CCleaner Was Compromised for a Month

Stefan Mileschin · 22nd September 2017, 05:26

Nextweb reports that CCleaner 5.33.6162 and CCleaner Cloud version 1.07.3191 were hacked. Between August 15 and September 12 about 2.27 million users downloaded the infected CCleaner version with 5,000 using CCleaner Cloud. The vulnerability allowed a two-stage backdoor to be inserted when running the CCleaner.exe. The malware was also collecting other information including the name of the computer, list of installed software and running processes, and MAC adresses of the first three network adapters. Anyone who has downloaded that version should update immediately. "To the best of our knowledge, the second-stage payload never activated… It was prep for something bigger, but it was stopped before the attacker got the chance."

http://www.hardocp.com/news/2017/09/...sed_for_month/

jmke · 22nd September 2017, 09:36

this is crazy, av company buys CCLeaner and then allows malware to get distributed in an update... like...WTF?

Stefan Mileschin · 23rd September 2017, 14:29

Quote:

Originally Posted by jmke

this is crazy, av company buys CCLeaner and then allows malware to get distributed in an update... like...WTF?

Yes, really stupid! The company I am working for has now required to uninstall manually the utility from about 100 stations, which is a real chore to do....

22nd September 2017, 05:26	#1
Stefan Mileschin [M] Reviewer Join Date: May 2010 Location: Romania Posts: 148,462	CCleaner Was Compromised for a Month Nextweb reports that CCleaner 5.33.6162 and CCleaner Cloud version 1.07.3191 were hacked. Between August 15 and September 12 about 2.27 million users downloaded the infected CCleaner version with 5,000 using CCleaner Cloud. The vulnerability allowed a two-stage backdoor to be inserted when running the CCleaner.exe. The malware was also collecting other information including the name of the computer, list of installed software and running processes, and MAC adresses of the first three network adapters. Anyone who has downloaded that version should update immediately. "To the best of our knowledge, the second-stage payload never activated… It was prep for something bigger, but it was stopped before the attacker got the chance." http://www.hardocp.com/news/2017/09/...sed_for_month/

22nd September 2017, 09:36	#2
jmke Madshrimp Join Date: May 2002 Location: 7090/Belgium Posts: 79,021	this is crazy, av company buys CCLeaner and then allows malware to get distributed in an update... like...WTF? __________________

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
UK industrial software is compromised	Stefan Mileschin	WebNews	0	21st July 2017 07:10
Spammers compromised Twitter accounts for @PlayStation and others	Stefan Mileschin	WebNews	0	20th November 2016 10:39
Acer's new Chromebook 15 is cheap but compromised	Stefan Mileschin	WebNews	0	18th October 2016 11:58
Motorola's new Moto Z Play is cheaper, but not compromised	Stefan Mileschin	WebNews	0	3rd September 2016 14:23
Raptr Service Hacked, Accounts Compromised	jmke	WebNews	0	2nd February 2015 14:49
Snapchat servers 'were never breached,' but your snaps may still be compromised	Stefan Mileschin	WebNews	0	13th October 2014 08:44
Find Out If Your Password Has Been Compromised [H]ardOCP Dec 7	Stefan Mileschin	WebNews	0	9th December 2013 08:46
Ubisoft Hacked, Your Data Compromised	Stefan Mileschin	WebNews	0	3rd July 2013 07:16
ProFTPD.org Compromised, Backdoor Distributed	jmke	WebNews	0	2nd December 2010 16:54
MacBook Air First To Be Compromised In Hacking Contest	jmke	WebNews	0	28th March 2008 13:58