Last edited by a moderator:
- Aug 6, 2014
- 1,044
Hackers broke into British company Piriform’s free software for optimizing computer performance last month and installed tools that could have allowed them to take control of tens of millions of devices, the company and independent researchers said on Monday.
The malicious program was slipped into legitimate software called CCleaner, which is downloaded for personal computers and Android phones as often as 5 million times a week. It cleans up junk programmes and advertising cookies to speed up devices.
CCleaner is the main product made by London’s Piriform, which was bought in July by Prague-based Avast, one of the world’s largest computer security vendors. At the time of the acquisition, the company said 130 million people used CCleaner.
A version of CCleaner downloaded in August included remote administration tools that tried to connect to several unregistered web pages, presumably to download additional unauthorized programs, security researchers at Cisco’s Talos unit said.
Talos researcher Craig Williams said it was a sophisticated attack since it penetrated an established and trusted supplier in a manner similar to June’s “NotPetya” attack on companies that downloaded infected Ukrainian accounting software.
“There is nothing a user could have noticed,” Williams said, noting that the optimization software had a proper digital certificate, which means other computers automatically trust the program.
In a blog post, Piriform confirmed that two programmes released in August were compromised. It advised users of CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 to download new versions. It did not disclose how many users were affected.
Piriform said Avast, its new parent company, had uncovered the attacks on September 12. A new, uncompromised version of CCleaner was released the same day and a clean version of CCleaner Cloud was released on September 15, it said.
The nature of the attack code suggests that the hacker won access to a machine used to create CCleaner, Williams said.
CCleaner does not update automatically, so each person who has installed the problematic version will need to delete it and install a fresh version, he said.
Williams said Talos detected the issue at an early stage, when the hackers appeared to be collecting information from infected machines, rather than forcing them to install new programs.
Piriform said it had worked with U.S. law enforcement to shut down a server located in the United States to which traffic was set to be directed.
It said the server was closed down on Sept. 15 “before any known harm was done”.
A detailed analysis of the attack can be found here: Cisco's Talos Intelligence Group Blog: CCleanup: A Vast Number of Machines at Risk and Piriform - Security Notification for CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 for 32-bit Windows users
The malicious program was slipped into legitimate software called CCleaner, which is downloaded for personal computers and Android phones as often as 5 million times a week. It cleans up junk programmes and advertising cookies to speed up devices.
CCleaner is the main product made by London’s Piriform, which was bought in July by Prague-based Avast, one of the world’s largest computer security vendors. At the time of the acquisition, the company said 130 million people used CCleaner.
A version of CCleaner downloaded in August included remote administration tools that tried to connect to several unregistered web pages, presumably to download additional unauthorized programs, security researchers at Cisco’s Talos unit said.
Talos researcher Craig Williams said it was a sophisticated attack since it penetrated an established and trusted supplier in a manner similar to June’s “NotPetya” attack on companies that downloaded infected Ukrainian accounting software.
“There is nothing a user could have noticed,” Williams said, noting that the optimization software had a proper digital certificate, which means other computers automatically trust the program.
In a blog post, Piriform confirmed that two programmes released in August were compromised. It advised users of CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 to download new versions. It did not disclose how many users were affected.
Piriform said Avast, its new parent company, had uncovered the attacks on September 12. A new, uncompromised version of CCleaner was released the same day and a clean version of CCleaner Cloud was released on September 15, it said.
The nature of the attack code suggests that the hacker won access to a machine used to create CCleaner, Williams said.
CCleaner does not update automatically, so each person who has installed the problematic version will need to delete it and install a fresh version, he said.
Williams said Talos detected the issue at an early stage, when the hackers appeared to be collecting information from infected machines, rather than forcing them to install new programs.
Piriform said it had worked with U.S. law enforcement to shut down a server located in the United States to which traffic was set to be directed.
It said the server was closed down on Sept. 15 “before any known harm was done”.
A detailed analysis of the attack can be found here: Cisco's Talos Intelligence Group Blog: CCleanup: A Vast Number of Machines at Risk and Piriform - Security Notification for CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 for 32-bit Windows users
- Apr 28, 2017
- 326
I checked mine, and it was v5.24. My strategy of only updating CCleaner once a year has paid off.
Last edited by a moderator:
- May 7, 2016
- 1,307
Yes, i will still use their products.Avast is protecting.....
- May 11, 2011
- 444
- Jan 16, 2017
- 1,469
Oh man. Should I be glad that I was too lazy to update to 5.33 and stayed at 5.32? Hope 5.32 wasn't hacked
- May 7, 2016
- 1,307
Hmm.Nothing is safe nowdays.Good is that avast uncovered the attacks and timely patched.Pretty disappointing...
- Apr 28, 2015
- 271
Cisco's Talos Intelligence Group Blog: CCleanup: A Vast Number of Machines at Risk
Affected systems need to be restored to a state before August 15, 2017 or reinstalled.
Piriform says only 32-bit Windows users could be affected?
Affected systems need to be restored to a state before August 15, 2017 or reinstalled.
Piriform says only 32-bit Windows users could be affected?
- Jun 14, 2017
- 264
Nothing is safe and lost faith in ccleaner
- Mar 1, 2014
- 1,708
Nothing is safe. AVs exist also for this kind of thing. Legit programs must be checked and monitored.
Regardless, I'll still use CCleaner, the only cleaner I use.
Regardless, I'll still use CCleaner, the only cleaner I use.
- Jun 9, 2013
- 6,720
Is nothing sacred any more. But I think I will continue to use CCleaner for the time being.
But I think I will continue to use CCleaner for the time being. 
- Nov 19, 2014
- 2,350
And their program is removed forever. Piriform is terrible and this is honestly the worse offend they could have done. I don't use 32 bit luckily but they SUCK.
EDIT: SIGNED WITH THEIR CERTIFICATE. HOW SAD AND PATHETIC. PS the hackers are worse. They could have signed actual malware.
EDIT: SIGNED WITH THEIR CERTIFICATE. HOW SAD AND PATHETIC. PS the hackers are worse. They could have signed actual malware.
Last edited:
I'm using v5.34.6207 64-bit so I'm safe
- Apr 1, 2017
- 1,782
Fortunately, I don't use Ccleaner or other software from Piriform
- Jul 16, 2014
- 215
From v.5.33 I have updated My CCleaner on September 12 to v.5.34 , and I'm 32 bit. ...................... Sooo Sh**
What Now ? ( Only Reinstaling ??? )
What Now ? ( Only Reinstaling ??? )
- Sep 22, 2014
- 1,767
Does anybody have that infected version to shear or does somebody have VT link score with this problematic version?
- Jul 16, 2014
- 215
I Have It !!!
How / Where you want me to send it ???
- Sep 22, 2014
- 1,767
- Dec 12, 2012
- 173
- Jun 14, 2017
- 264
Restore your systemFrom v.5.33 I have updated My CCleaner on September 12 to v.5.34 , and I'm 32 bit. ...................... Sooo Sh**
What Now ? ( Only Reinstaling ??? )
CCleaner app offered for download between August 15 and September 12 was modified to include the Floxif malware, according to a report published by Cisco Talos
