Forgot your password?
typodupeerror
Security IT

New Malware Signed With Stolen Government Certificate 34

Posted by samzenpus
from the malaysian-malady dept.
Trailrunner7 writes "Security researchers claim that malware spreading via malicious PDF files is signed with a valid certificate stolen from the Government of Malaysia, in just the latest evidence that scammers are using gaps in the security of digital certificates to help spread malicious code. The malware, identified by F-Secure as a Trojan horse program dubbed Agent.DTIW, was detected in a signed Adobe PDF file by the company's virus researchers recently. The malicious PDF was signed using a valid digital certificate for mardi.gov.my, the Agricultural Research and Development Institute of the Government of Malaysia. According to F-Secure, the Government of Malaysia confirmed that the certificate was legitimate and had been stolen 'quite some time ago.'"
This discussion has been archived. No new comments can be posted.

New Malware Signed With Stolen Government Certificate

Comments Filter:
  • by Moheeheeko (1682914) on Tuesday November 15, 2011 @04:35PM (#38065898)
    We talking days? weeks? months? years? And why wasnt it immediately flagged as stolen?
    • by DriedClexler (814907) on Tuesday November 15, 2011 @05:53PM (#38067098)

      And why is it both stolen AND a legitimate cert?

      Also, who the hell actually installs software just because the Malaysian government signs it?

      "Hm, I'm not sure I want to run this code ... seems like it could put my system at risk. Oh, wait, the Malaysian government signed it! What a fool I was to spend even a moment in worry!"

      • by idontgno (624372) on Tuesday November 15, 2011 @06:04PM (#38067252) Journal

        Also, who the hell actually installs software just because the Malaysian government signs it?

        It's not "who", it's "what". As in "What operating system trusts signed <foo> more than unsigned equivalent?" As in "All of them."

        A signed cert opens doors that most users aren't even aware of. Add to that (in this case) an existing remote arbitrary code execution exploit in unpatched vulnerable versions of Acrobat Reader 8, and you've got a lovely recipe for malware drive-by installation.

        • Oh, crap! Didn't know that!

          *opens up trusted cert list*

        • and this is exactly why I don't trust any cert until I know exactly who issued it. In my case, that's a grand total of 8 certs I actually need to trust on a regular basis, not the damn mess that FF/IE/Opera and Chrome all insist are trustworthy

  • by Anonymous Coward on Tuesday November 15, 2011 @04:45PM (#38066086)

    The article makes no mention of the signing certificate being revoked. Why hasn't the signing certificate been revoked?

    • by Anonymous Coward

      Why hasn't the signing certificate been revoked?

      Is there a working revocation scheme for such certificates? An attack against the the revocation protocol for SSL certificates was demonstrated quite some time ago. It just took one single byte to defeat the entire protocol. And last I checked the running of a signed java applet, the browser didn't even attempt to check for revocation. Are signatures on PDF files any easier to revoke? (And since when was PDF files an executable format?)

    • by idontgno (624372) on Tuesday November 15, 2011 @07:03PM (#38067932) Journal
      I imagine it wasn't reported for revocation because (A) some bureaucrat would have to publicly 'fess up to a nasty boo-boo, and (B) that might inconvenience legitimate users of that certificate chain and (C) make lots of extra work for the fellow bureaucrats to replace the poisonous certificate and publicize its replacement in the using public.

      So, yeah. Allowing the certificate to glimmering is obviously the better solution. There's no downside as long as no one uses the stolen certificate for evil purposes. And if they do, there's probably enough plausible deniability to buy time to do the revocation only when it's absolutely necessary, like buying fire insurance while the roof is burning.

    • by Anonymous Coward

      What's the point when most clients (including browsers) don't look at revocation lists due to the latency it adds. OCSP stapling offers some hope, but is rarely used.

  • So the gap is "the secret key must be kept secret"? I don't see that as a digital certificate failing. It's also the reason we have revocation lists.

    • by putaro (235078)

      No, the gap is that there are too many trusted parties and when some idiot on the other side has a security breach it is affecting people everywhere.

  • by houghi (78078) on Tuesday November 15, 2011 @06:31PM (#38067590)

    It is copyright infringement.

    • by uufnord (999299)

      Should I have modded you as funny? X.509 certificates don't contain copyright notices anywhere within them. I believe they would be treated as non-copyrightable, since they are statements of fact, and not creative works. So, no it's not theft, and it's not copyright infringement. It's merely "copied"..

      malware spreading via malicious PDF files is signed with a valid certificate which was copied from the Government of Malaysia...

  • Revocation List? (Score:4, Informative)

    by Logarhythmic (1082321) on Tuesday November 15, 2011 @06:41PM (#38067706)
    Isn't this precisely what certificate revocation lists are for?
  • How exactly do you go about stealing a digital certificate? Can you revoke the cert after the event? What happens to legitimate sites using the stolen cert?
  • When faced with a virus that none of the existing tools detect, I open up Process Explorer, tell it to verify signatures, and then check for any currently loaded objects with a signature that can't be verified (or no signature). It's just one part of the investigation but it's certainly a good start.

    This increase in stolen certs is troubling.

  • The right question: why the fuck does the Agricultural Research and Development Institute of the Government of Malaysia even need a CA??
    • by heypete (60671)

      They don't.

      A Malaysian CA was issuing bad certificates from their intermediate CA that was chained to Entrust. They were allowing weak, 512-bit RSA keys to be signed, as well as not including any certificate extensions (and thus the certificates were treated as valid for all purposes by many OSs and browsers, as opposed to being limited to only what the extensions stated). Entrust revoked the intermediate CA [entrust.net]. Evidently the Malaysia CA also had broken CRL locations burned into the certs (or didn't include an

All great ideas are controversial, or have been at one time.

Working...