32-bit CCleaner 5.33 includes a malicious payload

[deustroop]

The affected version of CCleaner (v5.33) was released on August 15, which gave the malware almost a month to infect CCleaner users. Version 5.34 came out on September 12, the same day the CCleaner devs found the malware themselves, and it didn’t have the malware bundled with it.

http://www.tomshardware.com/news/avast-unknowingly-bundled-malware-ccleaner,35477.html

 

[EXCellR8]

heard about it but can't really find much on the actual nature of the infection. it is quite ironic, though...

 

[Iron Woode]

this should be posted in Security sub-forum.

 

[Elixer]

this should be posted in Security sub-forum.

Kinda, thing is, lots of people don't even look at the Security sub-forum.

• It decrypted and unpacked hardcoded shellcode (10 kB large) - simple XOR-based cipher was used for this.
• The result (16 kB in size) was a DLL (dynamic link library) with a missing MZ header.
• This DLL was subsequently loaded and executed in an independent thread.
• Afterwards, a normal execution of CRT code and main CCleaner continued, resulting in the thread with payload running in the background.

Here is the irony...

Czech antivirus company Avast acquired Recuva, Speccy, and CCleaner developer Piriform for an undisclosed amount of money.

 

[corkyg]

Just checked - I had 5.29 installed. 5.33 was in the download folder, but was never installed. Now have 5.34.

Security Forum is the best fit - lots of people can learn.

 

[Elixer]

Just a FYI, if you want to know if you were infected, check to see if you have this key:

When an infected version of CCleaner was installed it would have created a Windows Registry key located at HKEY_LOCAL_MACHINE\SOFTWARE\Piriform\Agomo. Under this key will be two data values named MUID and TCID, which are used by the installed Floxif infection.

Why didn't antivirus software catch the infection?
The CCleaner binary that included the malware was signed using a valid digital certificate.

So... they should also revoke that certificate pronto. (But, they won't.)

 

[EXCellR8]

holy crap I'm still using version 4.05 at work, just checked

 

[Kaido]

Amazing.

 

[PliotronX]

MBAM definitions now identifies the build as malware. A system I looked at today had a mysterious javaw process eating up CPU, perhaps mining. Killed it and uninstalled ccleaner after running MBAM.

 

[Mike64]

I had also downloaded, but never installed 5.33. "Interestingly", the update advisory in the program itself said (unusually) something along the lines of there being "important changes" in the 5.34 update, but the release notes "curiously" failed to mention that 5.33 had been so badly compromised...

MBAM definitions now identifies the build as malware. A system I looked at today had a mysterious javaw process eating up CPU, perhaps mining. Killed it and uninstalled ccleaner after running MBAM.

Some time within the past couple/few days, Kaspersky identified the file, too. I actually thought I'd already deleted it, but apparently I either didn't click on the delete button properly, or inadvertently hit one of the other buttons, because the installer was still there when I checked to see if it was still there after reading the thread.

 

[John Connor]

I don't have a need to update Ccleaner. Been using version 4.xx for a long time. I also use System Ninja and that will find more crap then you never thought possible.

One thing I don't understand is that I see countless people say they ran Ccleaner to clean an infected computer. Ccleaner is not a damn malware cleaner. I don't know why so many people think this. It's also not a cure all either.

You want a pretty decent malware scanner? Try Herdprotect portable. Although their website isn't allowing it to be downloaded right now, you can still get and use it at Softpedia. http://www.softpedia.com/get/PORTABLE-SOFTWARE/Antivirus---Antispyware/Portable-herdProtect.shtml

Why is Herdprotect so good? Because it only uses 63 anti-virus engines, that's why.

But I digress. Definition-based anti-virus won't stop polymorphic malware like ransomeware. For that I use a sandbox approach. There are several solutions. I use Sandboxie. They do have a great support forum.

 

[John Connor]

https://www.ghacks.net/2017/09/21/ccleaner-malware-second-payload-discovered/

 

[deustroop]

What exactly is the point of using any anti virus/malware software when none of them could pick it up ?

It required the most sophisticated research group, Cisco’s Talos.

Where do I sign up ?

 

[WilliamM2]

More concerning than the malware, is just the fact that Avast bought CCleaner. I expect it will suck soon, even without malware. I switched to BitDefender a year ago thanks to Avast constantly finding false positives, and breaking software.

 

[John Connor]

Problem is the server admins that host the Ccleaner executable don't read their access logs and use good security. It's not often you hear about a program that you can download has been replaced with one that has a malware payload.

 

[VirtualLarry]

Problem is the server admins that host the Ccleaner executable don't read their access logs and use good security. It's not often you hear about a program that you can download has been replaced with one that has a malware payload.

Actually, I worry about this constantly. Especially, when you reboot your PC, and when it boots back up and your user logs in, you see "Command Prompt" windows quickly flash up, one or two or rarely three of them, and then they disappear. And then you start to wonder... am I compromised? Where did those come from?

It doesn't help that it's known that Windows Update does that, but what if your Reliability Monitor or Windows Update doesn't show an update from the most recent date? Again, makes you wonder.

ALL Windows Executables should be SIGNED, including .EXE-style installers / extractors. Otherwise, this can happen. (Actually, in this particular case, wasn't it in fact signed?)

Some popular programs, like HDTune.com 's free version, ImgBurn's local copy of their software, and a few others, aren't signed, and would be ripe for such an attack. (Probably already happened? Assume the worst?)

With the tech that the NSA has, they can even replace the .exe in-flight, AS YOU DOWNLOAD it, if your internet router or one in your path is compromised by them. They wouldn't even have to hack the web server.

"They say" that Windows 10 has the "best security out of any Windows version". But I wonder if it's mostly just swiss cheese, moreso than Windows 7.

 

[AdamK47]

I'm more surprised that people still use CCleaner.

 

[corkyg]

Version 5.35 is now available.

 

[Elixer]

Version 5.35 is now available.

v5.35.6210 (20 Sep 2017)
- All builds signed with new Digital Signatures

You mean they actually released builds without a new digital sig?

 

[balloonshark]

One thing I don't understand is that I see countless people say they ran Ccleaner to clean an infected computer. Ccleaner is not a damn malware cleaner. I don't know why so many people think this. It's also not a cure all either.

They tell them to run ccleaner before running scans to shorten the amount of data the scanners have to deal with which saves time. It's common sense really. Every time I have run ccleaner on a relatives computer there at least a gigabyte worth of crap it deletes. Why scan all that crap when it can be easily deleted?

 

[John Connor]

Well, what I was referring to is that I've seen on computer forums people saying that they ran Ccleanr to help clean up an infected computer. I think a vast amount of computer illiterate people think Ccleaner is a cure all, which it is not.

 

[Elixer]

With logs missing, I don't know how they can possibly say this:

Worth noting is that about 40 PCs out of 2.27M had the compromised version of CCleaner product installed, i.e. 0.0018% of the total -- a truly targeted attack.

That is the 2nd malware payload, not the initial malware infection.

https://blog.avast.com/additional-information-regarding-the-recent-ccleaner-apt-security-incident

 

[Elixer]

You know, reading more about this, this was State sponsored. I bet either China or Russia.

They went after SPECIFIC targets, obviously trying to get to them.
The other millions of people that downloaded this were not on the radar per se, it was just a attempt to get to those targets.

The installer had the payload, NOT CCleaner itself.
So... people should be using firewalls that can tell you of OUTBOUND traffic attempts.