New Malware Signed With Stolen Government Certificate 34
Trailrunner7 writes "Security researchers claim that malware spreading via malicious PDF files is signed with a valid certificate stolen from the Government of Malaysia, in just the latest evidence that scammers are using gaps in the security of digital certificates to help spread malicious code. The malware, identified by F-Secure as a Trojan horse program dubbed Agent.DTIW, was detected in a signed Adobe PDF file by the company's virus researchers recently. The malicious PDF was signed using a valid digital certificate for mardi.gov.my, the Agricultural Research and Development Institute of the Government of Malaysia. According to F-Secure, the Government of Malaysia confirmed that the certificate was legitimate and had been stolen 'quite some time ago.'"
quite some time ago? (Score:4, Insightful)
Re: (Score:1)
> Is SSL even secure anymore?
It hasn't been since the beginning. But few bothered to notice since any opposition to the epic fail of the CA-model got side-swept in the 90's gold-rush towards "e-commerce" anyway. People (mostly pointy-haired) wanted a quick solution, and that's what they, and unfortunately we all, got.
Re:quite some time ago? (Score:4, Funny)
And why is it both stolen AND a legitimate cert?
Also, who the hell actually installs software just because the Malaysian government signs it?
"Hm, I'm not sure I want to run this code ... seems like it could put my system at risk. Oh, wait, the Malaysian government signed it! What a fool I was to spend even a moment in worry!"
Re:quite some time ago? (Score:5, Informative)
Also, who the hell actually installs software just because the Malaysian government signs it?
It's not "who", it's "what". As in "What operating system trusts signed <foo> more than unsigned equivalent?" As in "All of them."
A signed cert opens doors that most users aren't even aware of. Add to that (in this case) an existing remote arbitrary code execution exploit in unpatched vulnerable versions of Acrobat Reader 8, and you've got a lovely recipe for malware drive-by installation.
Re: (Score:2)
Oh, crap! Didn't know that!
*opens up trusted cert list*
Re:quite some time ago? (Score:5, Insightful)
Re: (Score:2)
Except that there are multiple paths a certificate can be signed. For example, to remove CNNIC, you have to distrust Entrust as well.
Re: (Score:2)
and this is exactly why I don't trust any cert until I know exactly who issued it. In my case, that's a grand total of 8 certs I actually need to trust on a regular basis, not the damn mess that FF/IE/Opera and Chrome all insist are trustworthy
Why isn't this certificate revoked? (Score:3, Insightful)
The article makes no mention of the signing certificate being revoked. Why hasn't the signing certificate been revoked?
Re: (Score:1)
Is there a working revocation scheme for such certificates? An attack against the the revocation protocol for SSL certificates was demonstrated quite some time ago. It just took one single byte to defeat the entire protocol. And last I checked the running of a signed java applet, the browser didn't even attempt to check for revocation. Are signatures on PDF files any easier to revoke? (And since when was PDF files an executable format?)
Re:Why isn't this certificate revoked? (Score:4, Interesting)
So, yeah. Allowing the certificate to glimmering is obviously the better solution. There's no downside as long as no one uses the stolen certificate for evil purposes. And if they do, there's probably enough plausible deniability to buy time to do the revocation only when it's absolutely necessary, like buying fire insurance while the roof is burning.
Re: (Score:1)
What's the point when most clients (including browsers) don't look at revocation lists due to the latency it adds. OCSP stapling offers some hope, but is rarely used.
Re: (Score:2)
"Life is no way to treat an animal." would make an excellent epitaph.
"gaps in the security of digital certificates" (Score:2)
So the gap is "the secret key must be kept secret"? I don't see that as a digital certificate failing. It's also the reason we have revocation lists.
Re: (Score:3)
No, the gap is that there are too many trusted parties and when some idiot on the other side has a security breach it is affecting people everywhere.
Comment removed (Score:5, Funny)
Re: (Score:1)
Should I have modded you as funny? X.509 certificates don't contain copyright notices anywhere within them. I believe they would be treated as non-copyrightable, since they are statements of fact, and not creative works. So, no it's not theft, and it's not copyright infringement. It's merely "copied"..
malware spreading via malicious PDF files is signed with a valid certificate which was copied from the Government of Malaysia...
Revocation List? (Score:4, Informative)
Re: (Score:1)
Unfortunately, the stolen certificate in question had an invalid CRL, which means this certificate could not be revoked at all. This is also one of the mentioned 22 certificates with weak 512-bit key.
In related news, the CA in question was revoked by major browser vendors exactly due to this bad practice.
http://tech.slashdot.org/story/11/11/04/1539253/microsoft-mozilla-and-google-ban-malaysian-intermediate-ca [slashdot.org]
Re: (Score:2)
Dear AC, don't worry.The mod who modded you down can hardly be blamed. He doesn't know about Dr. M, and he probably doesn't speak Bahasa Malaysia neither. So something was whooshing over her head.
stolen digital certificate (Score:1)
Makes virus detection tricky (Score:2)
When faced with a virus that none of the existing tools detect, I open up Process Explorer, tell it to verify signatures, and then check for any currently loaded objects with a signature that can't be verified (or no signature). It's just one part of the investigation but it's certainly a good start.
This increase in stolen certs is troubling.
Asking the wrong question (Score:2)
Re: (Score:2)
They don't.
A Malaysian CA was issuing bad certificates from their intermediate CA that was chained to Entrust. They were allowing weak, 512-bit RSA keys to be signed, as well as not including any certificate extensions (and thus the certificates were treated as valid for all purposes by many OSs and browsers, as opposed to being limited to only what the extensions stated). Entrust revoked the intermediate CA [entrust.net]. Evidently the Malaysia CA also had broken CRL locations burned into the certs (or didn't include an