CCleaner hacked with malware: What you need to know

It seems that CCleaner, one of PCWorld’s recommendations for the best free software for new PCs, might not have been keeping your PC so clean after all. In an in-depth probe of the popular optimization and scrubbing software, Cisco Talos has discovered a malicious bit of code injected by hackers that could have affected more than 2 million users who downloaded the most recent update.

On Sept. 13, Cisco Talos found that the official download of the free versions of CCleaner 5.33 and CCleaner Cloud 1.07.3191 also contained “a malicious payload that featured a Domain Generation Algorithm as well as hardcoded Command and Control functionality.” What that means is that a hacker infiltrated Avast Piriform’s official build somewhere in the development process build to plant malware designed to steal users’ data.

Cisco Talon suspects that the attacker “compromised a portion of (CCleaner’s) development or build environment and leveraged that access to insert malware into the CCleaner build that was released and hosted by the organization.” As such, customers’ personal information was not at risk.

According to Avast, the malware doesn’t seem to have affected any machines in the wild. In a blog post by vice president of products Paul Yung, he states that the company identified the attack on Sept. 12 and had taken the appropriate action even before Cisco Talos notified them of their discovery. Yung says the attack was limited to CCleaner and CCleaner Cloud on 32-bit Windows systems—fortunately, most modern PCs will likely be running the 64-bit version. 

Yung assures customers that the threat has been resolved and the “rogue server” has been taken down. He also says Piriform has shut down the hackers’ access to other servers. Additionally, the company is moving all users to the latest version of the software, which is already available on the company’s website (though the release notes only mention “minor big fixes.”)

Most reassuringly, Yung states that Avast was seemingly able to disarm the threat before it was able to do any harm. The intent of the attack is unclear at this time, though Avast says the code was able to collect information about the local system.

Users can download CCleaner 5.34 from Avast’s website if they haven’t already done so. Previous releases are also still available on the company’s website, but the infected version has been removed from the company’s servers. You’ll also want to perform an antivirus scan on your computer. If you're affected, Cisco Talos recommends using a backup to restore your PC to a state prior to August 15, 2017, which is when the hacked version was released.

The impact on you at home: While users within the target area shouldn’t see any impact from this attempted attack, it’s still a scary notion. While Avast got in front of the issue and resolved it without incident, smaller companies might not be able to react so quickly. For example, earlier this year, it was found that a breach at Ukranian software company MeDoc was responsible for the NotPetya ransomware. Ransomware is becoming a troubling trend, and if hackers are able to infect infect update servers they can spread malware to as many machines as possible.

/ How to Unsubscribe From Unwanted Email

Chances are, your email inbox is a mix of important messages, Amazon Prime shipping notices, bill alerts, and other easy-to-ignore offers.

But spam creeps in. Sometimes you do it yourself—enter your email address to win that contest!—and sometimes others do it for you. Thanks for the blank­of-the-month club email list, mom.

Luckily, there are easy ways to kill unwanted emails, and they don't involved sending invective-filled rants to the sender.

---

Unsubscribe Links Made Easy

The cleanest way to get off a list is to use the built-in unsubscribe option. That link is generally buried at the bottom of the message, in tiny type or made to not even look like a link, all the better to keep you subscribed.

(The chance that the unsubscribe link is a trick—a way to confirm you are a real person—is low. Be smart about it; if something looks fishy, just delete.)

Gmail makes it easy to unsubscribe on the desktop. Whenever it notices a working unsubscribe link in a message, it puts its own unsubscribe link at the top of the message, right next to the address of the sender's email. Click it and a giant Unsubscribe button appears.

It's a little harder on mobile. In the Gmail for iOS, the only option at this point is to mark a message as spam; tap the three dots on the top right > Report spam. On Android, touch the menu; if the sender offers an easy unsubscribe option, the word Unsubscribe will appear on the menu.

Prominent unsubscribe links are also found on Outlook.com and the Outlook apps as well. On the web, it says "Getting too much email? Unsubscribe" at the top of a supported message.

On the built-in iOS Mail app, look for a banner reading "This message is from a mailing list. Unsubscribe" atop your messages, which will email the sender with the unsub request.

Email (aka Edison Mail) for iOS and Android both show a large Unsubscribe button at the top of a message and an animation to indicate the request is placed.

What's interesting is, looking at the same messages with Gmail on the desktop and mobile, Email, and other apps with a more prominent unsub option shows that they don't all recognize the links the same way, nor even support it within the same messages.

At least when you're on the mobile apps like Email, which supports multiple services (usually Gmail, Outlook, iCloud, Yahoo, and IMAP accounts), you can unsubscribe across all the services.

---

Unsubscribe Services

Want to unsubscribe from mail in a big batch? Several services make it possible. The downside: you have to give these services complete access to your inbox for them to find messages with an unsubscribe option; sometimes that includes your contacts. Like Heinlein said: TANSTAAFL.

Unsubscriber

This is as simple as it gets. Put your email address in at GetUnsubscriber.com and the service sticks an Unsubscriber folder/label in your inbox. Drag messages you no longer want into that folder, and Unsubscriber will filter messages out until the unsub request goes through. It works with any email provider, though the site includes quick links for Gmail, Outlook.com, Yahoo Mail, and Aol.

It's free to use, but the service states up front "we collect and share certain information about non-personal email messages (e.g., commercial emails)." The company behind Unsubscriber, Return Path, also offers an extension for Google Chrome called Whisker, which manages unwanted email (including spam).

Unroll.me

Available on the web, or via an iOS app, Unroll.me looks into the heart of your Outlook.com, Gmail/GSuite, Yahoo Mail, and Aol account to locate messages you probably don't want. You can also try an email address from another service.

In return, you get a list of all the senders you could nix; pick the ones you don't want, and Unroll.me does the rest. It also offers a service called The Rollup so you can re-subscribe to select mailings, but they'll get funneled to you via Unroll.me in a daily digest. You can edit (or deactivate) The Rollup any time.

Unroll.me is free, but it does want full access to your messages and contacts. Its parent company, Slice Technologies, says it ignores personal email and anonymizes the messages it sees, but it's using all of the data it can to sell market research based on users.

Unlistr

Remember when companies dropped the "e" before the "r" to make a name? Unlistr does!

There is no web-based interface; Unlistr has a free Android app and a $20 add-on for Outlook (the one in Office, not Outlook.com). You sign up using your email account—any that supports IMAP/POP accounts, plus Gmail, Yahoo, AOL, Outlook.com), and others. Essentially, if you know the incoming and outgoing server settings, it should work. You get a list of senders to unsubscribe from all at once.

Unlistr does all its processing locally on your smartphone, keeps messages encrypted, and avoids trying to un-sub you from known spammers so you won't get more. It doesn't currently collect any information, according to the FAQ.

Heading to Best Buy to purchase a new software security suite? Don't plan on getting one from Kaspersky Lab, because you won't find it there.

As reported by the Minneapolis Star Tribune, Best Buy decided to pull Kaspersky products from its store shelves amid media and US government suspicion about the security firm's link to the Russian government. A Kaspersky Lab spokesperson confirmed the breakup in a Tuesday statement to PCMag.

"Kaspersky Lab and Best Buy have suspended their relationship at this time," the company wrote.

The move comes after Bloomberg in July cited internal Kaspersky Lab emails when reporting that the security vendor "maintained a much closer working relationship with Russia's main intelligence agency, the FSB, than it has publicly admitted" — a claim Kaspersky denied.

"Kaspersky Lab, and its executives, do not have inappropriate ties with any government," the Moscow-based company said in a July statement. "The company does regularly work with governments and law enforcement agencies around the world with the sole purpose of fighting cybercrime."

Around the same time, the Trump administration removed Kaspersky Lab from two lists of approved vendors from which government agencies can purchase technology equipment. The move was reportedly driven by "concerns its products could be used by the Kremlin to gain entry into US networks."

Kaspersky said its CEO and Founder Eugene Kaspersky "repeatedly offered to meet with government officials, testify before the US Congress, and provide the company's source code for an official audit to help address any questions the US government has."

Best Buy declined to comment on the matter when contacted by PCMag, saying: "we don't comment on contracts with specific vendors."

Kaspersky, meanwhile, said its relationship with Best Buy "may be re-evaluated in the future."

"Kaspersky Lab has enjoyed a decade-long partnership with Best Buy and its customer base, and Kaspersky Lab will continue to offer its industry-leading cybersecurity solutions to consumers through its website and other retailers," the company wrote.

The falling out with Best Buy comes after Kaspersky just ended a feud with Microsoft. The antivirus maker had filed suit against Microsoft in Russia and Europe, claiming the Redmond tech giant disabled and removed its antivirus software during a Windows 10 upgrade. Kaspersky dropped the suit last month as Microsoft announced a series of changes to ensure third-party cybersecurity products will no longer face compatibility issues on Windows 10.

Tech support scam victims lost $120 million—and will get $10 million back

Victims of a tech support scam are about to get refunds, but on average they will recover less than 10 percent of what they lost.

The Federal Trade Commission is sending e-mails to victims of the scam with instructions on how to claim a partial refund, the agency said today. Scam victims will have until October 27 of this year to apply for a refund.

The case stems from November 2014, when the FTC announced that "a federal court has temporarily shut down two massive telemarketing operations" that raked in more than $120 million "by deceptively marketing computer software and tech support services."

The FTC later won big court judgments against the companies involved, but the defendants didn't have enough money left to pay up. One monetary judgment of $29.5 million was suspended because of the defendants' financial condition.

But the FTC was able to recover $10 million in a December 2016 settlement with defendants including Inbound Call Experts, a company also known as Advanced Tech Support. A previous settlement with companies accused of generating leads for the telemarketers brought in $258,000.

The FTC did not say exactly how many people will get refunds or what the typical refund amount will be. But the FTC today said that Advanced Tech Support's victims number in the "hundreds of thousands."

People who bought products and services from Advanced Tech Support between April 2012 and November 2014 are eligible for refunds.

The online application to apply for refunds is available at this FTC webpage. The FTC also suggests calling the refund administrator at 877-793-0908.

False claims of viruses and malware

The defendants who paid $10 million "used high-pressure sales pitches to market tech support products and services by falsely claiming that people’s computers were infected with viruses and malware," the FTC said today.

"The company used online ads, search results, and partnerships with software developers to lure consumers to call Advanced Tech Support," the FTC said. Once victims called, telemarketers urged them to sign up for bogus technical support subscriptions and services that sometimes cost hundreds of dollars, the FTC said.

The defendants are allowed to continue doing business, but the settlement prohibits them from lying about performance or security problems on people's computers. "Under the order, a federal judge will appoint a monitor to oversee the defendants' business for two years, at the defendants' expense," the FTC said when it announced the settlement.

Still another set of defendants was ordered to pay $36.4 million, but the judgments were partially suspended due to the defendants' lack of money. A settlement in that case required the defendants to relinquish all of their assets.

Despite the multiple cases and settlements, an FTC spokesperson confirmed to Ars that $10 million is the total amount available for refunds.

Beware of government impersonators

People receiving messages about refunds should be careful, because some fraudsters impersonate government agencies in order to get more money from victims.

"You never have to pay to get a refund in an FTC case. Anyone who asks you to pay for a refund is a scammer," the FTC said. Such scammers should be reported to the FTC.

The FTC's e-mails about refunds for tech support scam victims will come from subscribe@subscribe.ftc.gov and contain a claim number and PIN that will let recipients apply for refunds. The settlement required defendants to provide customer information to the FTC, letting the agency identify people who are due refunds.

Amazon Music Unlimited now has a discount for impoverished students

It’s the time of year again when students head back to their hallowed halls of learning, and retail outlets the country over make an extra-special effort to sell them things. Back-to-school normally also brings some new promotions for students, and Amazon is making now exception for its digital offerings.

Amazon Music Unlimited, Amazon’s streaming music rival to Spotify and Apple Music, is now $5 a month for students. That’s a worthwhile discount over the $8 a month it is for Prime customers, and 50% off the $10 a month that regular non-Amazon-lovers get charged.

Amazon Music Unlimited has always seemed like a bit of an afterthought, a “me-too” lite version of Spotify and Apple Music. It doesn’t have the iPhone hook-in that Apple can leverage, and it can’t match Spotify’s quality of apps or exclusive music.

But for people who just want to listen to a good (not comprehensive) collection of stuff on one or two easy devices, it’s a good and cheap alternative to Spotify. If you’ve got an Amazon Echo, it works flawlessly with that, and that’s likely what Amazon is hoping for here.

Amazon Music Unlimited pricing is now right on par with Spotify and Apple Music for students. Amazon has become increasingly competitive with its digital offerings in the last year, releasing big-name original shows like Man In The High Castle to Amazon Video, and just today, it finally added multi-room music support to the Echo system.

10 ways to make your phone's battery last longer

Let's face it, at this point in your life, there are few things more important than your phone. That's why keeping it alive is more important than ever.

But with Hurricane Harvey, the first Category 3 hurricane that's forecast to hit the US in 12 years, touching down in Texas, potentially thousands of homes face the prospect of losing power. That's bad news for power-hungry smartphones, many of which can barely last a day with normal use.

Fear not. This handy phone survival guide will help you make the most out of your battery. If a power outage hits, you'll know exactly what to do to ensure you remain connected.

Turn off the extra wireless connections 

Your phone has a myriad of different connections, few of which are really that integral during a blackout. Wireless connections such as Bluetooth and WiFi are great during a regular day, but they can quickly drain a battery. In power-saving situations, GPS is also a no no, and disabling location services is another smart move.

Resist the urge to check your phone

For most of us, the smartphone is the equivalent of a drug -- one you can't quit. Well, a blackout is a good chance to go cold turkey. It's smart to limit the use as much as possible. Each time you turn on the display, you're cutting into the phone's battery life.

Share phones

If you're with a group of people, it might be useful to shut off all but one of the phones. That way, if one goes down, someone else can turn on a phone that still has a full charge. Of course, it might be handy to take down some critical phone numbers before turning off the devices.

Switch to airplane mode

If you don't want to completely shut off your phone, switch to airplane mode to shut off all of the radios, and switch back out of airplane mode only when you need to make a call or send a text message.

Keep your phone plugged in before a blackout hits

If you still have power and are looking to limit your usage already, why not let your phone rest near an outlet? When the power goes out, you'll know your phone is holding as much of a charge as it possibly can.

Charge backups

If you're lucky enough to have a phone with a swappable battery, as well as an extra battery, make sure that backup is fully charged before a blackout hits. Alternatively, a fully charged laptop can also be used as a battery of sorts, since it can charge a phone through a USB connection.

Disable push notifications

Most smartphones are hooked up to one e-mail account or another, and these devices either get messages pushed down to them or they fetch the e-mails. You can save a lot of battery by turning off the push notifications. 

Take a break from streaming

If you have to listen to music or video, don't use streaming services, which constantly puts a strain on the phone's battery. Only play videos or songs already loaded on the phone. Likewise, try not to play games that require a connection, like "Pokemon Go" or "Candy Crush Saga," or games that require phones to rev up their processors, such as the "Infinity Blade" series.

Dim the display

Displays often take up the most power, particularly if the phone has a large and bright screen. Most phones have an automatic brightness option, though you could manually dim the screen to preserve battery. Lock the phone and turn off the display as much as possible.

Send text messages instead of calling

Because of the nature of text messages, the conversation is usually kept short and concise. Phone calls can drag on, sucking up valuable battery life, but a text message gets the information out far more efficiently, and isn't constantly running.