Vulnerabilities / Threats

2/22/2018
06:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Criminals Obtain Code-Signing Certificates Using Stolen Corporate IDs

The certificates are available on demand at prices ranging from $299 to $1,599, says Recorded Future.

Malware authors have for some time been using code-signing certificates for their malicious payloads so they can sneak past enterprise anti-malware tools. But contrary to popular belief, not all of the certificates that are being used to distribute malware are stolen from their legitimate owners.

New research by Recorded Future shows that a growing number of code-signing certificates in the cyber underground are actually being created on demand for specific buyers by Dark Web vendors using stolen corporate identities. Each certificate is unique to the buyer and is usually delivered within two- to four days.

The certificates, available for prices ranging from $299 to $1,599, are being issued by reputable companies such as Symantec, Comodo, and Thawte, and are proving very effective at malware obfuscation, Recorded Future said in a report this week.

"We do not have information on what percentage of all certificates circulating in the Dark Web were obtained using compromised corporate credentials," says Andrei Barysevich, director of advance collection at Recorded Future. "However, considering the malicious intent of hackers when utilizing such certificates, it is safe to assume that a high proportion of them were obtained fraudulently." 

The use of code-signing certificates to distribute malware is not new. But more malware authors have recently begun resorting to the tactic as a way to distribute malware.

Organizations use code-signing certificates to authenticate their software and protect it against tampering. The certificates give users a way to verify the identity of the publisher and the integrity of the code. Malware that has been digitally signed with a valid code-signing certificate can be hard to spot. Most anti-malware tools and browsers assume the payload can be trusted because it is from a trusted publisher.

Security vendor Venafi last October reported that a six-month investigation it had conducted showed a thriving market for code signing certificates on the Dark Web.

The research, conducted for Venafi by the Cyber Security Research Institute, showed such certificates to be more expensive even than stolen US passports, credit cards, and even handguns. Venafi found that stolen code-signing certificates can fetch up to $1,200 in underground markets and are being used in a wide range of malicious activity including man-in-the-middle attacks, malware obfuscation, website spoofing, and data exfiltration.

Recorded Future says its investigation shows cybercriminals are currently offering new code-signing certificates and domain-name registration services with SSL certificates. The vendors of these services register the counterfeit certificates using stolen information belonging to legitimate organizations. There is little indication that impacted companies are aware their identity data is being used to illegally obtain code-signing certificate for use by malware authors.

Recorded Future researchers first observed a Dark Web vendor selling such certificates in 2015. Since then, they have seen at least three new actors selling code-signing certificates obtained from major CAs using stolen corporate credentials. One of the vendors has moved on to other activities while the remaining two are currently continuing to sell counterfeit certificates primarily to Russian threat actors.

One of the vendors specializes only in Class 3 certificates that do not support the so-called Extended Validation (EV) assurance, while the other sells EV certificates as well, Recorded Future said. The basic certificates without EV assurance are available for $600 from the vendors, or twicenthe $295 that an organization would normally pay for a code-signing certificate for legitimate use.

A threat-actor that wants to buy a high-assurance version of a code-signing certificate can get one for $1,599 — a 230% markup compared to the price of an authenticate certificate, Recorded Future said. A fully authenticated domain with EV SSL encryption and code-signing support costs $1,799 currently.

"Surprisingly, across the vast number of cybercriminal communities we monitor, we only identified two vendors of compromised certificates, both of whom are Russian-speaking," Barysevich says. "They were, however, offering their products indiscriminately to any willing buyer."

The cost associated with these certificates means they are likely to be of most interest to hackers with specific motives in mind, he says. "Attackers who are engaged in targeted campaigns, such as corporate espionage or bank infiltration, are the most likely buyers of counterfeit code-signing certificates," Barysevich says.

"That being said, there are many applications of compromised SSL EV certificates, and they could be used in a more widespread malware campaign."

Related Content:

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
timothy332211
50%
50%
timothy332211,
User Rank: Apprentice
2/25/2018 | 8:29:35 AM
Dogs
Thanks a lot for sharing the post with us. You can also study in detail about the dogs from here Dogs Hunt
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
The Case for a Human Security Officer
Ira Winkler, CISSP, President, Secure Mentem,  12/5/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8651
PUBLISHED: 2018-12-12
A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynamics NAV.
CVE-2018-8652
PUBLISHED: 2018-12-12
A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Scripting Vulnerability." This affects Windows Azure Pack Rollup 13.1.
CVE-2018-8617
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8618
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8619
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, aka "Internet Explorer Remote Code Execution Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Exp...