dewayne@warpspeed.com
Date: Sat, Nov 4, 2017 at 4:55 AM
Dan Goodin, Ars Technica, 3 Nov 2017
Stuxnet-style code signing is more widespread than anyone thought.
Forgeries undermine the trust millions of people place in digital
certificates.
<https://arstechnica.com/information-technology/2017/11/evasive-code-signed-malware-flourished-before-stuxnet-and-still-does/>
One of the breakthroughs of the Stuxnet worm that targeted Iran's nuclear program was its use of legitimate digital certificates, which cryptographically vouched for the trustworthiness of the software's publisher. Following its discovery in 2010, researchers went on to find the technique was used in a handful of other malware samples both with ties to nation-sponsored hackers and, later on, with ties to for-profit criminal enterprises.
Now, researchers have presented proof that digitally signed malware is much
more common than previously believed. What's more, it predated Stuxnet,
with the first known instance occurring in 2003. The researchers said they
found 189 malware samples bearing valid digital signatures that were
created using compromised certificates issued by recognized certificate
authorities and used to sign legitimate software. In total, 109 of those
abused certificates remain valid. The researchers, who presented their
findings Wednesday at the ACM Conference on Computer and Communications
Security, found another 136 malware samples signed by legitimate CA-issued
certificates, although the signatures were malformed.
The results are significant because digitally signed software is often able to bypass User Account Control and other Windows measures designed to prevent malicious code from being installed. Forged signatures also represent a significant breach of trust because certificates provide what's supposed to be an unassailable assurance to end users that the software was developed by the company named in the certificate and hasn't been modified by anyone else. The forgeries also allow malware to evade antivirus protections. Surprisingly, weaknesses in the majority of available AV programs prevented them from detecting known malware that was digitally signed even though the signatures weren't valid.
"Our results show that compromised certificates pose a bigger threat than
we previously believed, as it is not restricted to advanced threats and
that digitally signed malware was common in the wild before Stuxnet," Tudor
Dumitra, one of three professors at the University of Maryland, College
Park, who performed the research, told Ars. "The findings also raise
important concerns about the security of the code signing ecosystem."
Bypassing AV on the cheap
An accompanying research paper, titled Certified Malware: Measuring Breaches of Trust in the Windows Code-Signing PKI, found that even when a signature isn't valid because it doesn't match the cryptographic hash of the file being signed, at least 34 AV programs to some degree failed to identify the easy-to-spot error. As a result, the AV programs often failed to detect malware that was known to be malicious. The failure, the paper reported, is the result of faulty implementations of Microsoft's Authenticode specification.
To prove the point, the researchers downloaded five unsigned ransomware samples that AV programs almost universally detected as malicious. The researchers then took two expired certificates that previously had been used to sign both legitimate software and malware and used the certificates to sign each of the five ransomware samples. When analyzing the resulting 10 files, the AV programs to varying degrees failed to detect they were malicious. [...]