#Ccleaner vs ccleaner cloud update#
#Ccleaner vs ccleaner cloud software#
#Ccleaner vs ccleaner cloud code#

They didn’t say it, but it’s likely that they’ve used a new digital certificate to sign these latest versions.Īs Cisco researchers noted: “The presence of a valid digital signature on the malicious CCleaner binary may be indicative of a larger issue that resulted in portions of the development or signing process being compromised.

#Ccleaner vs ccleaner cloud update#

In the meantime, they have already made download sites remove CCleaner v, they pushed out a notification to update CCleaner users from v to v5.34, and automatically updated CCleaner Cloud users from v to. Piriform and Avast continue the investigation in order to find out how this compromise happened, who did it, and the hackers’ ultimate goal. Working with US law enforcement, we caused this server to be shut down on the 15th of September before any known harm was done,” the company stated.

“We have no indications that any other data has been sent to the server. The backdoor also collected information about the target systems (name of computer, its IP address, list of installed software, list of running processes, etc.) and sent it, encrypted, to a remote server located in the USA.

#Ccleaner vs ccleaner cloud code#

Paul Yung, VP of Products at Piriform, explained that it was “a two-stage backdoor capable of running code received from a remote IP address on affected systems.” The flagged executable was signed with a valid digital certificate issued to Piriform, but came with an additional payload. The discoveryĪn instance of a backdoored CCleaner version has been first flagged by Cisco, while customer beta testing their new exploit detection technology. “If even a small fraction of those systems were compromised an attacker could use them for any number of malicious purposes,” Cisco researchers noted. Piriform boasts of over 5 million weekly CCleaner desktop installs.

#Ccleaner vs ccleaner cloud software#

A press release from November 2016 puts the number of CCleaner downloads at 2 billion, but that includes all versions of the software (PC, Mac and Android, free and paid). They estimate that up to 3% of their users used the two compromised versions of the software, but did not mention actual numbers. CCleaner Cloud v was released on the 24th of August, and updated with a version without compromised code on September 15,” the company stated. “Piriform CCleaner v was released on the 15th of August, and a regularly scheduled update to CCleaner, without compromised code, was released on the 12th of September. Piriform – the company that develops CCleaner and which has been recently acquired by AV maker Avast – has confirmed that the 32-bit version of the v of CCleaner and the v of CCleaner Cloud were affected. It is still unknown how the compromise happened. Legitimately signed but backdoored versions of the popular CCleaner utility were available for download from the developer’s Web site and servers for nearly a month, Cisco Talos researchers have discovered.