Slashdot Mirror
The CCleaner Malware Fiasco Targeted at Least 20 Specific Tech Firms (wired.com)
An anonymous reader shares a report: Hundreds of thousands of computers getting penetrated by a corrupted version of an ultra-common piece of security software was never going to end well. But now it's becoming clear exactly how bad the results of the recent CCleaner malware outbreak may be. Researchers now believe that the hackers behind it were bent not only on mass infections, but on targeted espionage that tried to gain access to the networks of at least 20 tech firms. Earlier this week, security firms Morphisec and Cisco revealed that CCleaner, a piece of security software distributed by Czech company Avast, had been hijacked by hackers and loaded with a backdoor that evaded the company's security checks. It wound up installed on more than 700,000 computers. On Wednesday, researchers at Cisco's Talos security division revealed that they've now analyzed the hackers' "command-and-control" server to which those malicious versions of CCleaner connected. On that server, they found evidence that the hackers had attempted to filter their collection of backdoored victim machines to find computers inside the networks of 20 tech firms, including Intel, Google, Microsoft, Akamai, Samsung, Sony, VMware, HTC, Linksys, D-Link and Cisco itself. In about half of those cases, says Talos research manager Craig Williams, the hackers successfully found a machine they'd compromised within the company's network, and used their backdoor to infect it with another piece of malware intended to serve as a deeper foothold, one that Cisco now believes was likely intended for industrial espionage.
If you never read this essay here it is
https://www.ece.cmu.edu/~gange...
Malware is slowly moving up the software chain to where this is becoming increasingly plausible.
Some drink at the fountain of knowledge. Others just gargle.
...for outlining why I thought specific 32 bit platforms, like those used by corporate computing because they tend to maintain their existing image over time even if they have 64 bit machines rather than migrating to a 64 bit OS. Home computers have been sold with essentially only 64 bit OSes preinstalled for several years. Only ancient home computers and business computers are still 32 bit. Natural filter, reduces the amount of unwanted communications to the Command and Control servers.
Do not look into laser with remaining eye.
Ben Kenobi: ...so you can see it was cleaning them...from a certain point of view.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Seems weird that major tech firms would even bother with the likes of CCleaner... I'd assume they'd just re-image the PC's once they start getting fucky. In fact, I"m not even sure that most people use CCleaner.
You clearly overestimate the intelligence of management, supervisors, and service technicians.
We had a lead technician still trying to use Regclean a few years ago. On Windows 7 and Windows 8.1 computers. Same technician kept setting ethernet interfaces to 10Mbit Half Duplex because he somehow interpreted the time that 10/half was needed to push far beyond the 100m channel-length for a waaaaay overlength data drop as the Setting That We Should All Set.
My point is that a lot of myth and misunderstanding goes into IT, and often we get good results despite the stupidity, rather than because of it. I have no doubt that some technicians swore by CCleaner and used it in the corporate setting, and some IT departments even routinely used it in lieu of reimaging infected computers.
Do not look into laser with remaining eye.
My rule of thumb is never trust a source with foreign ties. We learned this from Kaspersky that its hard to distinguish if they are completely above board or not. Experts have said since Windows 7 that a registry cleaner is absolutely not recommended and could do more harm then good. Obviously they were not thinking in terms of malware. But don't install stuff on your PC that isn't needed.
Why China? The companies targeted already manufacture most of their products in China, so China already has access to their technology.
Do not look into laser with remaining eye.
This is yet another example of the anti-virus being the virus. Seen it many times and thatâ(TM)s why I donâ(TM)t use any anti virus products
CCleaner was always garbage that hosed the registry and "cleaned up" /TEMP. Completely useless and in many cases caused problems due to removal of placeholder registry items.
Anyone who thought that CCleaner was "security software" has no business using it, let alone submitting an article to Slashdot about it.
It's a junk/orphan file cleanup utility. Not "security software". Not antivirus or anti-malware. Where do these idiots come from reporting this shit?
Comment removed based on user account deletion
If you simply wish to verify you are not getting a trojan embedded into your binary by a compiler then you simply need to cross-compile a compiler from multiple compilers on multiple architectures and then compare the binaries each of the cross-compiled compilers produce. An example of this would be building GCC for x86 using itself and using Clang/LLVM on ARM (targetting x86). If the resulting builds of the GCC for x86 compiler produce identical binaries then it's extremely unlikely that either compiler is compromised. With each additional compiler and architecture used, it become exponentially less likely that the compile has been compromised.
It would require a sophisticated AI to create a self-perpetuating trojan that would run on all modern platforms and embed itself in all modern compilers. However, if your "Hello World" program starts producing a 10MB binary, you may want to be concerned.
Anons need not reply. Questions end with a question mark.
The code and techniques look like APT17 aka DeputyDog - hacking into tech firms, military and governments for the Chinese government for at least 10 years.
They realized CCleaner was a fantastic indirect vector into a whole lot of firms, and god knows what else they've got their fingers in that people haven't noticed since most firms are Equifax level incompetent with security.
I use Avast free for a lot of my clients. Since CCCleaner is run by them, does that imply that I shouldn't trust Avast either?
They give the illusion of security behind the wall.
If everything was exposed naked to the internet, it would have to be designed properly to be secure in the first place.
"Sneaking behind a corporate firewall" only works if the machines behind that wall are not properly protected from each other.
Russia are engaged in low-intensity warfare with the US. They're funding and inciting extremes at both ends of the political spectrum. It's working a treat, and the President can't get his tongue far enough up Dear Leader Vlad's ass.
I fully expect them to be behind both this and Equifax, and numerous others. And you can be sure that whoever challenges Trump in 3 years will have plenty of relevatory 'hacks' at inconvenient times, right on schedule.
A fucking pathetic effort, to be honest.
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
The CCleaner Malware Fiasco Targeted at Least 20 Specific Tech Firms
None of them were Linux companies.
All of them own or lease structures featuring at least one SINK. Join the dots people.
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
There's no doubt you get a certain security through obscurity from using such an unfashionable OS. Following your logic though, your should probably be on BeOS or TempleOS.
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
It was Lithuania.