Security Concerns

• I will refer to Temp_Cleaner GUI here as TCG, Windows Command Prompt as cmd.exe or just cmd, and the System32 folder that exists in the Windows directory as just System32.
• ASAP means As soon as possible.

TCG is open-source, meaning that detected security threats can be easily be spoted and fixed.

Currently known security flaws

This is a list of currently known security flaws with TCG.

• TCG can be used to execute malicious commands if cmd.exe in your OS is infected.

  If your computer is infected with a virus that changed the copy of cmd.exe installed on your computer with a malicious one, it will affect the way TCG performs, and since TCG uses basic commands like rmdir, del, and cd during the cleaning process, when TCG attempts to run these commands on a system with infected cmd.exe it will grant full administrative permissions to it, meaning it can allow it to run malicious commands.

  • There aren't any known incidents of someone getting infected with a virus that changes the copy of cmd.exe to a malicious one, but may happen later.

  • This security flaw affects all applications in the system that use cmd.exe, not just TCG.

  • The best way to protect yourself is to install a good antivirus and keep your system up-to-date.

  • TCG can NOT integrate a safe copy of cmd.exe onto it, since cmd.exe is a part of the Windows Operating System and is not Open Source.

• TCG can be used to execute malicious commands if sc.exe in your OS is infected.

  sc.exe, the service controller program, is a core part of the Windows Operating System that TCG uses during the process of restarting the Windows Update Service after the Windows Update cleaning function finishes successfully, the user is prompted if they want to do a restart or not, but however if the user chooses that they want to do a restart, TCG attempts to run the sc.exe from the System path, and since sc.exe is not a part of the cmd.exe like other commands are, some virus or malicious programs can replace the sc.exe in your OS's System32 folder with a malicious one.

  • There aren't any known incidents of someone getting infected with a virus that changes the copy of sc.exe to a malicious one, but may happen later.
  • This security flaw also affects all applications in the system that uses the sc.exe binary, not only TCG.
  • The best way to protect yourself is to install a good antivirus and keep your system up-to-date, or to click 'No' when prompted to restart the Windows Update Service during a cleaning session.
  • TCG can NOT integrate a safe copy of sc.exe onto it, since sc.exe is a part of the Windows Operating System and is not Open Source.

• TCG can be used to give administrator privileges to applications specified in a Custom user specified cleaner.

  In a more recent version of TCG (v8.0+), a non-administrator user can abuse the functionality of using user defined cleaning commands to make TCG give administrator privileges to a program, by specifying its full command line, which poses a security risk.

  • This may pose a security risk in organizations that allow its employees to use the company's property in standard User accounts and allow TCG to run with full administrator privileges under these user accounts.

    • The only way to mitigate this risk is by changing the permissions of the file addsclean.ini to be read-only for everyone and give modify permissions to only the administrators group or the IT Administrator user.

    Or if you are a standard home user:

    • You can mitigate this risk by only adding custom cleaning commands that you are completely sure that won't create new security vulnerabilities.

    • Only use commands del /F /S /Q /A "full\path\to\folder" if you want to delete all files in a folder
      or the command rmdir /Q "full\path\to\folder\*" if you want to delete all subdirectories in a folder
      or the command rmdir /S /Q "full\path\to\folder" if you want to delete everything in a folder in addition to the folder itself.
      (ALWAYS keep the quotes)
      You can run multiple commands by adding && between every two commands, like this: rmdir /S /Q "%userprofile%\Desktop\myfolder_tmp"&&del /F /S /Q "%userprofile%\Documents\someapp_tmp"

  • Severity: Severe

  • Rarity: Very Common

Privacy Concerns

I have explained what kind of information TCG and all its other components collect about you in the privacy policy

Report security vulnerabilities

If you find a new security flaw that you want to be addressed, please create an issue fully describing it properly.