Toggle sidebar Toggle sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

CPU-Z/HWMonitor malware

Yes it is going to get much worse. Perplexity is basically just spyware for your computer, phone etc too and our company is pushing it like it's the second coming of Jesus himself. I have voiced my concerns but money and revenue trumps safety of customers every time.
 
  • Like
Reactions: throAU
See. This is why you shouldn't listen to vendors to update right away or automatically and wait for things to settle down and manually load the STABLE version.
 
  • Like
Reactions: canadianreader
diamond.g said:
In this case, the portable apps version or the non-installer version (zip) would probably be "fine".
Click to expand...
Not really, if you downloaded it from the site that was hacked, you’re still boned.

The only real solutions to this are:
decent AV
keep an eye on news
ideally get your software from a trusted source (not necessarily the author) that vets it before signing it, and only run signed code
certificates on software so that code signing is required and can be revoked if it is determined to be compromised


shock horror, the things that apple is doing on the app store, microsoft is somewhat doing on the ms store and what google is supposedly doing on the play store.

this is why code signing is a thing.
 
  • Like
Reactions: pshufd
throAU said:
Not really, if you downloaded it from the site that was hacked, you’re still boned.

The only real solutions to this are:
decent AV
keep an eye on news
ideally get your software from a trusted source (not necessarily the author) that vets it before signing it, and only run signed code
certificates on software so that code signing is required and can be revoked if it is determined to be compromised


shock horror, the things that apple is doing on the app store, microsoft is somewhat doing on the ms store and what google is supposedly doing on the play store.

this is why code signing is a thing.
Click to expand...
So I think, if I am reading this correctly, that the best way to get software at this point is through the store of whatever platform you are using.

That's one thing that scares me about linux. Software is all developed by mostly single people or a couple of people. Who's to say there's not malicious codes built in.
 
  • Like
Reactions: throAU
Steve Adams said:
So I think, if I am reading this correctly, that the best way to get software at this point is through the store of whatever platform you are using.
Click to expand...
Some point to ponder
  • The developer will get less money if you go this route (for non-free software). For small developers this can be significant.
  • In many cases the software will be less featured, as app stores have stricter rules on what you can and cannot do
  • Lack of applications, the MAS is not as robust as apple wants, as many developers prefer direct sales. The Windows apps store is a lot worse, its app store is a barren wasteland
  • There still has been malware popping up in the app store, rare to be sure, at least on the MAS, it has occurred more often on the windows app store.
 
  • Like
Reactions: Steve Adams
maflynn said:
Some point to ponder
  • The developer will get less money if you go this route (for non-free software). For small developers this can be significant.
  • In many cases the software will be less featured, as app stores have stricter rules on what you can and cannot do
  • Lack of applications, the MAS is not as robust as apple wants, as many developers prefer direct sales. The Windows apps store is a lot worse, its app store is a barren wasteland
  • There still has been malware popping up in the app store, rare to be sure, at least on the MAS, it has occurred more often on the windows app store.
Click to expand...
I guess I read his comments wrong. What are the safeguards with linux?
 
Steve Adams said:
I guess I read his comments wrong. What are the safeguards with linux?
Click to expand...
Linux does not offer any greater protections then macOS, it does not have the gatekeeper for instance, but its better then windows. Open source means that anyone and everyone has access to the software so its harder to sneak in malware. What is more likely is bad actors can and have snuck in back doors to software as those are harder to catch.

The biggest difference on why there seems to be so little malware on linux is its marketshare (on the desktop). Linux occupies so little, that the bad actors often focus their attention on Windows, this is also one reason why macos hasn't had a huge issue with malware.

I'm not using Linux because its safer, but rather its overall a better environment windows and game playing is superior to that of macos.
 
  • Like
Reactions: Steve Adams
throAU said:
Not really, if you downloaded it from the site that was hacked, you’re still boned.

The only real solutions to this are:
decent AV
keep an eye on news
ideally get your software from a trusted source (not necessarily the author) that vets it before signing it, and only run signed code
certificates on software so that code signing is required and can be revoked if it is determined to be compromised


shock horror, the things that apple is doing on the app store, microsoft is somewhat doing on the ms store and what google is supposedly doing on the play store.

this is why code signing is a thing.
Click to expand...
Okay so TPU says that there was a compromised cryptbase.dll file in the folder that was the cause of the infection. The actual cpu-z EXE was "fine". For that utility I usually just pull the exe from the zip and run it by itself. I don't normally keep all the extra files. Then again I haven't downloaded cpu-z in like a year (updates are really only useful when new chips like nova lake come out).

It also looks like the website was changed to point to a different payload, it was claimed that the original files were not compromised.
 
Steve Adams said:
So I think, if I am reading this correctly, that the best way to get software at this point is through the store of whatever platform you are using.

That's one thing that scares me about linux. Software is all developed by mostly single people or a couple of people. Who's to say there's not malicious codes built in.
Click to expand...

Yeah thats the thing.

People whine and complain about “i paid for the computer i should be able to run what i want! gatekeeper bad!” etc.

BUT…. It’s not just these big corps being bad. They do bad things too, but code signing, TPM, etc. is all a legit effort to at least attempt to mitigate malware damage/spread as much as possible.

The concept is:
* author makes software, signs it with their developer cert granted to them by the platform.
* software reviewed by store to make sure it is clean then added to store
* device only runs software signed with valid certificate from vendor
* if the vendor discovers the software is malware, they revoke the digital certificate and the OS no longer trusts it to be run, even if it was already downloaded, virus scanner didn’t find anything in it because the malware was sneaky/unknown when it was scanned, etc.

Whether its apple, google, microsoft the tech is basically the same. This is the flip side to security vs. just fixing bugs… if the site hosting the software you download gets hacked and the hosted software gets compromised, that’s a “supply chain attack” and you inadvertently end up installing malicious software.

This is why almost all my mac software is from the store if at all possible, and why i seriously recommend people to stick to apps in the Apple/Play/MS store as much as you can, and to leave things like gatekeeper and system integrity protection TURNED ON. If you need something not in the store, so be it, just be aware that there may be some additional risks. Even if you’re a technical, competent user, supply chain attacks like the one currently in the news for cpu-Z are things you will never detect just by being competent. Getting things from the store at least gives you the chance that the vendor detects the issue before it hurts you too much and they revoke the software’s ability to run.

If you disable gatekeeper on your machine - this process to save you doesn’t work because you told macOS to ignore security certificate requirements. Apple can disable the certificate but your mac is configured to not check it.

This is a huge reason why all the mobile/tablet platforms are far more secure than Windows and macOS in general - they never ran unsigned software (well, android did, but google are trying to backtrack on that and push you to the store), whereas mac and windows have been doing it for years, and both vendors are gradually trying to wean people off that. At least if software is signed it can be “turned off” globally if it is found to be malicious by revoking its cert.

With Linux? Yeah, it’s a bit wild out there. IN theory the same tech can be applied BUT… linux is full of anti-authoritarian evangelists so trying to get digital signing implement is… hard. In theory, its all open source but yes - on linux you have a choice to either get your software from random places on the internet, or get it from the distribution store/package repository and hope that the maintainers of the distribution audit it well enough.
 
Last edited:
  • Like
Reactions: Steve Adams
diamond.g said:
Okay so TPU says that there was a compromised cryptbase.dll file in the folder that was the cause of the infection. The actual cpu-z EXE was "fine". For that utility I usually just pull the exe from the zip and run it by itself. I don't normally keep all the extra files. Then again I haven't downloaded cpu-z in like a year (updates are really only useful when new chips like nova lake come out).

It also looks like the website was changed to point to a different payload, it was claimed that the original files were not compromised.
Click to expand...

In this case, sure, whatever.

however this is indicative of a much more serious and widespread problem, and its only getting worse.

Rather than playing a combination of russian roulette / whack a mole, the industry and end users need to be smarter about software hygiene.

If you think “i’m safe, nobody is targeting me” you’re wrong. If you use a computer on the internet or with software obtained from the internet - you are a target.

Act accordingly.
 
  • Like
Reactions: diamond.g and Steve Adams
maflynn said:
Some point to ponder
  • The developer will get less money if you go this route (for non-free software). For small developers this can be significant.
  • In many cases the software will be less featured, as app stores have stricter rules on what you can and cannot do
  • Lack of applications, the MAS is not as robust as apple wants, as many developers prefer direct sales. The Windows apps store is a lot worse, its app store is a barren wasteland
  • There still has been malware popping up in the app store, rare to be sure, at least on the MAS, it has occurred more often on the windows app store.
Click to expand...

Yeah these are all valid points.

For me though:
* my security > developer profit
* thats a trade off i am normally willing to make; those more featured apps are that way because they are using processes or permissions to do the thing in macOS in a less secure way and haven’t bothered to update to be compatible with the app store restrictions. sure, SOME thing simply may not be possible. then its a check to determine if i need that specific app feature bad enough, 99.9% of the time the answer is NO.
* yup - the app store is not complete, but definitely suggest to check there first, if its not available there then sure. get it form the internet. but the more you can limit doing that, the more you limit your exposure to malware risk
* yup, occasionally malware can/will slip through into the store, but as per above there are methods to neuter it when discovered. if you get stuff from the internet, especially if you disable gatekeeper - if you accidentally install it, good luck!


Exact same points apply to Windows and Android too, for the exact same reasons.

Apple, Microsoft and Google generally have far better store security than some random dude’s $10/month web host that he’s uploaded his work to. Because no matter how much you trust the developer, his software is hosted on whatever service he put it on/can afford. If that $10/month web host gets hacked, his content (i.e., the installer you download) may be modified.

And i guarantee some personal hosting is likely less well maintained/protected than the big app stores.
 
Last edited:
throAU said:
Yeah thats the thing.

People whine and complain about “i paid for the computer i should be able to run what i want! gatekeeper bad!” etc.

BUT…. It’s not just these big corps being bad. They do bad things too, but code signing, TPM, etc. is all a legit effort to at least attempt to mitigate malware damage/spread as much as possible.

The concept is:
* author makes software, signs it with their developer cert granted to them by the platform.
* software reviewed by store to make sure it is clean then added to store
* device only runs software signed with valid certificate from vendor
* if the vendor discovers the software is malware, they revoke the digital certificate and the OS no longer trusts it to be run, even if it was already downloaded, virus scanner didn’t find anything in it because the malware was sneaky/unknown when it was scanned, etc.

Whether its apple, google, microsoft the tech is basically the same. This is the flip side to security vs. just fixing bugs… if the site hosting the software you download gets hacked and the hosted software gets compromised, that’s a “supply chain attack” and you inadvertently end up installing malicious software.

This is why almost all my mac software is from the store if at all possible, and why i seriously recommend people to stick to apps in the Apple/Play/MS store as much as you can, and to leave things like gatekeeper and system integrity protection TURNED ON. If you need something not in the store, so be it, just be aware that there may be some additional risks. Even if you’re a technical, competent user, supply chain attacks like the one currently in the news for cpu-Z are things you will never detect just by being competent. Getting things from the store at least gives you the chance that the vendor detects the issue before it hurts you too much and they revoke the software’s ability to run.

If you disable gatekeeper on your machine - this process to save you doesn’t work because you told macOS to ignore security certificate requirements. Apple can disable the certificate but your mac is configured to not check it.

This is a huge reason why all the mobile/tablet platforms are far more secure than Windows and macOS in general - they never ran unsigned software (well, android did, but google are trying to backtrack on that and push you to the store), whereas mac and windows have been doing it for years, and both vendors are gradually trying to wean people off that. At least if software is signed it can be “turned off” globally if it is found to be malicious by revoking its cert.

With Linux? Yeah, it’s a bit wild out there. IN theory the same tech can be applied BUT… linux is full of anti-authoritarian evangelists so trying to get digital signing implement is… hard. In theory, its all open source but yes - on linux you have a choice to either get your software from random places on the internet, or get it from the distribution store/package repository and hope that the maintainers of the distribution audit it well enough.
Click to expand...
Ok, so I did read that right. I agree as well. Most of what's on my pc's are from the MS store.
 
  • Like
Reactions: throAU
Oh one big thing i forgot to mention that may not be obvious.

If software is digitally signed, then modified (after the developer signed it) then the certificate signature breaks and no longer works. it is clear the software has been tampered with at that point, you can think of the signature as a warranty seal from whoever signed it.

This is the good thing about signing, and keeping gatekeeper ON, even if you get stuff from the internet: if the dev signed the software and then someone hacked his site to modify it, it is no longer signed, unless the bad guy signed it with his own code signing cert (or, he somehow stole the developer’s code signing credentials in which case there’s far more serious problems than just his website being hacked).

So yeah

store first
signed code from third party site that will run with gatekeeper ON second
last resort: having to turn gatekeeper off to run unsigned stuff. really, seriously try not to do that because you’re on your own at that point.
 
Last edited:
  • Like
Reactions: Howard2k and TechnoMonk
Linux is a security nightmare. I have to run through hoops to maintain my Linux workstation. It’s easier to sneak in rogue libraries, and probably will take months and years to figure out by a random researcher. I don’t use mac AppStore but I don’t download random utilities. I have bunch of health scripts I run if needed.
 
  • Like
Reactions: throAU
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back