Hackers compromised CCleaner software by installing a hidden backdoor

Hackers hid malware in CCleaner antivirus software

According to this deep technical analysis of the compromise of CCleaner from Talos Intelligence, Piriform claimed last November that they were adding 5 million new desktop installs of CCleaner each week.

Marco Cova, a senior security researcher at cyber security company Lastline, told International Business Times supply chain attacks are "sort of a holy grail for malware authors because they can efficiently distribute their malware, hide it in a trusted channel, and reach a potentially large number of users".

On Sept. 18, Piriform publicly revealed that its servers had been hacked with attackers modifying CCleaner with a backdoor that possibly infected millions of users.

Hackers compromised CCleaner to infect as many as 2.27 million PCs with malware.

"We would like to apologize for a security incident that we have recently found in CCleaner version 5.33.6162 and CCleaner Cloud version 1.07.3191", Paul Yung of Piriform said in a statement. "Piriform believes that these users are safe now as its investigation indicates it was able to disarm the threat before it was able to do any harm", an Avast spokesperson said.

Anyone who uploaded CCleaner between August 15 to September 12 are advised to manually download and update their software immediately.

Cisco Talos said the attack affected CCleaner version 5.33, which was launched August 15.

Updated versions of CCleaner and CCleaner Cloud have since been released; users of the former should download version 5.34 of CCleaner if they've not already done so, while CCleaner Cloud customers will have already received the update to 1.07.3214. "Users should also update to the latest available version of CCleaner to avoid infection", Cisco advises.

The company's press team said that, if infected, hackers could use the exploit to steal sensitive data and/or credentials which could be used for internet banking or other online activities.

The CCleaner is a popular tool for cleaning out "crap-ware", helping remove temporary files, browser caches, log files and other junk from a system.

The flagged executable was signed with a valid digital certificate issued to Piriform, but came with an additional payload.

In a separate post, Talos reports: "In analyzing DNS-based telemetry data related to this attack, Talos identified a significant number of systems making DNS requests attempting to resolve the domains associated with the aforementioned DGA domains". However, "the lack of automatic updates for the free edition of CCleaner may actually have reduced the total number of users put at risk by the compromised version", United Kingdom security writer Graham Cluley noted in his blog today.

Alternatively, "It is also possible that an insider with access to either the development or build environments within the organization intentionally included the malicious code or could have had an account (or similar) compromised which allowed an attacker to include the code", the researchers added.

CCleaner is the software to clean up the system and optimize its performance.

Related News:

  • Four Florida teams in AP Top 25 poll; Alabama firmly on top

    Four Florida teams in AP Top 25 poll; Alabama firmly on top

    The senior tossed five touchdown passes and threw for 497 yards, giving him 11 scores and 1,135 yards during nonconference play. I flipped Oklahoma State and Ohio State in the eighth and ninth spots this week on the basis of the Cowboys' work at Pitt.
    Senate GOP musters final push to erase Obama health care law

    Senate GOP musters final push to erase Obama health care law

    Bill Cassidy (R., La.) and would replace Obamacare's top-down federal structure and replace it with block grants to states. That includes states like NY and California, which stand to lose federal funds under Graham-Cassidy.
    Canadians touch down in Antigua and Barbuda to help rebuild after Irma

    Canadians touch down in Antigua and Barbuda to help rebuild after Irma

    Browne went on to say that they hope worldwide partners and friendly governments will come forward to assist the island . The Prime Minister Gaston Browne and other officials have attributed this to poor building standards in Barbuda .
  • Interior chief urges shrinking 4 national monuments in West

    Interior chief urges shrinking 4 national monuments in West

    The restrictions aren't as stringent as for national parks, but include limits on mining, timber cutting and recreational activities such as riding off-road vehicles.
    Gas prices hit three-year highs

    Gas prices hit three-year highs

    During the same time in 2014, oil was (and usually is) the main driver of pump prices, as crude traded between $65-$75 per barrel. Not a threat to make landfall, Hurricane Jose, a Category 1, is well off the shore of North Carolina.

    Neville Rodie & Shaw Inc. Sells 1795 Shares of Union Pacific Corporation (UNP)

    Also, it has an estimated price-earnings (P/E) multiple of 17.15 and a trailing 12-month price-earnings (P/E) multiple of 20.11. Earnings per share serves as an indicator of a company's profitability. 620,891 were reported by Millennium Mgmt Ltd Liability.
  • Cowboys' value climbs to $4.8bn atop Forbes' NFL list

    Cowboys' value climbs to $4.8bn atop Forbes' NFL list

    However, the 19-percent increase from 2015 to 2016 suggests that financial growth over the past year has relatively slowed. The Cowboys were the only National Football League club worth $2 billion five years ago, per Forbes .
    MGM announces plans for new CT  casino

    MGM announces plans for new CT casino

    The sale was disclosed in a document filed with the Securities & Exchange Commission, which is available through this link . After this sale, 850,290 common shares of MGM are directly owned by the insider, with total stake valued at $27,141,257.
    European Union  warns Ryanair on cancellation reimbursement, compensation

    European Union warns Ryanair on cancellation reimbursement, compensation

    So far, no flights to and from Cyprus have been axed, but that might change when a "new list" is published midweek. Ryanair is changing its holiday year, which now runs from April to March, to run from January to December instead.
  • Oil Prices Rise Toward $56 As Demand Outlook Brightens

    Oil Prices Rise Toward $56 As Demand Outlook Brightens

    The stock market is still producing plenty of green arrows, and investors need to be able to capitalize. Many investors may feel like they have missed out on the markets getting to where they are today.

    Major League Baseball announces suspension for Willson Contreras

    Cubs manager Joe Maddon told reporters Sunday that he was pleased the situation was resolved. "It's good news", he said Sunday. The backstop appealed the ruling and will now only be forced to sit out one game. "Get it off his mind and play it forward".
    USC dramatically avoids upset in another classic against Texas

    USC dramatically avoids upset in another classic against Texas

    The game lived up to the hype in many ways and we learned more about the Longhorns on a ideal night in Southern California. Following a 6-yard run by Ronald Jones, USC called time out to set up, well, let's call it not a Hail Mary but a Half Mary.


Most liked

United Kingdom businesses call for three-year Brexit transitional deal
But Tobias Ellwood, the Defence minister, acknowledged there was now disunity within the Conservative Party over Brexit . Mrs May's de facto deputy Damian Green said Mr Johnson would not be sacked over his intervention.

Klopp confirms Liverpool trio will start in League Cup
We are obviously together with him and the analysts to show him how we want to play him in this position and in that position. Liverpool can not call on Nathaniel Clyne, Sadio Mane or Adam Lallana but they have an otherwise full squad to choose from.

Kate Walsh Opens Up About Having a Brain Tumor
The auburn beauty dismissed her exhaustion as being due to working an 80-hour week on NBC's legal drama Bad Judge . Even though the tumor was benign, Walsh said that the whole experience was a big wake-up call for her.

Sindhu clinches Korea Open Super Series
After Sindhu's victory, PM Modi in his congratulatory tweet appreciated her efforts to make India pride by winning the title. Though the Japanese lost to Sindhu in the quarter-finals in Seoul last week, she can not be taken lightly at any cost.

Texas judge denies National Football League bid to reinstate Elliott suspension
Noted sports law attorney Daniel Wallach said, "I've never seen that done before and it's very, very unlikely". The NFLPA made its argument through a legal filing Saturday with the 5th U.S.

Sean Spicer makes Emmys cameo in politically-loaded opening
Colbert joked with previous Emmys host Seth Myers about the tweet Trump sent that accused Myers of having "marbles in his mouth". He then made a quip about the crowd size at the award show, which may have looked like an innocent joke at Trump's expense.

Toys R Us could be headed towards bankruptcy
The deal saddled the company with debt, limiting its ability to revamp its stores and make online shopping easier. Toys "R" Us is reportedly set to file for bankruptcy just ahead of the busy holiday shopping season.

Celebrate National Cheeseburger Day with a 'free' cheeseburger from McDonald's
Monday is National Cheeseburger Day , and Shake Shack isn't the only chain with burger deals . Fuddrucker's: Are you up to the 3-Pound Burger Challenge? "Promo is still running till 2 p.m".

Australia go 2-1 up against Belgium in Davis Cup semi-final
The weekend's winners will face the victors of the other semi-final between France and Serbia who are playing in nearby Lille. However, the duo eased through in the tiebreak and are now closing in on an 18th Davis Cup final for France.

How Does Bank of the Ozarks (OZRK) Stack Up Right Now?
The financial services provider reported $0.73 earnings per share (EPS) for the quarter, hitting the consensus estimate of $0.73. After $0.73 actual EPS reported by Bank Of The Ozarks Inc for the previous quarter, Wall Street now forecasts 1.37% EPS growth.

Georgia Tech Police Shoot & Kill Scout Schultz, a Student Wielding a Knife
That video container away to demonstrate another officer strolling up from behind Schultz and after that a gunfire is heard. Once of the officers fired when Schultz continued to advance and would not drop the knife.

Game Preview: Seahawks look to continue recent success against 49ers
In the Seahawks' 17-9 loss to Green Bay last week, he managed a paltry three yards on five carries against his former team. In 2015, he rushed for just 758 yards and reached the end zone three times while dealing with ankle and groin injuries.

Tactical masterclass from Conte helps 10-man Chelsea shut out Arsenal
"I didn't see the red card properly but David Luiz thought he was fouled beforehand", Cahill said on the incident. Chelsea head coach Antonio Conte is adamant Arsenal are a Premier League title contender.

Hurts, No. 1 Alabama overwhelm Colorado State, 41-23
The Rams got on the board early in the second quarter after kicker Wyatt Bryan connected on a 27-yard field goal to make it 17-3. Give some credit to the Rams' offense moving the ball deep and their defense being able to stop some of Alabama's drives.

UN Security Council condemns N.Korea over missile launch
The Philippines has urged North Korea to stop its missile tests and head to the negotiation table instead, hours after Pyongyang launched another missile over Japan.