Protect your corporate IT network from hackers and other unwanted intruders with Proxy Sentinel™. Click here for all the details and get the peace of mind you deserve.
Back to our Homepage Proxy Sentinel™ high performance Internet proxy server and secure firewall solution Firewall Sentinel™ secure & powerful Internet firewall solution About Internet Security.ca and GCIS Frequently Asked Questions on Internet security issues Internet Security Industry News - Stay informed of what's happening Contact Internet Security.ca today and order your Proxy Sentinel™ or Firewall Sentinel™ server now!

Miscreants were quick to capitalize on the theft of Sony's crypto certificates

If you need reliability when it comes to SMTP servers, get the best, get Port 587.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!

Share on Twitter.

December 10, 2014

Click here to order the best deal on a HP enterprise dedicated server and at a great price.

Cyber criminals were quick to capitalize on the theft of Sony's cryptographic certificates used to sign software to appear to make it look legitimate.

A further analysis of malware called 'Destover' was published by Kaspersky Labs yesterday, and reveals that the code was signed using a private certificate belonging to Sony to evade malware filters. Yes, they are smart.

These certificate were apparently taken from Sony Pictures servers, which were hugely attacked by hackers at the end of November and then leaked online.

It's believed that the infiltrators used a version of Destover to attack Sony's network. And it appears the stolen digital certificates were then used to sign another build of Destover on Friday, which then ended up in the wild over the weekend.

When a Windows server examines an executable, it looks to see if the program has been signed by a recognized, trusted developer before running the code. As far as the operating system was concerned, the signed Destover was legitimate, but of course it wasn't since the server was tricked into thinking it was.

"The stolen Sony certificates, which were also leaked by the attackers, can be used to sign other malicious samples," Kaspersky warned yesterday.

"In turn, these can be further used in other similar attacks. Because the Sony digital certificates are trusted by security solutions, this makes attacks more effective. We've seen attackers leverage trusted certificates in the past, as a means of bypassing whitelisting software and default-deny policies."

It's worth pointing out that malware writers can no longer use the code-signing keys. The certificates were issued by DigiCert, a U.S. firm that sells security certificates.

Kaspersky said it warned DigiCert about the problem, so we checked with the crypto-company to find out what the situation was.

"This certificate is already revoked," a spokeswoman for DigiCert told us, meaning that Windows system admins should reject the Destover build when its cryptographic signature is checked by the operating system.

"We received a report about the malware last week and immediately revoked the certificate," a spokesperson added.

If you've already downloaded and run the Sony-signed malware, well, bad luck-- you're infected! If you haven't yet, your PC should kick it out as the certificate is now invalid.

Source: Kaspersky Labs.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!


Home | Proxy Sentinel™ | Firewall Sentinel™ | FAQ | News | Sitemap | Contact
Copyright © Internet Security.ca    Terms of use    Privacy agreement    Legal disclaimer