Avast fights off cyber-espionage attempt, Abiss

[Gandalf_The_Grey]

Content source

https://blog.avast.com/ccleaner-fights-off-cyberespionage-attempt-abiss

Another attack on CCleaner and the reason for the latest update.

Avast deploys hardened self-defense and wider intelligence industry collaboration

Global software companies are increasingly being targeted for disruptive attacks, cyber-espionage and even nation-state level sabotage, as evidenced by the many reports of data breaches and supply chain attacks over the last few years. At Avast, we constantly work hard to stay ahead of the bad guys and to fight off attacks on our users. It is therefore not so surprising that we ourselves could be a target.
On September 23, we identified suspicious behavior on our network and instigated an immediate, extensive investigation. This included collaborating with the Czech intelligence agency, Security Information Service (BIS), the local Czech police force cybersecurity division, and an external forensics team to provide additional tooling to assist our efforts and verify the evidence that we were collecting.

Read more here:

Avast fights off cyber-espionage attempt, Abiss

Avast deploys hardened self-defense and wider intelligence industry collaboration to fight off cyber-espionage attempt, Abiss

blog.avast.com

Latest changelog of CCleaner here:

Version History

www.ccleaner.com

v5.63.7540 (15 Oct 2019)
General
- This release contains an important security update and some minor bug fixes and UI updates

You can read more here: CCleaner v5.63.7540

 

[Gandalf_The_Grey]

Also on ZDNet:

Avast says hackers breached internal network through compromised VPN profile
Czech antivirus maker discloses second attack aimed at compromising CCleaner releases.

Avast says hackers breached internal network through compromised VPN profile

Czech antivirus maker discloses second attack aimed at compromising CCleaner releases.

www.zdnet.com

 

[Pat MacKnife]

I will never use avast again since i was a victim on a hack on their forum back in 2014.... still receive phishingmails on my mail account (haveibeenpwned https://haveibeenpwned.com/) their AV acts like spyware itself !

 

[blackice]

The truth is all the vendors and Microsoft have a target on their backs and big kudos from fellow hackers if compromised. Pretty much every AV is hacked at one point or another. There was already the big one a few months ago where three major endpoint vendors were hacked. Hopefully these companies get a little more serious about network security. It’s cumbersome to implement on a large scale, and management doesn’t like how it slows things down, but it is clearly necessary.

 

[CyberTech]

Hackers accessed the internal network of Czech cybersecurity company Avast, likely aiming for a supply chain attack targeting CCleaner. Detected on September 25, intrusion attempts started since May 14.

Following an investigation, the antivirus maker determined that the attacker was able to gain access using compromised credentials via a temporary VPN account.


Tiptoeing to higher privileges:

From the information collected this far, the attack appears to be "an extremely sophisticated attempt," says Jaya Baloo, Avast Chief Information Security Officer (CISO).

Avast refers to this attempt by the name 'Abiss' and says that the threat actor behind it exercised extreme caution to avoid being detected and hide the traces of their intention.

Logs of the suspicious activity show entries on May 14 and 15, on July 24, on September 11, and on October 4.

The intruder connected from a public IP address in the U.K. and took advantage of a temporary VPN profile that should no longer have been active and was not protected with two-factor authentication (2FA).

In a statement today, Jaya Baloo says that the company received an alert for "a malicious replication of directory services from an internal IP that belonged to our VPN address range;" this had been dismissed as a false positive, though.

However, it turned out that the user whose credentials had been compromised did not have the permissions of a domain administrator, indicating that the attacker achieved privilege escalation.

The logs further showed that the temporary profile had been used by multiple sets of user credentials, leading us to believe that they were subject to credential theft.

More information: Hackers Breach Avast Antivirus Network Through Insecure VPN Profile