CCleaner Malware Incident

[bob3160]

Always check on your downloads with this little free tool: http://www.winmd5.com/

pol

That hash tag tool wouldn't have caught the hack. Wish it was that simple.

[polonus]

Bob3160 is right in this respect, certainly and also a bit sadly...

Know that against advanced collison state actor hacking a simple MD5 comparison won't help,
but it is a quick and dirty to perform on any download and check on VirusTotal you have the right McCoy there.

MD5 is not safe anymore, again added threats from downgraded standards provided by organizations like NSA (who would like to trust a lock given to you by a burgler?). Against targeted attacks from state hackers, the normal user has no defense. You have both arms tied to your backs all the time and the game is "rigged" from the word go by the 'Forces that Be'.

It should be a concern that the Microsoft Windows certificate store (you find it inside the registry) identifies certificates 'uniquely" on basis of their SHA1, so hash - collision can not be avoided under all circumstances. SHA1 is also unsafe, still loads of sites still have it,
https://shaaaaaaaaaaaaa.com/

Alas, we do as best we can under the prevailing situation,

polonus

[1234ava]

Additional info from Avast with an updated list of IOCs. And, maybe the malware wasn't from China after all.
https://blog.avast.com/additional-information-regarding-the-recent-ccleaner-apt-security-incident

[bob3160]

Additional info from Avast with an updated list of IOCs. And, maybe the malware wasn't from China after all.
https://blog.avast.com/additional-information-regarding-the-recent-ccleaner-apt-security-incident

The statement from avast was :
"Furthermore, given the clear lack of traffic on Saturdays and Sundays, it would indicate that it wasn’t an Arabic country."
No Tech companies in China or Russia were on the targeted list.

[1234ava]

Before that they also say:
"Given the typical working day starts at 8AM or 9AM, this leads us to the most likely location of the attacker in the time zone UTC + 4 or UTC + 5, leading us to Russia or the eastern part of Middle East / Central Asia and India."