CCleaner Compromised to Gather and Transmit Information About Its Users

[Rustys]

Piriform, the company that makes the popular CCleaner application, just announced that their application was hijacked and used to gather information about its users and send it to an unknown party.

http://i1-news.softpedia-static.com/images/news2/ccleaner-compromised-to-gather-and-transmit-information-about-its-users-517750-2.jpg

Hackers usually prefer to penetrate insufficiently secured servers and get the data they want in that manner, but that usually means that webmasters and programmers were not doing their job. Compromising the code for an application to gather information about user’s devices before that app is distributed is on a different level.

Piriform hasn’t said anything about how their systems were penetrated or how the executable was modified before launch, but they did reveal everything that’s been going on, and it’s not a pretty sight. In fact, if you read the short description of the event, it’s even more terrifying.

“An unauthorized modification of the CCleaner.exe binary resulted in an insertion of a two-stage backdoor capable of running code received from a remote IP address on affected systems, ” wrote Paul Yung, VP for Products at Piriform.

More information

http://news.softpedia.com/news/ccleaner-compromised-to-gather-and-transmit-information-about-its-users-517750.shtml

https://www.theverge.com/platform/amp/2017/9/18/16325202/ccleaner-hack-malware-security

[veeg]

Good info…

[Rustys]

The gift the just keeps giving.

CCleaner malware targeted internal networks at Google, Microsoft, and Samsung

More sophisticated than your average malware

https://cdn.vox-cdn.com/thumbor/PJ9eeHtF-oXOL1S2vPzjj6YK1qM=/0x0:2040x1360/1200x800/filters:focal(857x517:1183x843)/cdn.vox-cdn.com/uploads/chorus_image/image/56788625/acastro_170621_1777_0006_v2_fin.0.jpg

The malware attack on Windows utility CCleaner may have been more targeted and sophisticated than it seemed. In the days since the attack was announced, researchers have been poring through data from a seized command and control center, finding evidence that the attackers were using the compromise to target some of the world’s most powerful tech companies.

New posts from Avast and Cisco’s Talos research group detail the findings, as first reported by Wired. At the time the server was seized, the attackers were targeting a string of internal domains with a second-stage payload, designed to collect data and provide persistent access to any infected device.

https://cdn.vox-cdn.com/thumbor/RUe_alyyWKQbGfu6Ir8OWD5PlZ4=/400x0/filters:no_upscale()/cdn.vox-cdn.com/uploads/chorus_asset/file/9294949/domains.png
Domains targeted by the CCleaner malware.

The list of domains, published by Talos, reveals a number of major tech companies. “Ntdev.corp.microsoft.com” is an internal domain for Windows developers, while hq.gmail.com appears to be the internal Gmail instance for Google employees. Other targets include Sony, Samsung, Intel, and Akamai. The domains also include a German slot machine company and major telecoms in Singapore and the United Kingdom.

Read more here…

[jmarket]

I read about this on Talos. Very interesting stuff

CCleaner Command and Control Causes Concern