How did the attackers use ccleaner in order to plant their malware?

Question

I recently read about the ccleaner attacks and without knowing anything about viruses/malware I'd like to know how the attackers managed to plant their malware.

Can somebody, with simple words explain how can somebody plant a malware in popular software like ccleaner without the company that produces it noticing?

Answer 1

As @schroeder said, Piriform/Avast haven't yet released details on how the software was backdoored. That said, we can still figure out how it might have occurred with a high level of certainty (that is to say, some guesswork and logic).

According to Avast's reports, they believe that the attacker behind the threat were highly advanced - that is - an Advanced Persistent Threat or APT. This sort of actor doesn't rely solely on publicly disclosed vulnerabilities but also have access to other sources for exploits - zero day exploits or even physical access.

Until Avast discloses just how the attack on their systems took place, the following are possible attack vectors through which they might've been compromised:

• Exploitation of zero days on their infrastructure
• Social engineering attacks on their developers - to get them to execute/backdoor their own code unknowingly.

In the light of their blog post that claims that the attack was an APT, I'm leaving out other possible vectors such as 'It was an inside job' - the target seems to have been much larger and it's unlikely to have been as small as this might otherwise imply.

---

So far, we've only looked at how someone might've broken into the production servers. But how about actually backdooring the code?

Well, once you've got access to a system, that part is definitely much easier. They could've smuggled in their backdoor through larger commits in internal systems (guessing here) where they'd have likely gone unnoticed once a developer signed off on the code, or they could have patched the binaries themselves on the update server after stealing the signing certificate (which seems more likely). Detecting these threats before they can do real damage is more difficult than it looks though.

I'll update this answer with more details as they come in, but for now, that's all we get as outsiders.