https://old.reddit.com/r/pcmasterrace/comments/1sh4e5l/warni...
https://www.bleepingcomputer.com/news/security/supply-chain-...
https://old.reddit.com/r/pcmasterrace/comments/1sh4e5l/warni...
https://www.bleepingcomputer.com/news/security/supply-chain-...
v1.63 updated 6 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.HWMonitor
v2.19 updated 15 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.CPU-Z
So two programs from CPUID. I wonder if there are more affected.
Same topic on Reddit at https://news.ycombinator.com/item?id=47718830 @dang
> Q: Why the heck did you hyperlink [the malware installer]?
> A: If someone reads this and they still click the download then they kind of deserve the virus tbh
Looking forward to information down the line on how this came about.
>Dear All, I'm Sam and in I'm working with Franck on CPU-Z (I'm doing the validator). Franck is unfortunately OOO for a couple weeks. I'm just out of bed after worked on Memtest86+ for most the night, so I'm doing my best to check everything. As very first checks, the file on our server looks fine (https://www.virustotal.com/gui/file/6c8faba4768754c3364e7c40...) and the server doesn't seems compromised. I'm investigating further... If anyone can tell me the exact link to the page where the malware was downloaded, that would help a lot
>Thank you. I found the biggest breach, restored the links and put everything in read-only until more investigation is done. Seems they waited Franck was off and I get to bad after working on Memtest86+ yesterday :-/
>The links have been compromised for a bit more than 6 hours between 09/04 and 10/04 GMT :-/
so, it appears that the cpuid website was compromised, with links leading to fake installers.
The script lived above the web root, so they'd have to escape that to tamper with it, and was generated by another script.
Saved me a couple of times since, well worth the 15 minutes I spent on setting it up.
Wait, how often does your Wordpress site get successfully hacked like that?
One time the hosting provider got compromised, FTP server exploit IIRC, they ran a recursive search and replace from root directory of the server.
As I recall, they recommended putting the expected values on a floppy disk and setting the ‘write protect’ tab, so the checksums couldn’t be changed.
when i say i didnt verify, i just mean that i ripped these quotes out of reddit, and did not check whether the reddit username that posted the comments is known to be an identity of Sam.
which you can install with:
winget install --exact --id CPUID.CPU-Z
All updates are manual, and are done via pull requests. Check everything in-queue: https://github.com/microsoft/winget-pkgs/pulls
Existing versions don't tend to have their metadata updated (I'm not sure winget would accept it). Only new versions are supported.
You can see all the checks that go into cpu-z updates with the latest PR: https://github.com/microsoft/winget-pkgs/pull/349095
> All updates are manual, and are done via pull requests.
The pull requests can be and some are automated, so not all are manual. But more importantly, how would it help?
> Existing versions don't tend to have their metadata updated (I'm not sure winget would accept it). Only new versions are supported.
The attack is version update! How is the old manifest version relevant here?
> You can see all the checks that go into cpu-z updates with the latest PR:
> Description : Invoke an Azure Function > Static Analysis > Status: Started > Status: InProgress
Excellent, now how can I get the answer to the question from this valuable information?
I think devs should avoid distributing their software on first party sites unless they're willing to dedicate a bunch of time to making sure all the infra is secure. Not a lot of people verify signatures, but it's also good to have your PKI in order (signing keys should be available on multiple channels)
Other than that, WinGet is mostly just "run setup.exe". It is not a package manager. It's basically MajorGeeks as a mediocre CLI.
> (because i am often working with programms which triggering the defender i just ignored that)
This again shows the unfortunate corrosive effect of false-positives. Probably impossible to solve while aggressively detecting viruses though.
Yes, a very difficult problem, compilers must be pure functions with thin effectful wrappers.
- CachyOS packages should be coming from known, trusted CachyOS and Arch Linux maintainers. There is still potential for them or their original packages to get compromised (See XZ backdoor) however they are pulling source code from trusted sources so you can generally trust these as much as your trust the OS itself.
- AUR packages are a complete wild west. AUR packages are defined by PKGBUILD files and I highly recommend learning how to read PKGBUILDs and always reading them before installation and re-reading them when they are updated. PKGBUILDs for AUR packages can be treated as untrusted shell scripts and to a certain extent an arbitrary actor can make and upload any PKGBUILD to the AUR. Feel free to use them, but make sure A) they are downloading from trusted sources like the original git repo and B) they are running commands that are expected.
EDIT: Improved accuracy.
Well, the enterprise version of ms defender will not only react to it if it does something "weird", but will specifically look at its "reputation" before it runs at all.
However, as another commenter pointed out, this generates a ton of false positives. Basically everything that's "brand new" is liable to trigger it. Think your freshly compiled hellow_world.exe. So, all in all, people may no longer pay attention to it and just click through all warnings.
You're probably thinking about Javascript programmers.
Supply chain attacks are easier because changelogs for most software are useless now if they are provided at all.
kevincloudsec•3h ago