Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

F-Secure finds malware signed with stolen digital certificate

The certifcate allowed the malicious software to appear legitimate when installed

Researchers from security vendor F-Secure have spotted a rare malicious software sample that carried a valid code-signing certificate from a Malaysian governmental institution.

A code-signing certificate is a kind of digital signature that ensures the authenticity and integrity of an application to be run on a computer. Malicious software programs often present fake digital signatures, but ones that are legitimate and attached to malware are rare, said Mikko Hypponen, chief research officer for F-Secure.

The certificate was signed by "anjungnet.mardi.gov.my," which is part of Malaysia's Agricultural Research and Development Institute. Hypponen said F-Secure contacted the organization, which then found that a Windows server responsible for generating the certificates had been hacked.

The organization said it was unsure how long the server may have been compromised, Hypponen said.

Hypponen said the malware using the certificate was a "backdoor," or an application that can steal information or download other programs to an infected machine. The malware was distributed by a PDF file that had been rigged to exploit a vulnerability in Adobe's Reader 8 application.

Obtaining the secret key isn't enough to generated a code-signing certificate, Hypponen said. An attacker would also have to know a password in order to generate a certificate. He said that could have been obtained by infecting one of the organization's computers with a keylogging program.

It is quite rare for malware to have a valid certificate, although the one associated with this malware is no good now since it expired at the end of September. Nonetheless, since the discovery, the secret key used to generate the certificate has been revoked.

Other components of the malware were also digitally signed, though not by the Malaysian government entity. Hyponnen said the other components were signed by "esupplychain.com.tw," an unknown entity.

Send news tips and comments to jeremy_kirk@idg.com

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Adobe, F-Secure

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: f-secure, malware, security
Latest Blog Posts
Whitepapers
  • Unified Communications Strategy Guide
    Articles include: How to ensure a successful UC project; Five reasons to set up unified communications; Unified communications: Is your network ready?; How to get the most from unified communications. Read this Computerworld Strategy Guide.
    Learn more »
  • Improving Productivity in the Connected Enterprise Through Collaboration
    In the market for collaborative applications, a large convergence is beginning to take hold, and the consumerization of IT is central to this movement. The technologies that people use as consumers are impacting the way employees, customers, and partners want to interact and collaborate at work. People want to take the same technology experiences that are available at home and plug them into their daily work lives. This movement is setting worker expectations as both employees and corporate consumers. Workers need to have the choice and flexibility to consume the applications they want, where they want, and on their preferred device. Read on.
    Learn more »
  • Why Encrypt? Securing Email without compromising communications.
    Encryption is a vital component of any DLP strategy. It allows businesses to exchange sensitive information without compromising on security; even if data is intercepted, encryption makes it unreadable and renders it tamper-proof. Read on.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments