Slashdot Mirror
The CCleaner Malware Fiasco Targeted at Least 20 Specific Tech Firms (wired.com)
An anonymous reader shares a report: Hundreds of thousands of computers getting penetrated by a corrupted version of an ultra-common piece of security software was never going to end well. But now it's becoming clear exactly how bad the results of the recent CCleaner malware outbreak may be. Researchers now believe that the hackers behind it were bent not only on mass infections, but on targeted espionage that tried to gain access to the networks of at least 20 tech firms. Earlier this week, security firms Morphisec and Cisco revealed that CCleaner, a piece of security software distributed by Czech company Avast, had been hijacked by hackers and loaded with a backdoor that evaded the company's security checks. It wound up installed on more than 700,000 computers. On Wednesday, researchers at Cisco's Talos security division revealed that they've now analyzed the hackers' "command-and-control" server to which those malicious versions of CCleaner connected. On that server, they found evidence that the hackers had attempted to filter their collection of backdoored victim machines to find computers inside the networks of 20 tech firms, including Intel, Google, Microsoft, Akamai, Samsung, Sony, VMware, HTC, Linksys, D-Link and Cisco itself. In about half of those cases, says Talos research manager Craig Williams, the hackers successfully found a machine they'd compromised within the company's network, and used their backdoor to infect it with another piece of malware intended to serve as a deeper foothold, one that Cisco now believes was likely intended for industrial espionage.
If you never read this essay here it is
https://www.ece.cmu.edu/~gange...
Malware is slowly moving up the software chain to where this is becoming increasingly plausible.
Some drink at the fountain of knowledge. Others just gargle.
One or the other... taking bets...
My money is on China.
...for outlining why I thought specific 32 bit platforms, like those used by corporate computing because they tend to maintain their existing image over time even if they have 64 bit machines rather than migrating to a 64 bit OS. Home computers have been sold with essentially only 64 bit OSes preinstalled for several years. Only ancient home computers and business computers are still 32 bit. Natural filter, reduces the amount of unwanted communications to the Command and Control servers.
Do not look into laser with remaining eye.
Ben Kenobi: ...so you can see it was cleaning them...from a certain point of view.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
I blame the users with admin privileges. I can't imagine an enterprise-level IT department using CCleaner as an approved application. However, this is an application that a user with admin privileges would install because they know better than the IT department. Which is what the hackers are counting on.
Seems weird that major tech firms would even bother with the likes of CCleaner... I'd assume they'd just re-image the PC's once they start getting fucky. In fact, I"m not even sure that most people use CCleaner.
My rule of thumb is never trust a source with foreign ties. We learned this from Kaspersky that its hard to distinguish if they are completely above board or not. Experts have said since Windows 7 that a registry cleaner is absolutely not recommended and could do more harm then good. Obviously they were not thinking in terms of malware. But don't install stuff on your PC that isn't needed.
I'm still waiting slashdot- the biggest story of the week was the Morgan Freeman video produced by an alliance of leading figures in the Democrat and Repulican parties of the USA- declaring that the USA is at war with Russia.
The producer of the video was leading jewish liberal Hollywood personality- Rob Reiner. And it was Reiner personally who demanded a famous beloved 'black' actor read the line stating that the USA was a 'shining beacon to the world' during the years when legally 'black' women and children were RAPE slaves. Jewish Rob Reiner had a much admired 'black' personality praise the holocaust of Human slavery- and you people are still proud for voting Clinton.
The owners of Slashdot are in a bit of a dilemma. It is now clear that the Deep State is grooming Trump for a second term- having eliminated every last ounce of his anti-war feelings. So 'bash Trump' propaganda is ending, and 'bash Russia' programs are accelerating. But at this time Russia is crushing Clinton's wahhabi terror gangs in Syria down to the last man, and the regional players are now dancing to Russia's, not America's tune.
But the new wave of 'anti-Russian' warmongers are the racist psychopaths like Rob Reiner- and for ordinary Americans seeing Freeman and Reiner blow their 'liberal' cover and come out as frothing loonies screaming their love for the time of Human Slavery in the States- well this makes even the dumbest sap start to think twice about recent mainstream media propaganda.
Anyway personally I take great joy in pointing out to you Yanks that you are going to have Trump for far longer than you thought. Not because people like me like Trump (at the time he was the better option compared to war criminal Clinton). But simply because you Clinton voters deserve all the mental pain in the world for all the mass murder and destruction you happily justified in your sick hypocrisy. Trump is a horror- true- but only a horror was going to make it to the White House. The two houses of US government now bloc vote like a Stalin Congress for War and anything in Israel and Saudi Arabia's interest. The US president merely fronts this state of affairs.
Slashdot has carried an astonishing amount of NSA/CIA inspired propaganda across the last few years- having long given up its pretence of being what it says on the label. Slashdot was simply a front to reach the 'nerd' section of society with the Clinton messages of hatred and militarism. So given the clear 'political' purpose of the current Slashdot, each of you should notice what doesn't get covered here- and know that censorship by omision allows you to comprehend what currently troubles your Deep State masters.
because judging from the description, this is exactly how America uses NSA to spy on Europe etc.
Needs extra spyware to make it operate smoothly.
Hatstand. That is all.
This is yet another example of the anti-virus being the virus. Seen it many times and thatâ(TM)s why I donâ(TM)t use any anti virus products
The CCleaner Malware Fiasco Targeted at Least 20 Specific Tech Firms
None of them were Linux companies.
I think you're forgetting that one of the reasons to stick with 32 bit is external software (that includes drivers) that doesn't have a 64 bit version and will not work in a 64 bit OS.
CCleaner was always garbage that hosed the registry and "cleaned up" /TEMP. Completely useless and in many cases caused problems due to removal of placeholder registry items.
You lazy technicians.
There is absolutely no reason to leave CCleaner on a computer - period.
It is a cleaning tool. It does not need to always be running. Why leave a program installed that really only needs to be ran once every 6 months for maintence purposes.
Go find a hobby, you simp.
"How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine"
https://www.blackhat.com/eu-17/briefings/schedule/#how-to-hack-a-turned-off-computer-or-running-unsigned-code-in-intel-management-engine-8668
"It allows an attacker of the machine to run unsigned code in PCH on any motherboard via Skylake+. The main system can remain functional, so the user may not even suspect that his or her computer now has malware resistant to reinstalling of the OS and updating BIOS."
"New FinFisher surveillance campaigns: Are internet providers involved?"
https://www.welivesecurity.com/2017/09/21/new-finfisher-surveillance-campaigns/
"What’s new – and most troubling – about the new campaigns in terms of distribution is the attackers’ use of a man-in-the-middle attack with the “man” in the middle most likely operating at the ISP level. We have seen this vector being used in two of the countries in which ESET systems detected the latest FinFisher spyware[...]. When the user – the target of surveillance – is about to download one of several popular (and legitimate) applications, they are redirected to a version of that application infected with FinFisher."
Anyone who thought that CCleaner was "security software" has no business using it, let alone submitting an article to Slashdot about it.
It's a junk/orphan file cleanup utility. Not "security software". Not antivirus or anti-malware. Where do these idiots come from reporting this shit?
Comment removed based on user account deletion
If you simply wish to verify you are not getting a trojan embedded into your binary by a compiler then you simply need to cross-compile a compiler from multiple compilers on multiple architectures and then compare the binaries each of the cross-compiled compilers produce. An example of this would be building GCC for x86 using itself and using Clang/LLVM on ARM (targetting x86). If the resulting builds of the GCC for x86 compiler produce identical binaries then it's extremely unlikely that either compiler is compromised. With each additional compiler and architecture used, it become exponentially less likely that the compile has been compromised.
It would require a sophisticated AI to create a self-perpetuating trojan that would run on all modern platforms and embed itself in all modern compilers. However, if your "Hello World" program starts producing a 10MB binary, you may want to be concerned.
Anons need not reply. Questions end with a question mark.
Comment removed based on user account deletion
Comment removed based on user account deletion
The code and techniques look like APT17 aka DeputyDog - hacking into tech firms, military and governments for the Chinese government for at least 10 years.
They realized CCleaner was a fantastic indirect vector into a whole lot of firms, and god knows what else they've got their fingers in that people haven't noticed since most firms are Equifax level incompetent with security.
Glad I use a mac.
AV software? LOLOLOLOL.
Comment removed based on user account deletion
I use Avast free for a lot of my clients. Since CCCleaner is run by them, does that imply that I shouldn't trust Avast either?
They give the illusion of security behind the wall.
If everything was exposed naked to the internet, it would have to be designed properly to be secure in the first place.
"Sneaking behind a corporate firewall" only works if the machines behind that wall are not properly protected from each other.
I have tried to act like creimer on other sites to annoy people.
He's so well known and annoying I'm sure people do it here too.
You're almost definitely creimer.
You're violating AUP on sock puppets as well as the personal deal you made with slashdot staff when they tried to help you sort all this out by wiping your 100 accounts and renaming your embarrassing primary account.
I don't know why they help you at all I would have banned your whole C class and called it problem solved.
If you're looking for a TL;DR it's "I'm a simple cunt who blames all his problems on jews, blacks, women, and other favored objects of hate for neckbeard dickheads."