Indicators of Compromise

The installer for CCleaner, a free cleanup utility with millions of users, was the last program anyone expected a detection tool to flag. On September 13, 2017, Cisco was trying out a new detection tool on a customer's network, and it flagged that installer. The file had come from CCleaner's own download servers and carried a valid digital signature from Piriform, the company that made it. A signature like that tells Windows the program comes from its maker and hasn't been changed since (a different thing from the malware signatures anti-malware scans for). The tool was built to catch attacks as they happen, by watching what programs do when they run.

Cisco's researchers took the installer apart. Version 5.33 of CCleaner, released in August, carried extra code that someone had slipped into the program before Piriform signed and published it. On each computer that installed it, the code collected the computer's name, its installed programs, and its running processes, and sent them to a server the attackers controlled, which could send back more code. Avast, which had just bought Piriform, later said the bad version had been installed about 2.27 million times.

Within days, Cisco and Avast published what to look for, so that anyone could check their own computers. Some of it was:

Indicators come in kinds, depending on where an investigator finds them. Read the three kinds below, then decide where A and B would be found.

The attackers' first-try sign-in to a Piriform developer's workstation, told at the end of this lesson, is the kind of trace the third kind covers.

A is file-based: an investigator hashes the installer, or the program files it left, and compares. B is host-based, a change to the system's configuration that nothing legitimate makes. C is evidence too, but it shows up mainly in network records, the firewall's or the router's, which none of the three kinds above covers. D is weaker. A version number records what was installed, and updating to 5.34 replaced it, though not the registry key. It tells an investigator where to look for A and B.

Suppose an advisory like Cisco's arrived about a program the video game studio uses. The IT lead runs the same check on every laptop: look for the file by its hash, look for the registry key, and search the firewall records for the attackers' server address. A laptop with any of them is treated as compromised, whatever its anti-malware says. It is handled the way the artist's laptop was after the cracked program: wiped, rebuilt, and its passwords changed.

Most of the 2.27 million computers got nothing back. The server kept a list of the companies it was after, and when a computer inside one of them checked in, it received a second, more capable program. Avast said 40 computers got it, at a dozen technology and telecommunications companies, most of them in Taiwan and Japan. In 2018 Avast reported how the attackers had got in: in March 2017, five months before the release, they had signed in to a Piriform developer's workstation through a remote-access program on the first try, so they already had the login, and worked their way to the server that built CCleaner. The first warnings, from the security company Morphisec on September 12 and from Cisco's tool the next day, came from watching what the program did when it ran.