CCleaner Compromised by Hackers - Update Immediately

Users of the popular CCleaner optimization software have been urged to immediately update the program. The software was recently compromised by hackers for almost a month, though it does not yet appear they did any damage.

The warning to update is particularly important because CCleaner doesn't automatically update - though it does tell users when a new version is ready. The compromised versions were the 32-bit editions of CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191. User who currently have these versions should uninstall them immediately, then get the latest copy from the website of manufacturers Piriform. If you own an older version of CCleaner, it is not affected.

Software Compromised At Source?

It's reported that hackers gained access to one of the computers used to compile CCleaner (from programming code to Windows executable), rather than hacking the site used to distribute the software. That meant compromised versions appeared genuine and didn't trigger security alerts such as those in Windows that aim to catch bogus software before it can run.

Piriform says the compromised editions were released on August 15 and August 24 and an estimated 2.27 million people used these editions. It discovered the problem on September 12 and released a new version of CCleaner the same day, plus a new version of CCleaner Cloud three days later. (Source: piriform.com)

According to Piriform, the rogue version of the software had the ability to send the following details about the user's computer to a third party:

• Network name
• IP address
• List of installed software
• List of software that was actively running
• List of network adapters

No Sign Of Malware Attack

Security researchers at Cisco say the modifications to the rogue editions included the ability to download and install further software, but there's no evidence this was used. Piriform's parent company Avast (makers of Avast! antivirus) say it scanned computers that had both Avast security software and CCleaner and found no sign of malware. (Source: forbes.com)

The most likely explanation was that the hackers wanted to use the data gathered from computers to put together a targeted list to do maximum damage with malware, but were cut off before they could proceed to the next stage of the attack.

What's Your Opinion?

Do you use CCleaner? Has this incident damaged your trust in the company? Are you happy it has done enough to both tackle the threat and keep users informed?