Miscreants were quick to capitalize on the theft of Sony's crypto certificates
Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!Tweet Share on Twitter.
December 10, 2014
Cyber criminals were quick to capitalize on the theft of Sony's cryptographic certificates used to sign software to appear to make it look legitimate.
A further analysis of malware called 'Destover' was published by Kaspersky Labs yesterday, and reveals that the code was signed using a private certificate belonging to Sony to evade malware filters. Yes, they are smart.
These certificate were apparently taken from Sony Pictures servers, which were hugely attacked by hackers at the end of November and then leaked online.
It's believed that the infiltrators used a version of Destover to attack Sony's network. And it appears the stolen digital certificates were then used to sign another build of Destover on Friday, which then ended up in the wild over the weekend.
When a Windows server examines an executable, it looks to see if the program has been signed by a recognized, trusted developer before running the code. As far as the operating system was concerned, the signed Destover was legitimate, but of course it wasn't since the server was tricked into thinking it was.
"The stolen Sony certificates, which were also leaked by the attackers, can be used to sign other malicious samples," Kaspersky warned yesterday.
"In turn, these can be further used in other similar attacks. Because the Sony digital certificates are trusted by security solutions, this makes attacks more effective. We've seen attackers leverage trusted certificates in the past, as a means of bypassing whitelisting software and default-deny policies."
It's worth pointing out that malware writers can no longer use the code-signing keys. The certificates were issued by DigiCert, a U.S. firm that sells security certificates.
Kaspersky said it warned DigiCert about the problem, so we checked with the crypto-company to find out what the situation was.
"This certificate is already revoked," a spokeswoman for DigiCert told us, meaning that Windows system admins should reject the Destover build when its cryptographic signature is checked by the operating system.
"We received a report about the malware last week and immediately revoked the certificate," a spokesperson added.
If you've already downloaded and run the Sony-signed malware, well, bad luck-- you're infected! If you haven't yet, your PC should kick it out as the certificate is now invalid.
Source: Kaspersky Labs.
Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!