Malware Strikes With Valid Digital Certificate
- 05 February, 2013 00:32
One of the foundational elements of ecommerce is the web of trust enabled by digital certificates. When you go to a web site, you can feel confident that it's legitimate because it has a certificate from a recognized certificate authority that validates it. But the certificates themselves can be vulnerable. Case in point: Security firm Malwarebytes recently discovered some malware in the wild with a valid, signed digital certificate.
"One of our security researchers identified this piece of malware," says Jerome Segura, senior security researcher at Malwarebytes. "It's a typical Trojan with one peculiarity: It was signed, and unlike a lot of malware that uses signatures, this one was valid."
The malware is a banking/password stealer that Segura says uses email to spread. It appears to be a PDF invoice with a valid certificate issued to a real Brazilian software company called "Buster Paper Comercial Ltda," Segura says. The certificate was issued by SSL certificate authority DigiCert. Segura notes that although DigiCert has been notified about the malware, the certificate has not yet been revoked.
"I don't think it's stolen, per se," Segura says. "It looks like what [the criminals] did is they looked at this company in Brazil, which is a software company, and essentially made a request in their name to DigiCert. From the point of view of the certificate authority, it looks normal. [The criminals] probably spoofed the email address to buy the certificate. It looks to me as if it's too easy for anybody who does a bit of research to either impersonate a company or set up a fake web site as if it were a company and then buy a certificate."
When someone clicks on this particular piece of malware, Segura says, it opens what appears to be a PDF invoice. But it also creates a number of processes that connect to an enterprise cloud storage company.
"This is a sub-domain for a cloud storage company focusing on file sharing for the enterprise," Segura says. "Well, in our case, it's file storage for the criminals."
The fake PDF downloads two very large files--WIDEAWAKE1.zip and WIDEAWAKE1.ecl. Segura notes that Malwarebytes has also reached out to the cloud storage company about the issue but have yet to receive a response.
Segura notes that ThreatExpert, provider of an automated threat analysis system, found a similar Trojan with a valid digital certificate last November. That Trojan's certificate has since been revoked.
"What we have here is a total abuse of hosting services, digital certificates and repeat offenses from the same people," Segura says. "Clearly if digital certificates can be abused so easily, we have a big problem on our hands."
Digital Certificates Used for Spear Phishing Attacks
"Digital certificate theft can be used in targeted attacks as [for] spear phishing, for example," Segura says. "As we know, one of the weakest links in the security chain is the end-user (and this is especially true in the enterprise world). An attacker can easily find out or guess what antivirus a company is running and craft a piece of malware that will not be detected by it. Because such attacks are very narrow, the sample will not be disseminated around the world, making its discovery less likely."
Segura recommends that end-users still check for valid digital certificates before opening an attachment received via email (even if they know the sender). But he also recommends following two basic but "powerful" rules:
- Check the file extension and beware the multiple file extension trick (i.e., document.pdf.xls.exe)
- Never trust file icons; just because it looks like a Word document or PDF, that doesn't mean it is
Thor Olavsrud covers IT Security, Big Data, Open Source, Microsoft Tools and Servers for CIO.com. Follow Thor on Twitter @ThorOlavsrud. Follow everything from CIO.com on Twitter @CIOonline and on Facebook. Email Thor at firstname.lastname@example.org
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
Trust issue looms large for tech companies capitalizing on personal data
5 women who've made it in IT
Five trends affecting legal CIOs
CIO Roundtable: The changing face of security
Bitcoin malware count soars as cryptocurrency value climbs
Traversing Energy Markets
For a number of industries, there is room for delays caused by poor performance of IT infrastructure, and the importance of a solid monitoring system has never been greater. Read about how the Midcontinent Independent System Operator was able to tackle this challenge and effectively administer one of the world’s largest energy markets.
5 Ways To Be More Productive At Work
Think back to the last time all your employees were in the office, at their desks, on the same day. It’s no surprise that you might struggle, between travel and off-site meetings, remote staff, flexible schedules and sick days. In today's competitive business climate, organisations need to maintain productivity and connectedness with their staff, despite not always being onsite. In this whitepaper, we look at five ways you can improve productivity, no matter where employees are.
The Power of Transformational Knowledge
Apple saves $5 million a year on case and email deflection, while its agents find information 47 per cent faster than before they invested in something called Transformational Knowledge. In today’s consumer-empowered marketplace, you cannot afford negative customer experiences. However many companies lack the tools and processes required to empower their employees to deliver great customer experiences. In this whitepaper, we look at how to breakdown silos and deliver great customer experiences.