{"id":155,"date":"2017-09-19T08:34:01","date_gmt":"2017-09-19T06:34:01","guid":{"rendered":"https:\/\/www.cyril-bras.fr\/?p=155"},"modified":"2017-09-19T08:38:55","modified_gmt":"2017-09-19T06:38:55","slug":"ccleaner-compromis-par-un-logiciel-malveillant","status":"publish","type":"post","link":"https:\/\/www.cyril-bras.fr\/?p=155","title":{"rendered":"CCleaner compromis par un logiciel malveillant"},"content":{"rendered":"<p><img loading=\"lazy\" class=\"size-full wp-image-156 alignleft\" src=\"https:\/\/www.cyril-bras.fr\/wp-content\/uploads\/2017\/09\/ccleanerThumb.jpg\" alt=\"\" width=\"140\" height=\"105\" \/>L&rsquo;utilitaire de nettoyage CCleaner a \u00e9t\u00e9 compromis dans la version distribu\u00e9e \u00e0 partir du mois d&rsquo;ao\u00fbt 2017. Il embarque alors du code malveillant ouvrant une porte d\u00e9rob\u00e9e dans le syst\u00e8me infect\u00e9 ; ce qui repr\u00e9sente environ 2 millions d&rsquo;utilisateurs \u00e0 travers le monde !<\/p>\n<p>Il est important, si l&rsquo;on souhaite continuer \u00e0 l&rsquo;utiliser, de le mettre \u00e0 jour. Nous avons l\u00e0 une d\u00e9monstration de la confiance relative \u00e0 placer dans les logiciels \u00ab\u00a0gratuits\u00a0\u00bb qui proposent de r\u00e9parer les syst\u00e8mes d&rsquo;exploitation.<\/p>\n<blockquote><p>Afin de d\u00e9terminer si une machine est infect\u00e9e, il convient de v\u00e9rifier les \u00e9l\u00e9ments suivants\u00a0:<br \/>\nSi une version affect\u00e9e (cf. section Syst\u00e8mes affect\u00e9s) est install\u00e9e sur la machine, la pr\u00e9sence de la cl\u00e9 de registre Windows HKLM\\SOFTWARE\\Piriform peut \u00eatre v\u00e9rifi\u00e9e sur le syst\u00e8me.<br \/>\nEn cas de compromission la machine aura communiqu\u00e9 vers l&rsquo;adresse ip 216.126.225.148_BAD_ ou vers l&rsquo;un des domaines suivants\u00a0:<\/p>\n<ul>\n<li>ab6d54340c1a[.]com._BAD_<\/li>\n<li>aba9a949bc1d[.]com._BAD_<\/li>\n<li>ab2da3d400c20[.]com._BAD_<\/li>\n<li>ab3520430c23[.]com._BAD_<\/li>\n<li>ab1c403220c27[.]com._BAD_<\/li>\n<li>ab1abad1d0c2a[.]com._BAD_<\/li>\n<li>ab8cee60c2d[.]com._BAD_<\/li>\n<li>ab1145b758c30[.]com._BAD_<\/li>\n<li>ab890e964c34[.]com._BAD_<\/li>\n<li>ab3d685a0c37[.]com._BAD_<\/li>\n<li>ab70a139cc3a[.]com._BAD_<\/li>\n<\/ul>\n<p>Si tel est le cas, la machine doit \u00eatre consid\u00e9r\u00e9e comme potentiellement compromise et restaur\u00e9e \u00e0 un \u00e9tat ant\u00e9rieur au 15 ao\u00fbt 2017, ou de pr\u00e9f\u00e9rence compl\u00e8tement r\u00e9-imag\u00e9e.<\/p><\/blockquote>\n<p>R\u00e9f\u00e9rences :<\/p>\n<ul>\n<li><a href=\"http:\/\/www.cert.ssi.gouv.fr\/site\/CERTFR-2017-ALE-013\/CERTFR-2017-ALE-013.html\">CERTFR-2017-ALE-013 : Pr\u00e9sence de code malveillant dans Piriform CCleaner (18 septembre 2017<\/a>)<\/li>\n<li><a href=\"http:\/\/www.lemondeinformatique.fr\/actualites\/lire-un-malware-cache-dans-ccleaner-69405.html\">Un malware cach\u00e9 dans CCleaner<\/a><\/li>\n<li><a href=\"http:\/\/www.zdnet.fr\/actualites\/ccleaner-l-utilitaire-devrait-balayer-devant-sa-porte-39857442.htm#xtor=RSS-1\">CCleaner : l\u2019utilitaire devrait balayer devant sa porte<\/a><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>L&rsquo;utilitaire de nettoyage CCleaner a \u00e9t\u00e9 compromis dans la version distribu\u00e9e \u00e0 partir du mois d&rsquo;ao\u00fbt 2017. Il embarque alors du code malveillant ouvrant une porte d\u00e9rob\u00e9e dans le syst\u00e8me&hellip; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[10],"tags":[31,14,15,12,24],"_links":{"self":[{"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/posts\/155"}],"collection":[{"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=155"}],"version-history":[{"count":2,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/posts\/155\/revisions"}],"predecessor-version":[{"id":158,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/posts\/155\/revisions\/158"}],"wp:attachment":[{"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=155"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=155"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=155"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}