Malware identified in CCleaner 5.33

Re:Malware identified in CCleaner 5.33 by giancarlostoro on Monday September 18, 2017 @07:14AM (#15274843)

According to: https://news.ycombinator.com/item?id=15274517

This blog post from Piriform has more details: http://www.piriform.com/news/release-announcements/2017/9/18...

Basically they believe it was only the 32-bit installer that was compromised.

[ Parent | on HN ]

Re:Malware identified in CCleaner 5.33 by r1ch on Monday September 18, 2017 @10:59AM (#15276496)

I wish there was more technical information, even the advisory is unclear here.

The CCleaner installer is always 32 bit for compatibility - it installs both 32 bit and 64 bit program binaries. On 64 bit systems, the default shortcuts are to the 64 bit binary.

So was the 32 bit installer compromised, or only the 32 bit binary? The original advisory makes references to the installer which is quite confusing. Tried to figure it out myself but I assume the loader has VM detection techniques as I wasn't able to infect a VM.

[ Parent | on HN ]