Malware authors' continued use of stolen certificates isn't all bad news

Posted by   Martijn Grooten on   Jul 10, 2018

A malware campaign has been using code-signing certificates stolen from Taiwanese companies to sign its samples, ESET researcher and regular VB conference speaker Anton Cherepanov writes.

Malware signed with stolen certificates isn't a new phenomenon. Stuxnet famously used stolen certificates, also from Taiwanese companies, and in 2016 Symantec wrote about a malware campaign that used no fewer than nine stolen certificates. A year earlier, IBM's Limor Kessem looked at the phenomenon of code signing being offered as a service in the cybercrime underground.

In this particular case, two malware families were using the stolen certificates: the PLEAD backdoor (analysed by JPCERT/CC last month) and a password stealer that steals passwords from various browsers. Both malware families are linked to the BlackTech cyber espionage group that Trend Micro wrote about last year and whose activities focus particularly on Taiwan.

PLEAD_D-Link_Certificate.pngD-Link was one of the companies whose certificates was stolen. Source: ESET.

In his blog post, Cherepanov lists a number of indicators of compromise, including the serial numbers of the two affected certificates, both of which have now been revoked. This shows another, more positive side to the use of stolen certificates by malware authors: once the certificate theft has been discovered, it does help defenders find the malware more easily.

Something similar occurs with DKIM, which is used to sign emails and which plays an important role in the fight against unwanted and malicious emails. DKIM private keys can also be stolen, but doing so won't give an adversary more than a short-term advantage: once the malicious use of a DKIM key is discovered, which in the case of email often happens quickly and automatically, emails that are signed with with are actually more likely to be blocked.

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2018 paper and video: Android app deobfuscation using static-dynamic cooperation

Static analysis and dynamic analysis each have their shortcomings as methods for analysing potentially malicious files. Today, we publish a VB2018 paper by Check Point researchers Yoni Moses and Yaniv Mordekhay, in which they describe a method that…

VB2019 call for papers closes this weekend

The call for papers for VB2019 closes on 17 March, and while we've already received many great submissions, we still want more!

Registration open for VB2019 ─ book your ticket now!

Registration for VB2019, the 29th Virus Bulletin International Conference, is now open, with an early bird rate available until 1 July.

The VB2019 call for papers is about ... papers

When we are calling for papers for the Virus Bulletin conference as we are doing now, we really mean a written paper. But don't worry if you've never written a paper - we can help!

VB2018 video: Adware is just malware with a legal department - how we reverse engineered OSX/Pirrit, received legal threats, and survived

Amit Serper first analysed the OSX/Pirrit adware in 2016, highlighting some of its malware-like techniques, and soon afterwards started receiving legal threats from the company behind it. At VB2018 Amit gave a presentation in which he discussed both…

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.