Vulnerabilities / Threats

2/22/2018
06:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Criminals Obtain Code-Signing Certificates Using Stolen Corporate IDs

The certificates are available on demand at prices ranging from $299 to $1,599, says Recorded Future.

Malware authors have for some time been using code-signing certificates for their malicious payloads so they can sneak past enterprise anti-malware tools. But contrary to popular belief, not all of the certificates that are being used to distribute malware are stolen from their legitimate owners.

New research by Recorded Future shows that a growing number of code-signing certificates in the cyber underground are actually being created on demand for specific buyers by Dark Web vendors using stolen corporate identities. Each certificate is unique to the buyer and is usually delivered within two- to four days.

The certificates, available for prices ranging from $299 to $1,599, are being issued by reputable companies such as Symantec, Comodo, and Thawte, and are proving very effective at malware obfuscation, Recorded Future said in a report this week.

"We do not have information on what percentage of all certificates circulating in the Dark Web were obtained using compromised corporate credentials," says Andrei Barysevich, director of advance collection at Recorded Future. "However, considering the malicious intent of hackers when utilizing such certificates, it is safe to assume that a high proportion of them were obtained fraudulently." 

The use of code-signing certificates to distribute malware is not new. But more malware authors have recently begun resorting to the tactic as a way to distribute malware.

Organizations use code-signing certificates to authenticate their software and protect it against tampering. The certificates give users a way to verify the identity of the publisher and the integrity of the code. Malware that has been digitally signed with a valid code-signing certificate can be hard to spot. Most anti-malware tools and browsers assume the payload can be trusted because it is from a trusted publisher.

Security vendor Venafi last October reported that a six-month investigation it had conducted showed a thriving market for code signing certificates on the Dark Web.

The research, conducted for Venafi by the Cyber Security Research Institute, showed such certificates to be more expensive even than stolen US passports, credit cards, and even handguns. Venafi found that stolen code-signing certificates can fetch up to $1,200 in underground markets and are being used in a wide range of malicious activity including man-in-the-middle attacks, malware obfuscation, website spoofing, and data exfiltration.

Recorded Future says its investigation shows cybercriminals are currently offering new code-signing certificates and domain-name registration services with SSL certificates. The vendors of these services register the counterfeit certificates using stolen information belonging to legitimate organizations. There is little indication that impacted companies are aware their identity data is being used to illegally obtain code-signing certificate for use by malware authors.

Recorded Future researchers first observed a Dark Web vendor selling such certificates in 2015. Since then, they have seen at least three new actors selling code-signing certificates obtained from major CAs using stolen corporate credentials. One of the vendors has moved on to other activities while the remaining two are currently continuing to sell counterfeit certificates primarily to Russian threat actors.

One of the vendors specializes only in Class 3 certificates that do not support the so-called Extended Validation (EV) assurance, while the other sells EV certificates as well, Recorded Future said. The basic certificates without EV assurance are available for $600 from the vendors, or twicenthe $295 that an organization would normally pay for a code-signing certificate for legitimate use.

A threat-actor that wants to buy a high-assurance version of a code-signing certificate can get one for $1,599 — a 230% markup compared to the price of an authenticate certificate, Recorded Future said. A fully authenticated domain with EV SSL encryption and code-signing support costs $1,799 currently.

"Surprisingly, across the vast number of cybercriminal communities we monitor, we only identified two vendors of compromised certificates, both of whom are Russian-speaking," Barysevich says. "They were, however, offering their products indiscriminately to any willing buyer."

The cost associated with these certificates means they are likely to be of most interest to hackers with specific motives in mind, he says. "Attackers who are engaged in targeted campaigns, such as corporate espionage or bank infiltration, are the most likely buyers of counterfeit code-signing certificates," Barysevich says.

"That being said, there are many applications of compromised SSL EV certificates, and they could be used in a more widespread malware campaign."

Related Content:

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
timothy332211
50%
50%
timothy332211,
User Rank: Apprentice
2/25/2018 | 8:29:35 AM
Dogs
Thanks a lot for sharing the post with us. You can also study in detail about the dogs from here Dogs Hunt
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
4 Ways to Fight the Email Security Threat
Asaf Cidon, Vice President, Content Security Services, at Barracuda Networks,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.