Vulnerabilities / Threats

2/22/2018
06:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Criminals Obtain Code-Signing Certificates Using Stolen Corporate IDs

The certificates are available on demand at prices ranging from $299 to $1,599, says Recorded Future.

Malware authors have for some time been using code-signing certificates for their malicious payloads so they can sneak past enterprise anti-malware tools. But contrary to popular belief, not all of the certificates that are being used to distribute malware are stolen from their legitimate owners.

New research by Recorded Future shows that a growing number of code-signing certificates in the cyber underground are actually being created on demand for specific buyers by Dark Web vendors using stolen corporate identities. Each certificate is unique to the buyer and is usually delivered within two- to four days.

The certificates, available for prices ranging from $299 to $1,599, are being issued by reputable companies such as Symantec, Comodo, and Thawte, and are proving very effective at malware obfuscation, Recorded Future said in a report this week.

"We do not have information on what percentage of all certificates circulating in the Dark Web were obtained using compromised corporate credentials," says Andrei Barysevich, director of advance collection at Recorded Future. "However, considering the malicious intent of hackers when utilizing such certificates, it is safe to assume that a high proportion of them were obtained fraudulently." 

The use of code-signing certificates to distribute malware is not new. But more malware authors have recently begun resorting to the tactic as a way to distribute malware.

Organizations use code-signing certificates to authenticate their software and protect it against tampering. The certificates give users a way to verify the identity of the publisher and the integrity of the code. Malware that has been digitally signed with a valid code-signing certificate can be hard to spot. Most anti-malware tools and browsers assume the payload can be trusted because it is from a trusted publisher.

Security vendor Venafi last October reported that a six-month investigation it had conducted showed a thriving market for code signing certificates on the Dark Web.

The research, conducted for Venafi by the Cyber Security Research Institute, showed such certificates to be more expensive even than stolen US passports, credit cards, and even handguns. Venafi found that stolen code-signing certificates can fetch up to $1,200 in underground markets and are being used in a wide range of malicious activity including man-in-the-middle attacks, malware obfuscation, website spoofing, and data exfiltration.

Recorded Future says its investigation shows cybercriminals are currently offering new code-signing certificates and domain-name registration services with SSL certificates. The vendors of these services register the counterfeit certificates using stolen information belonging to legitimate organizations. There is little indication that impacted companies are aware their identity data is being used to illegally obtain code-signing certificate for use by malware authors.

Recorded Future researchers first observed a Dark Web vendor selling such certificates in 2015. Since then, they have seen at least three new actors selling code-signing certificates obtained from major CAs using stolen corporate credentials. One of the vendors has moved on to other activities while the remaining two are currently continuing to sell counterfeit certificates primarily to Russian threat actors.

One of the vendors specializes only in Class 3 certificates that do not support the so-called Extended Validation (EV) assurance, while the other sells EV certificates as well, Recorded Future said. The basic certificates without EV assurance are available for $600 from the vendors, or twicenthe $295 that an organization would normally pay for a code-signing certificate for legitimate use.

A threat-actor that wants to buy a high-assurance version of a code-signing certificate can get one for $1,599 — a 230% markup compared to the price of an authenticate certificate, Recorded Future said. A fully authenticated domain with EV SSL encryption and code-signing support costs $1,799 currently.

"Surprisingly, across the vast number of cybercriminal communities we monitor, we only identified two vendors of compromised certificates, both of whom are Russian-speaking," Barysevich says. "They were, however, offering their products indiscriminately to any willing buyer."

The cost associated with these certificates means they are likely to be of most interest to hackers with specific motives in mind, he says. "Attackers who are engaged in targeted campaigns, such as corporate espionage or bank infiltration, are the most likely buyers of counterfeit code-signing certificates," Barysevich says.

"That being said, there are many applications of compromised SSL EV certificates, and they could be used in a more widespread malware campaign."

Related Content:

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
timothy332211
50%
50%
timothy332211,
User Rank: Apprentice
2/25/2018 | 8:29:35 AM
Dogs
Thanks a lot for sharing the post with us. You can also study in detail about the dogs from here Dogs Hunt
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.