Posts

Avast reveals how attackers compromised CCleaner last year

Back in September last year, it was reported that popular system-cleaning tool CCleaner had been compromised by attackers for over a month. Some details of the incident were unclear at the time, but Avast, which acquired maker Piriform last July, has now revealed more information about what happened.

The attack saw hackers modify an updated version of CCleaner to include a malware backdoor. We knew there were 2.27 million downloads of the corrupted installation file worldwide, but how the attackers achieved this feat wasn’t specified at the time.

The security firm’s chief technology officer, Ondrej Vlcek, writes that the threat actors accessed Piriform’s network on March 11, 2017, four months before the company was taken over by Avast. The person or persons responsible somehow managed to get hold of stolen credentials to log into a TeamViewer remote desktop account on a developer PC.

“While we don’t know how the attackers got their hands on the credentials, we can only speculate that the threat actors used credentials the Piriform workstation user utilized for another service, which may have been leaked, to access the TeamViewer account,” he said.

The attackers installed the ShadowPad malware on two of the company’s compromised machines, before using its keylogger abilities to gain further access to Piriform’s systems. It wasn’t until August 2 that the first contaminated download of CCleaner appeared.

“Our investigation revealed that ShadowPad had been previously used in South Korea, and in Russia, where attackers intruded [on] a computer, observing a money transfer,” explained Vlcek.

Of the 2.27 million downloads of the affected program, a second stage attack—installing ShadowPad—took place on just 40 PCs, all of which belonged to tech and telecommunications companies. “We don’t have proof that a possible third stage with ShadowPad was distributed via CCleaner to any of the 40 PCs.”

Vlcek said that for Avast, there are two key takeaways from the attack. “First, M&A due diligence has to go beyond just legal and financial matters. Companies need to strongly focus on cybersecurity, and for us this has now become one of the key areas that require attention during an acquisition process.”

“Second, the supply chain hasn’t been a key priority for businesses, but this needs to change. Attackers will always try to find the weakest link, and if a product is downloaded by millions of users it is an attractive target for them. Companies need to increase their attention and investment in keeping the supply chain secure.”

TechSpot

Malware discovered in CCleaner put millions of users at risk

System-cleaning tool CCleaner is one of the most popular programs of its type in the world. According to Avast, which recently acquired maker Piriform, it boasts over 2 billion worldwide downloads and receives 5 million more each week. But it’s just been reported that up to 2.27 million users were put at risk from a backdoor found in a recent version of the program.

Security firm Cisco Talos warned that version 5.33 of CCleaner, which was downloadable from August 15 to September 11, had been modified to include the Floxif malware. The unaffected version 5.34 was released on September 12, but those who downloaded the tool during the weeks that version 5.33 was available may have unwittingly installed the backdoor.

The exact versions that were infected were the 32-bit version of CCleaner and CCleaner Cloud 1.07.3191. The 64-bit version of CCleaner was not affected.

Floxif can gather information about an infected system and send the data back to a hacker’s server. It can also allow other forms of malware, such as ransomware and keyloggers, to make their way onto a victim’s computer.

It’s unclear exactly how the person or persons responsible breached Avast’s systems, but Talos speculates it could have been “an insider with access to either the development or build environments within the organization.”

Paul Yung, Piriform’s Vice President of Products, has tried to play down the attack. In a blog post today, he wrote: “The threat has now been resolved in the sense that the rogue server is down, other potential servers are out of the control of the attacker.”

“Users of CCleaner Cloud version 1.07.3191 have received an automatic update. In other words, to the best of our knowledge, we were able to disarm the threat before it was able to do any harm.”

The company said it was working with US law enforcement agencies to discover who was behind the incident. “We apologize and are taking extra measures to ensure this does not happen again,” it added.

TechSpot