Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware identified in CCleaner 5.33

blog.talosintelligence.com

Post reply on HN
Print view View original

131–140 of 229 posts

Re: Malware identified in CCleaner 5.33

#131

Post by microtonal »

cm2187 wrote: post #54
pmontra wrote: post #52

Earlier quoted context omitted.

I don't know what they're planning to do, but we could need only a few parties doing the verifications. If a build yields the wrong binary then the release is flagged and nobody gets it. Apt should check against the expected results. Many things could go wrong with this (mainly attacks on the expected results db, it should be replicated) but the idea should work.

The thing is if the threat is any machine on the publisher side being infected, then it sorts of need to be verified by the consumer of the software, a bit like compiling a checksum when you download software.

Debian packages are signed. It is hard to make software distribution completely secure. But, one could imagine creating pretty strong guarantees. Imagine that you have N completely different parties/machines (isolated, on different infrastructure, different user accounts).

- (N-1) machines build a new Debian package.

- The (N-1) results are fetched by the fourth party.

- The Nth party checks whether the build results are identical.

- The Nth party signs the result with GPG on a machine that is not connected.

- The signed package is distributed.

An attacker would need to compromise either: (1) N-1 build machines; (2) the offline machine used for signing packages; or (3) the upstream source.

I consider (3) to be the most serious thread. But in this scenario, only the distribution packagers need to inspect the source changes. In the common scenario where you download from a vendor (e.g. the Transmission or CCleaner website), every user has to inspect a binary blob.

Another possibility would be to have strong sandboxing for applications. An application could still participate in DDoS attacks, etc. But it would at least not encrypt/destroy your data.

tl;dr: reproducible builds are an extremely important development and Debian (and other distributions participating in this initiative) should be commended for their work!

Re: Malware identified in CCleaner 5.33

#132

Post by microtonal »

corv wrote: post #18
westoque wrote: post #11

Earlier quoted context omitted.

Binary analysis for each software you install might be too cumbersome for most developers. I suggest you use something like "Little Snitch" for mac which warns you when software makes inside/outside connections. It might not be the best, but it's definitely something that works to mitigate some hacks.

I like to compliment Little Snitch with XFence (formerly known as Little Flocker). You can think of it as a firewall for your filesystem and devices.

I use Little Snitch too. I had a Little Flocker license, but the rules were quite painful to maintain. Especially if you are also using the Terminal and command-line apps.

Re: Malware identified in CCleaner 5.33

#133

Post by 0xfeba »

kevin_thibedeau wrote: post #83
happy-go-lucky wrote: post #23

As a kid, the only OS I was aware of was Windows. Once, my computer was infected to the point where it was almost unusable. A more experienced friend suggested a non-free antivirus and the CCleaner. After a lot of effort, I could get my machine back to working, but it became so slow that it led me to discover Linux. Now, on a Windows 10 machine, I’ve nothing but Defender, and since the aforementioned experience I’ve…

The culprit was the non-free AV. Gone are the days of simple passive signature scanners. Now they all sink their claws deeply into the OS intercepting filesystem operations, network packets, and any other privileged activity. Performance be damned.

Free and non-free AV are liabilities at this point (for Windows). Microsoft has never had an official way to let AV hook into the system calls needed, so they all relied on hacks and shifty stuff.

Surprise, surprise, now there is more attack surface available since AV is kernel level. And so now we see attacks getting root or kernel level access via AV vulnerabilities.

Re: Malware identified in CCleaner 5.33

#134

Post by ballenf »

jmkni wrote: post #106
josefresco wrote: post #68

Earlier quoted context omitted.

CCleaner is not an Anti-Virus. It does not run in the background (at least the free version) and will not slow your PC. It helps users locate and remove temporary/cache files buried in the OS to free up disk space. It is very useful - even for pros. Defender will not do this.

Doesn't Windows 10 basically do this itself?

The latest Win 10 has a new setting that vaguely indicates it will look for and delete temporary files automatically. On my machine it was not turned on by default.

No idea how much it gets vs. leaves behind and since turning on it hasn't thrown up any obvious notifications lauding itself.

This is on a secondary machine. My primary machine isn't Windows.

Re: Malware identified in CCleaner 5.33

#135

Post by TravelTechGuy »

Question: I get my CCLeaner installers through Chocolatey, so it always installs the 64 bit version.

Obviously, this gave me quite a scare, so I downloaded and ran both MalwareBytes and Immunet - both came up negative. I checked my registry for the keys mentioned in the article, and found none of them. Can I assume I'm "safe" (well, one never is, but relatively speaking), or should I revert my system to an August image?

Re: Malware identified in CCleaner 5.33

#136

Post by criddell »

happy-go-lucky wrote: post #23

As a kid, the only OS I was aware of was Windows. Once, my computer was infected to the point where it was almost unusable. A more experienced friend suggested a non-free antivirus and the CCleaner. After a lot of effort, I could get my machine back to working, but it became so slow that it led me to discover Linux. Now, on a Windows 10 machine, I’ve nothing but Defender, and since the aforementioned experience I’ve…

Definitely test drive a couple of Linux distributions. I do so periodically and love seeing the progress.

There are really only two things keeping me on Windows.

    1. I run some Windows-only applications that don't work with Wine.
    2. A lot of Linux software often doesn't work well on a hi-dpi monitors.
Aside from that, since Windows 7 (and later versions of Vista), Windows is fine. IMHO, operating systems aren't terribly interesting these days. Everything interesting is in applications on top of the operating system. Windows, macOS, Linux? Whatever. If the application I need runs on that operating system, then I can be productive.

Re: Malware identified in CCleaner 5.33

#140

Post by jraph »

0xJRS wrote: post #70
0xabe wrote: post #58

Earlier quoted context omitted.

My experience with Ubuntu (xubuntu 16.04.x) is that you really need a modern Nvidia card to get high/native resolution. Especially for someone who wants to run 3 monitors.

I have a small underpowered desktop running in my house that only has onboard graphics and it runs Ubuntu 16.04 just fine, but its only connected to 1 monitor, not 3.

The Intel integrated graphic card of my laptop does handle 3 screens fine and I dont need to mess with drivers, everything works well out of the box. I would actually advise against NVIDIA cards unless you need powerful graphic processing or to do GPU computation.
Post reply on HN