potential benefits are not worth the negatives.

Linux package managers (the normal way to install software) use signed packages.

I don't know how easy/hard it would be to compromise that.

> Before someone says Linux offers GPG signing it's mostly useless without a central PKI

One could also argue that GPG signing is useful exactly because it doesn't rely on a central PKI.

It's as useful as self-signed certificates.

I don't know about other managers, but nixpkgs has hashes of the package I'm installing, and is a git repo, so I can easily detect a history rewrite, and I have the full history of package changes over time. Since it's a git repo, I can also easily install things as of a given time.

You probably know this, but a note for the benefit of people who don’t. The entire git history, including metadata, can be modified. Unless you have an independent offline remote to compare to, this method is not 100% guaranteed to detect tampering in all cases, for example if the nixpkgs repo is compromised (or your machines’ connection to your git forge is being MITM’d)

I hope you don't think that waiting a month will protect you. Malicious software can wait to be triggered months or years before anything malicious happens.

It helps. If I were a malware/backdoor author, I have the choice to make it lie idle for a couple months; this would help me get more victims, BUT it gives more time for someone to notice it BEFORE I get any victims at all.

Whereas if it is active immediately, I'm likely to get at least a few victims.

Not fair take, cpuz and hwmonitor are often used on new installations of PCs (or at least for me) to verify hw specs and stuff. Or when I need to do some upgrade work for a desktop computer.

I just go to the trusted site, download what's there and get going. This is not an npm package that a dev is updating on day 0 of its release for being a "human shield", it's literally the first version which comes up when DLing the new software.

Seems like the kind of thing to just have on a bootable thumb drive, to inspect any machine without requiring installation on the fly.

In fact, I think I used to use memtest86+ this way as it is a baked in boot option on Fedora bootable ISO images. (Or at least was in the past, I haven't checked this recently.)

CPU-Z gets updated to recognise new CPUs and memory configs and thus must be downloaded new to recognise the new hardware in a new machine (otherwise it can’t recognise it properly). With Memtest sure but CPU-Z is something you actually need the latest version of when you first fire up a new PC.

OK, so a bootable thumb drive rather than a read-only ISO image?

I mean, it should be possible to give it an update function which you can run from any utility host, rather than requiring a live install at the moment you want to test a new machine.

That update function could do normal package management and repository things with digital signature checks, etc.

And it could be done ahead of time to support sneaker-net scenarios, i.e. where you won't have networking on the new machine that is being burned-in/validated.

It's HWMonitor https://www.cpuid.com/softwares/hwmonitor.html and not HWInfo https://www.hwinfo.com/

So two programs from CPUID. I wonder if there are more affected.

Same topic on Reddit at https://news.ycombinator.com/item?id=47718830 @dang

For windows users, this is an advantage of using `winget` for installing things. It points to the installer hosted elsewhere, but it at least does a signature check. The config for the latest installer is listed here: https://github.com/microsoft/winget-pkgs/blob/master/manifes...

which you can install with:

   winget install --exact --id CPUID.CPU-Z

(there is a --version flag where you can specify "2.19", which the signature there is a month old, so it should be safe to install that way)

Yes. Winget is getting better support on Windows apps. The other day I tried to download the latest version of ImageMagick but all the links on the official site were bad. I tried Winget and it had it!

This manifest only shows sha checks, which wouldn't help if the manifest is updated during the site compromise. How does it do the signature check?

Presumably the manifest is in github and won't auto-update when something on the CPU-Z website changes?

What do you mean, how would it get the new version name/hash if not following the changes on the website?

I think you should spend the 5 minutes it takes to look at the winget-pkg repo to see how it works. There's lots of great documentation.

All updates are manual, and are done via pull requests. Check everything in-queue: https://github.com/microsoft/winget-pkgs/pulls

Existing versions don't tend to have their metadata updated (I'm not sure winget would accept it). Only new versions are supported.

You can see all the checks that go into cpu-z updates with the latest PR: https://github.com/microsoft/winget-pkgs/pull/349095

That would obviously be longer than 5 minutes; presumably you've done that and still can't answer the simple question

> All updates are manual, and are done via pull requests.

The pull requests can be and some are automated, so not all are manual. But more importantly, how would it help?

> Existing versions don't tend to have their metadata updated (I'm not sure winget would accept it). Only new versions are supported.

The attack is version update! How is the old manifest version relevant here?

> You can see all the checks that go into cpu-z updates with the latest PR:

> Description : Invoke an Azure Function > Static Analysis > Status: Started > Status: InProgress

Excellent, now how can I get the answer to the question from this valuable information?

Package managers also saved people from the Notepad++ hijack that was disclosed a couple months ago.

I think devs should avoid distributing their software on first party sites unless they're willing to dedicate a bunch of time to making sure all the infra is secure. Not a lot of people verify signatures, but it's also good to have your PKI in order (signing keys should be available on multiple channels)

No, WinGet does not generally protect against this. While PRs to update package versions are verified in some way before going live, the necessary throughput can only be achieved with shallow checks. A determined actor could easily get a malicious update in, once they control the original source.

Other than that, WinGet is mostly just "run setup.exe". It is not a package manager. It's basically MajorGeeks as a mediocre CLI.

Nonsense. WinGet has the ability to add repositories, just like any other package manager. If you want the 'approved' packages for the distro, that would be the msstore repository. If you want to use the 'community feed', which WinGet warns you about the first time you use it, it's less vetted, but still goes through Defender scans and community moderators.

If you go adding any old repo to APT, you have the same risk. You should look at how much code review goes into packages for major distros like Debian, hint, not much, especially once the initial package was accepted.

Seems the installers hosted by them are fine. The links on the site have been changed to direct people towards Cloudflare R2 storage with various copies of malicious executables.

Looking forward to information down the line on how this came about.

Not exactly a supply chain compromise, as devs should be smart enough to update via a package manager such as winget and chocolatey, but it certainly fits for a watering hole attack.

I suppose one could view it as a supply-chain compromise of an alternate chain that's very short.

This is bad. I like to install software with winget. Are the versions there also compromised?

v1.63 updated 6 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.HWMonitor

v2.19 updated 15 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.CPU-Z

same threat group hit filezilla last month with a fake domain. this time they didn't even need a fake domain, they compromised the real one's api layer. the attack is evolving from 'trick users into visiting the wrong site' to 'make the right site serve the wrong file.'

FileZilla has had a history of intentionally bunding adware/spyware, so aren't they the threat to begin with?

https://en.wikipedia.org/wiki/FileZilla#Bundled_adware_issue...

some good details here https://xcancel.com/vxunderground/status/2042483067655262461

"Bug fixes and general improvements."

Supply chain attacks are easier because changelogs for most software are useless now if they are provided at all.

"Fix for a critical issue when querying the CPU that could lead to data corruption in other processes executing at the same time"

Or, "hey ChatGPT generate me a changelog for updates and fixes I could make to the software CPU-Z"

Expecting a more detailed changelog doesn't help at all

(I'm not even sure you'd need to prompt an LLM around guardrails like I did here, it would probably happily spit out a fake changelog even if you were explicit about it not being real as long as you don't tell the LLM you're planning to trick people with malware)

I've wondered about this while using CachyOS and their package installer. I don't know what repos do what, I don't really understand the security model of the AUR, and I wonder, if I download a package, how can I know it's legitimate or otherwise by some trusted user of the community vs. some random person?

To provide some quick information (I implore others to correct me here):

- CachyOS packages should be coming from known, trusted CachyOS and Arch Linux maintainers. There is still potential for them or their original packages to get compromised (See XZ backdoor) however they are pulling source code from trusted sources so you can generally trust these as much as your trust the OS itself.

- AUR packages are a complete wild west. AUR packages are defined by PKGBUILD files and I highly recommend learning how to read PKGBUILDs and always reading them before installation and re-reading them when they are updated. PKGBUILDs for AUR packages can be treated as untrusted shell scripts and to a certain extent an arbitrary actor can make and upload any PKGBUILD to the AUR. Feel free to use them, but make sure A) they are downloading from trusted sources like the original git repo and B) they are running commands that are expected.

EDIT: Improved accuracy.

Jesus. I see that post and comment section and I immediately expect to hear Joey telling me about how this ATM is Idaho started spraying cash after his hack of the Gibson. That is a real-life reproduction of the perception of hackers in films in the '90s.

someone has some l33t sk1llz

From the thread:

> Q: Why the heck did you hyperlink [the malware installer]?

> A: If someone reads this and they still click the download then they kind of deserve the virus tbh

And CSI: Miami, which kept the vibe alive through the 2000s and "educated the masses" on how IT works. Beep boop, I'm in.

The counter-hacker double-keyboarding sequence was inspiring.

wow https://youtube.com/watch?v=kl6rsi7BEtk

Just my luck that I needed and downloaded CPU-Z yesterday at work, after not needing it for years. Fortunately my download is not detected as malicious by Virustotal, but what a scare.

One interesting thing about all this stuff is that we may see a big swing towards paid/trusted solutions for all these type of things.

Maybe the 5-10% of true nerds will go find the l33t open source solutions, but most people will just use some paid solution.

Maybe Steam could build. Or in Windows. Or some SaaS solution for registry.

In exchange you just share your HW info

If one were conspiratorially-minded, one would even be inclined to believe that these were deliberately done to push us towards that authoritarian dystopia of "trusted computing".

Wait, people still download unsigned exes from PHP-era websites in 2026? And then act surprised when the download link starts pointing to malware?

At this point if your software isn't distributed through a repo with verifiable builds, you're basically running a malware lottery for your users. The only question is when, not if.

CPUID got lucky it was only 6 hours. Imagine if the attackers had better taste in filenames than "HWiNFO_Monitor_Setup.exe" lmao

> PHP-era

PHP-era is still today

Is anything not potentially compromised these days? Wow.

Grok post linking further sources: https://x.com/i/grok/share/3b870ceb9b424c01bf89afbe0de3bd81

Reply on news.ycombinator.com