Several months ago, I asked this list about ways of deleting and blocking ever-cookies. A
few list members suggested "CCleaner". Today, I saw an article in the CNN
Finance web site about a security breach at Piriform, the owner of "CCleaner".
I pasted the text of the article below.
I'm not asking anything here. I simply want list members who use "CCleaner"
to be aware of this new issue so they can take appropriate measures.
Bill.
=========================
The latest security breach targeted British software firm Piriform, known for its free
software CCleaner. Hackers compromised CCleaner in a sophisticated attack that affected
over 2 million computers, security researchers and Piriform confirmed Monday.
CCleaner deletes unneeded files and web browser caches to keep Windows computers free of
junk. But hackers were able to successfully place malware into a new version, released in
August. This allowed them to control infected computers.
Piriform said in a blog post its parent company Avast discovered the hack affected two
products -- CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 -- on September 12. The firm
has since updated the software.
The company said it worked with law enforcement to shut down the hacker's server
"before any known harm was done." The breach could let hackers collect computer
names, IP addresses, and lists of what software people use, but no sensitive data was
collected, it added.
Researchers from security firm Cisco Talos, which detected the hack, call it a
"supply chain attack." Attackers got into the original computer system where the
software was built, and those who downloaded would have no way of knowing their computer
was compromised.
Research indicated the hacker was collecting information, like reconnaissance, about
infected computers, according to Talos researcher Craig Williams.
In July, Avast acquired Piriform and said about 130 million people use CCleaner.
"The malware works like a loader," Williams said. "The bad guy could take
any kind of malware he wanted, like ransomware, and push that down to end users."
The strategy is similar to the major global NotPetya attack in June that targeted
Ukrainian tax software, Williams added. Hackers infected trusted software and people
downloaded it without realizing it contained malware.
Piriform advises Windows users to check if they are running compromised versions, delete
the app, and install the new safe version.
[the end]
Show replies by date