Talos also showed that anti-exploit technology can be quite useful in situations where antivirus software cannot, as Malwarebytes has also said in the past.
Additionally, if updates are automatic, the damage could be much larger, as we saw with the NotPetya attack.Īutomatic updates may still be a net win for users because of how many patches to exploitable bugs could reach users faster than otherwise, but it also means that developers of software with automatic updates should take the security of their update servers that much more seriously. What we can learn from this situation is that attackers seem to be increasingly targeting developers of popular software as a way to more easily infect millions of users at once. Other factors limiting the potential impact were the fact that the malware was only bundled with the 32-bit version of the software, as well as the malware only activating on Windows accounts with administrator privileges. If they were, we may have seen orders of magnitude more users being infected. However, there are a few factors that limited the number of infections, one of which is that for users of the free version of CCleaner, updates are not automatic.
Potential ImpactĬCleaner had 130 million active users at the time of the Avast acquisition, and it continues to gain millions of users every week. The Talos team believes it may have more to do with an attacker compromising Avast’s development and signing process for the CCleaner application and recommended that this certificate be immediately revoked and untrusted going forward.
0 kommentar(er)
