⚠️CCleaner Malware Fiasco (UPDATED)

[Cassidy]

WARNING

If any of you use CCleaner and have updated one month ago, update it now. Previous version 5.33 (ccsetup533.exe) had a trojan allowing backdoor access (Trojan.Floxif). Updating to the latest update version should remove it.

This infection was only present in the 32-bit binary, but if you do not know which one you have, update it anyway.

UPDATE: Users with 64-bit version have detected malware on their versions as well. ALL CCleaner users please update for security.

News sources:

http://www.tomshardware.com/news/avast-unknowingly-bundled-malware-ccleaner,35477.html

https://www.bleepingcomputer.com/news/security/ccleaner-compromised-to-distribute-malware-for-almost-a-month/

http://searchenterprisedesktop.techtarget.com/blog/Windows-Enterprise-Desktop/CCleaner-533-32-bit-Carries-Malicious-Payload

WARNING 2

CCleaner's 2nd payload of malware has been found.

The Trojan.Floxif left other backdoors open. Check your systems for these binary files:

 GeeSetup_x86.dll
 EFACli64.dll
 TSMSISrv.dll
 DLL in registry: f0d1f88c59a005312faad902528d60acbf9cd5a7b36093db8ca811f763e1292a

Początkowo opublikowane przez thehackernews.com:

However, during the analysis of the hackers' command-and-control (C2) server to which the malicious CCleaner versions connected, security researchers from Cisco's Talos Group found evidence of a second payload (GeeSetup_x86.dll, a lightweight backdoor module) that was delivered to a specific list of computers based on local domain names.

[...]

Just removing the Avast's software application from the infected machines would not be enough to get rid of the CCleaner second stage malware payload from their network, with the attackers' still-active C2 server.
So, affected companies that have had their computers infected with the malicious version of CCleaner are strongly recommended to fully restore their systems from backup versions before the installation of the tainted security program.

Początkowo opublikowane przez blog.talosintelligence.com:

Stage 2 Payloads

The stage 2 installer is GeeSetup_x86.dll. This installer checks the OS version and then drops either a 32-bit or 64-bit version of a trojanized tool. The x86 version is using a trojanized TSMSISrv.dll, which drops VirtCDRDrv (which matches the filename of a legitimate executable that is part of Corel) using a similar method to the backdoored CCleaner tool. The x64 version drops a trojanized EFACli64.dll file named SymEFA which is the filename taken from a legitimate executable that is part of "Symantec Endpoint". None of the files that are dropped are signed or legitimate.

Effectively, they patch a legitimate binary to package their malware. Additionally, the setup put an encoded PE in the registry :

HKLM\Software\Microsoft\Windows NT\CurrentVersion\WbemPerf\001
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WbemPerf\002
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WbemPerf\003
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WbemPerf\004

The purpose of the trojanized binary is to decode and execute this PE in registry. This PE performs queries to additional C2 servers and executes in-memory PE files. This may complicate detection on some systems since the executable files are never stored directly on the file system.

Within the registry is a lightweight backdoor module which is run by the trojanized files. This backdoor retrieves an IP from data stegged into a github.com or wordpress.com search, from which an additional PE module is downloaded and run.

[...]

Below are indicators of compromise associated with this attack.

Installer on the CC: dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83 (GeeSetup_x86.dll)

64-bit trojanized binary: 128aca58be325174f0220bd7ca6030e4e206b4378796e82da460055733bb6f4f (EFACli64.dll)

32-bit trojanized binary: 07fb252d2e853a9b1b32f30ede411f2efbb9f01e4a7782db5eacf3f55cf34902 (TSMSISrv.dll)

DLL in registry: f0d1f88c59a005312faad902528d60acbf9cd5a7b36093db8ca811f763e1292a

News sources:

http://thehackernews.com/2017/09/ccleaner-malware-hacking.html
http://blog.talosintelligence.com/2017/09/ccleaner-c2-concern.html

Stay safe, my friends.

These are dark times when we can't even trust programs like CCleaner anymore.

Steam Inventory Helper (extension) reportedly spies on users

News sources:

http://windowsreport.com/steam-spyware/

https://www.reddit.com/r/GlobalOffensive/comments/70xofs/warning_trusted_steam_inventory_helper_now/

[Gen X]

Początkowo opublikowane przez Azza ☠:

Początkowo opublikowane przez Generation X:

Maybe I can agree with u on this, but id rather have russian spy onme then a american lol, maybe norton spys on ppl? THey says NSA created bit coin and all that crap. Look up 2008 white paper on cryptocurrency that can go back to 3 nsa employees from 1996 theorized.... Japanese guys name translates to central intelligence. NExt question is why would they create this? Simple answer if you have the intelligence...

I'm a security expert (it's my job) and even I use Kaspersky (traced it's packets) and there was zero proof or concern.

Kaspersky has a Cloud Network Protection, which you need to 'enable' (disabled by default). That calls it's home server, checking your files, allowing zero day protection of new virus threats. That's the only security/privacy concern. It's a joke that US Government bans Kaspersky for that. When Microsoft themselves has their own cloud network enabled by default (and you have to go via 10 pages of privacy settings to disable it in Win 10).

Talk about bias.

I dont use any cloud ♥♥♥♥, I dont mind Dr Web. But i turn off all other stuff MS, everything, google

[Azza ☠]

Początkowo opublikowane przez Generation X:

Początkowo opublikowane przez Azza ☠:

I'm a security expert (it's my job) and even I use Kaspersky (traced it's packets) and there was zero proof or concern.

Kaspersky has a Cloud Network Protection, which you need to 'enable' (disabled by default). That calls it's home server, checking your files, allowing zero day protection of new virus threats. That's the only security/privacy concern. It's a joke that US Government bans Kaspersky for that. When Microsoft themselves has their own cloud network enabled by default (and you have to go via 10 pages of privacy settings to disable it in Win 10).

Talk about bias.

I dont use any cloud ♥♥♥♥, I dont mind Dr Web. But i turn off all other stuff MS, everything, google

I just find it extremely amusing...

I have to go: Settings > Additional > Additional protection tools settings

Enable "Kaspersky Security Network"

(where there's a big block of text telling you what it is and what it does, plus links to a privacy page and learn more about cloud protection page)

Even claims - "Kaspersky Security Network does not collect or process user's personal data."

Click "Enable" button will popup with another confirm box, with a "Kaspersky Security Network Statement". This clearly tells you about every single piece of information they will be collecting from your PC and the reasons why. Stuff such as file names, sizes, paths, checksums (MD5, SHA2-256, SHA1), vendors, signatures, and files integrity, etc.

Then you have to "Agree" to that. Only after I do all that, do I notice data packets going off to their home base.

It's like the most clearest possible privacy warning I've ever seen. Then you compare that to US morals and privacy.... Blahahhaaa you gotta be joking. Yeah, lets ban Kaspersky, they are the real threat of privacy.

ps: Kaspersky has a vulnerability scanner which checks other apps/plugins/etc, which detected CCleaner's 5.33 issue and provided the solution too:
https://threats.kaspersky.com/en/vulnerability/KLA11105/

[Volfogg]

Uh-oh...

Well, I hope I had 64-bit version running, because it was 5.33.

What a BonziBuddy of cleaning software...

[DMN]

Początkowo opublikowane przez OCDavid:

Uh-oh...

Well, I hope I had 64-bit version running, because it was 5.33.

What a BonziBuddy of cleaning software...

oh this infection only present on the 32 bit version.
XD

i did not read that, i saw the ver. compare it with mine, and i rush to update it.

i was using CCleaner 64 bit, no wonder Eset did not pick anything up.

[Gen X]

Początkowo opublikowane przez Azza ☠:

Początkowo opublikowane przez Generation X:

I dont use any cloud ♥♥♥♥, I dont mind Dr Web. But i turn off all other stuff MS, everything, google

I just find it extremely amusing...

I have to go: Settings > Additional > Additional protection tools settings

Enable "Kaspersky Security Network"

(where there's a big block of text telling you what it is and what it does, plus links to a privacy page and learn more about cloud protection page)

Even claims - "Kaspersky Security Network does not collect or process user's personal data."

Click "Enable" button will popup with another confirm box, with a "Kaspersky Security Network Statement". This clearly tells you about every single piece of information they will be collecting from your PC and the reasons why. Stuff such as file names, sizes, paths, checksums (MD5, SHA2-256, SHA1), vendors, signatures, and files integrity, etc.

Then you have to "Agree" to that. Only after I do all that, do I notice data packets going off to their home base.

It's like the most clearest possible privacy warning I've ever seen. Then you compare that to US morals and privacy.... Blahahhaaa you gotta be joking. Yeah, lets ban Kaspersky, they are the real threat of privacy.

ps: Kaspersky has a vulnerability scanner which checks other apps/plugins/etc, which detected CCleaner's 5.33 issue and provided the solution too:
https://threats.kaspersky.com/en/vulnerability/KLA11105/

I dont use kasp anyways

[wookiecharmander]

No advertising allowed

[Gen X]

Początkowo opublikowane przez Penguin Thing:

No advertising allowed

WHo is advertising?
No backseat modding especially if your clueless

[Captain Pentium]

Początkowo opublikowane przez Penguin Thing:

No advertising allowed

No, no, no. Wrong use here.

[DMN]

Początkowo opublikowane przez Anna Kist:

But... I trusted you, CCleaner! :-(

Oh well, I had the 64-bit version installed, so my computer should be STD-free.

same, i was panicking for nothing. XDDD

i didn't realize it was only for 32 bit version XD

[Azza ☠]

Początkowo opublikowane przez 888 SIH is malware now:

Początkowo opublikowane przez Anna Kist:

But... I trusted you, CCleaner! :-(

Oh well, I had the 64-bit version installed, so my computer should be STD-free.

same, i was panicking for nothing. XDDD

i didn't realize it was only for 32 bit version XD

It's probably actually how they bypassed the check.

A malicous middle man just fudged the 32-bit version, then added a 600 second delay to it's execution too, as well as having speccy.piriform (IP: 216.126.225.148) as a faked trusted host under the SSL certificate.

The checks: 32-bit only > 600 second delay (10 minutes) > User must be admin

That would affect only a very small percentage. Any lazy testing on security however, it would go unnoticed.

ps: The traced malicious host (now secured) was a server is the USA. I'm gonna assume it was the malcious NSA and ban them from my dumbass government, haha.

[DMN]

Początkowo opublikowane przez Azza ☠:

Początkowo opublikowane przez 888 SIH is malware now:

same, i was panicking for nothing. XDDD

i didn't realize it was only for 32 bit version XD

It's probably actually how they bypassed the check.

A malicous middle man just fudged the 32-bit version, then added a 600 second delay to it's execution too, as well as having speccy.piriform (IP: 216.126.225.148) as a faked trusted host under the SSL certificate.

The checks: 32-bit only > 600 second delay > User must be admin

That would affect only a very small percentage.

ps: The traced malicious host (now secured) was a server is the USA. I'm gonna assume it was the malcious NSA and ban them from my dumbass government, haha.

hmm... or it was an inside job went wrong.
cos kinda weird only 32bit got infected.

[Azza ☠]

Początkowo opublikowane przez 888 SIH is malware now:

Początkowo opublikowane przez Azza ☠:

It's probably actually how they bypassed the check.

A malicous middle man just fudged the 32-bit version, then added a 600 second delay to it's execution too, as well as having speccy.piriform (IP: 216.126.225.148) as a faked trusted host under the SSL certificate.

The checks: 32-bit only > 600 second delay > User must be admin

That would affect only a very small percentage.

ps: The traced malicious host (now secured) was a server is the USA. I'm gonna assume it was the malcious NSA and ban them from my dumbass government, haha.

hmm... or it was an inside job went wrong.
cos kinda weird only 32bit got infected.

Like I was saying... it's not wierd, rather a smart way of trying to hide it's detecting during the security checks before distributing.

It's nothing new either. A trusted companies software can be infected by it's software distributors. It's normally a malicious employee of the distributor involved, just near the final stages of public release. In this case, it appears to of been bypassed by an Avast distributor (the backdoor was signed off by their own SSL certificate).

A company like themselves would have little to no reason. Unless they don't wish to be a company for long. Why bite the hand that feeds you?

[DMN]

Początkowo opublikowane przez Azza ☠:

Początkowo opublikowane przez 888 SIH is malware now:

hmm... or it was an inside job went wrong.
cos kinda weird only 32bit got infected.

Like I was saying... it's not wierd, rather a smart way of trying to hide it's detecting during the security checks before distributing.

It's nothing new either. A trusted companies software can be infected by it's software distributors. It's normally a malicious employee of the distributor involved, just near the final stages of public release.

A company like themselves would have little to no reason. Unless they don't wish to be a company for long. Why bite the hand that feeds you?

yeah, that's what i mean, without a malicious employee, how can the files get infected from official download link.

[Azza ☠]

Początkowo opublikowane przez 888 SIH is malware now:

Początkowo opublikowane przez Azza ☠:

Like I was saying... it's not wierd, rather a smart way of trying to hide it's detecting during the security checks before distributing.

It's nothing new either. A trusted companies software can be infected by it's software distributors. It's normally a malicious employee of the distributor involved, just near the final stages of public release.

A company like themselves would have little to no reason. Unless they don't wish to be a company for long. Why bite the hand that feeds you?

yeah, that's what i mean, without a malicious employee, how can the files get infected from official download link.

Back not so long ago, it was Chinese programmers affected... They actually used an illegal priated version of development software, infecting their own apps on the Apple Store. The software developers themselves where compromised (giving the hacker full access to compilation tools and signing off certificates, applying software update, etc). Slaps forehead.

The employee wasn't himself malicious, but rather due to questionable downloads he had done for the tools he uses regularly. That was pretty popular software too, RIP. Saved $1000 off software development tools, lost $280,000 or more due to it.

[DMN]

Początkowo opublikowane przez Azza ☠:

Początkowo opublikowane przez 888 SIH is malware now:

yeah, that's what i mean, without a malicious employee, how can the files get infected from official download link.

Back not so long ago, it was Chinese programmers affected... They actually used an illegal priated version of development software, infecting their own apps on the Apple Store. The software developers themselves where compromised (giving the hacker full access to compilation tools and signing off certificates, applying software update, etc). Slaps forehead.

The employee wasn't himself malicious, but rather due to questionable downloads he had done for the tools he uses regularly. That was pretty popular software too, RIP.

never used iphone, but yeah RIP.

a lost trust is harder to regain.