Slashdot Mirror

← Back to Stories (view on slashdot.org)

Avast's CCleaner Free Windows Application Infected With Malware (bleepingcomputer.com)

Posted by msmash on from the security-woes dept.

Reader Tinfoil writes: Cisco Talos announces that malware cleaning app, CCleaner, has been infected with malware for the past month. Version 5.33 of the CCleaner app offered for download between August 15 and September 12 was modified to include the Floxif malware, according to a report published by Cisco Talos a few minutes ago. Cisco Talos believes that a threat actor might have compromised Avast's supply chain and used its digital certificate to replace the legitimate CCleaner v5.33 app on its website with one that also contained the Floxif trojan. The company said more 2.27 million had downloaded the compromised version of CCleaner.

8 of 156 comments (clear)

  1. Never had a problem until by p51d007 · · Score: 5, Informative

    Avast bought it. Always was a quick easy way to dump the garbage off your computer instead of 2-3 or more programs to do the same thing.

  2. Why payload is so gimped? by sinij · · Score: 5, Interesting

    From the linked article: "The malware collected information such as computer name, a list of installed software, a list of running processes, MAC addresses for the first three network interfaces, and unique IDs to identify each computer in part. Researchers noted that the malware only ran on 32-bit systems."

    Someone capable of poisoning signed downloads (high complexity) should be able to select functional payload (low complexity). I don't see any alternative explanation to "ran on 32-bit systems" limitation other than incompetence. This doesn't add up.

  3. Missing Malware Info by Anonymous Coward · · Score: 5, Informative

    Floxif is a malware downloader that gathers information about infected systems and sends it back to its C&C server. The malware also had the ability to download and run other binaries, but at the time of writing, there is no evidence that Floxif downloaded additional second-stage payloads on infected hosts.

    The malware collected information such as computer name, a list of installed software, a list of running processes, MAC addresses for the first three network interfaces, and unique IDs to identify each computer in part. Researchers noted that the malware only ran on 32-bit systems. The malware also quit execution if the user was not using an administrator account.

    1. Re:Missing Malware Info by TWX · · Score: 5, Interesting

      It's almost like it was meant to inspect corporate or government computers where lazy IT admins might not have migrated 64-bit-capable workstations to 64-bit OSes because they've been maintaining a 32-bit OS/image for years, and to then allow that information to be inspected to determine which computers to attempt to infect with other payloads.

      --
      Do not look into laser with remaining eye.
  4. Re:CCleaner wasn't malware all along? by CaptainDork · · Score: 5, Insightful

    It's not an anti-malware program.

    It's an optimizer.

    --
    It little behooves the best of us to comment on the rest of us.
  5. Re:Anyone know if the malware is detectable / fixa by TWX · · Score: 5, Funny

    Sure. CCleaner version 5.34. Available from downloads.ru today!

    --
    Do not look into laser with remaining eye.
  6. Re:CCleaner wasn't malware all along? by Anonymous Coward · · Score: 5, Insightful

    IT IS NOT ANTI-MALWARE, IT IS A DUPE FILE REMOVER, CACHE FILE CLEANER, UTILITY TOOL FOR REMOVING STUBBORN UNINSTALLERS THAT BROKE, ETC.

    You fucking idiots want to keep saying it's AV because you don't seem to know a god damn thing about it lol. "Oh it's a terrible security model" - On Windows? MORON.

    WHINY PETULANT SLASHDOT BITCHES WHO THINK THEY'RE EXPERTS WITHOUT READING A GOD DAMN THING, LOL

  7. Superficial and inacurate by XSportSeeker · · Score: 5, Informative

    This post is sorely lacking tons of information and the few that are in it are wrong.
    CCleaner is NOT a malware cleaning app. It's a registry and regular file cleaner software.
    Furthermore, let's dig into the case:

    - This ONLY affects the 32-bit version of CCleaner and CCleaner Cloud, which accounts for some 3% of Piriform users. If you are using 64-bit version, you are probably safe. From Piriform’s website: “This compromise only affected customers with the 32-bit version of the v5.33.6162 of CCleaner and the v1.07.3191 of CCleaner Cloud. No other Piriform or CCleaner products were affected.”;

    - From Piriform’s accessment, here’s the actual danger: “The compromise could cause the transmission of non-sensitive data (computer name, IP address, list of installed software, list of active software, list of network adapters) to a 3rd party computer server in the USA. We have no indications that any other data has been sent to the server. Working with US law enforcement, we caused this server to be shut down on the 15th of September before any known harm was done.”

    - The investigation is still ongoing, but Piriform is saying that the issue has been solved, that no harm was done, and what seems like it didn’t originate from official CCleaner/Piriform sources. Which is to say, it could be embedded code that was inserted on 3rd party download websites. There is further explanation on Talos' post how it was a sofisticated attack because whoever did it managed to put up a valid cert on the infected version of Ccleaner though, so there should be more information coming out as the investigation proceeds.

    If you wanna dig more into the whole thing, here's Piriform's official statement:
    https://www.piriform.com/news/...

    And here's Talos security accessment of the case:
    http://blog.talosintelligence....