#CCLEANER MALWARE FIX UPDATE#
#CCLEANER MALWARE FIX SOFTWARE#
#CCLEANER MALWARE FIX PC#
#CCLEANER MALWARE FIX DOWNLOAD#

#CCLEANER MALWARE FIX SOFTWARE#

With the fact that the software installer was validly signed, along with the presence of this malicious compilation artefact attached, several hypotheses have been thought about the malware and how it became part of the system.

In its analysis, Talos found the following compilation artefact in the CCleaner binary: The malicious installer was signed using a certificate issued to Piriform Ltd by Symantec, with validity date until 10/2018.

#CCLEANER MALWARE FIX DOWNLOAD#

The infected CCleaner version 5.33 was distributed through the official CCleaner download site, using a software installer that could trick most security solutions. Getting to understand the CCleaner malware incident

#CCLEANER MALWARE FIX UPDATE#

It remains a mystery if the CCleaner version update released on September 12th, 2017 was related to the necessity of removing malware or if removing the backdoor from the distribution repository happened only after the notification by Cisco on September 13th, 2017. We have confirmed that this malicious version of CCleaner was hosted directly on CCleaner’s download server as of September 11, 2017. Since then, it is now estimated that over 700,000 machines were infected and may still be receiving command & control remote tasks from the owners of what now seems to be the fastest growing botnet of 2017.įigure 3: Screenshot of CCleaner – Version Historyįew weeks later, on September 13th, 2017, Cisco’s Talos informed Avast (the antivirus company that had recently acquired Piriform) of the attack and to initiate relevant action on the matter.Īccording to Talos, “over 700,000 machines reported to the malicious software command & control server over this time period, and more than 20 machines have received the second-stage payload”.ĭuring the installation of CCleaner 5.33, the 32-bit CCleaner binary was also contained in a malicious payload that featured Domain Generation Algorithm (DGA) as well as hardcoded Command and Control (C2) functionality. More specifically, a backdoor that allows the receiving and processing of remote command & control commands.įigure 2: Screenshot of the Cisco’s notification date for AvastĪs a result, the CCleaner version released on August 15th, 2017 presented risks of infection for an unprecedented number of computers (including those that run on critical infrastructures) and enormous potential damage to software users across the world. Sadly, Cisco’s Talos Intelligence Group recently discovered that CCleaner version 5.33 contained malware attached to it. This is usually very effective as it is based on the trust created between the software developer and the end-user.Īn example of this is the worm Nyetya, that recently re-coined the term ‘ransomware’ using proof of concept network level spreading behavior.Īccording to the developers of CCleaner, more than 2 billion downloads had been registered by November 2016 and a growth rate of approximately 5 million downloads per week for its flagship product.įigure 1: CCleaner growth statistics CCleaner malware – a ‘numbers game’Īs recent events show, these look like just the numbers needed for a motivated malware developer / advanced attacker to step in and take control of the software distribution network. One way to distribute malware to different organisations is through software supply chains. Why was CCleaner used to distribute malware? For this reason, we should look at this event with humbleness and regard it as a good motivation to increase our awareness regarding the security of the software that we use.

#CCLEANER MALWARE FIX PC#

While editing this blog post, I aim to provide an as unbiased point of view as possible, considering that this website also serves a PC System Utilities software product to its audience. Update for customers asking about CCleaner malware:it seems that malicious software has been discovered as being distributed alongside CCleaner between August 15th, 2017 – September 13th, 2017.

Ccleaner malware fix