Hackers hid malicious code in popular CCleaner software

Avast-owned Piriform, which makes the computer-cleaning program, says no harm was done to any users but encourages people to check which version they have.
Hackers penetrated computer-optimization software CCleaner in a way that could have let them control millions of devices, Piriform, the company that makes the program, said Monday.

A malicious program was planted inside the popular, free software, which is downloaded as often as 5 million times per week and is used to delete cookies and junk programs to make computers and Android phones run faster.

Piriform said it estimates that 2.27 million people used the infected software, but sought to calm consumers who might be inclined to panic.

"We resolved this quickly and believe no harm was done to any of our users," the company said in a statement.

It's just the latest episode in the unsettling saga of vulnerable computers. Last week a security company flagged a flaw that could let malware hit more than 5 billion Bluetooth devices, and Google purged its Play Store of millions of dangerously compromised apps. In May and June, ransomware attacks locked up computers around the world, demanding payment from people and companies in return for renewed access.

This hack shows that even software updates from trusted brands can be bad news. It's also ironic, because one of the best ways to keep your devices safe from hackers is to keep your software up to date. Usually.

The hackers were able to infiltrate the CCleaner program and insert malicious code at some point while Piriform software developers were creating the new version of the program. As a result, the code was signed by a digital certificate meant to guarantee it came from a legitimate CCleaner software developer. For regular users of CCleaner, there was no reason to distrust the software update that contained the bad code.

"It's powerful attack for sure," said Tod Beardsley, a forensic security expert at cybersecurity firm Rapid7. "If I trust whoever's giving me updates, then I trust the updates are good."

Avast, the Czech Republic-based security software maker that bought Piriform in July, uncovered the CCleaner attack on Tuesday. Two versions of the software released in August were affected, the company said.

Piriform advised people with CCleaner v5.33.6162 or CCleaner Cloud v1.07.3191 installed on their machines to delete them and download new versions as soon as possible. The software doesn't update automatically.

"We are continuing to investigate how this compromise happened, who did it, and why," Piriform said. "We are working with US law enforcement in their investigation."