Suspicious cert-sellers give badware a good name for just a few thousand bucks

LASER_oneXM

Level 37
Thread author
Verified
Top Poster
Well-known
Feb 4, 2016
2,520
Researchers unmask trade in code-signing certs


There's a flourishing trade in illicit code-signing certificates, and even extended validation certificates can be purchased for a few thousand dollars.

That's the conclusion of a study by American and Czech researchers, with input from Symantec Labs (the company's technical director Christopher Gates is a co-author).

The research found that the success of Microsoft's Windows Defender SmartScreen has forced attackers to change tactics. Once, malware authors would seek out code-signing certificates that had been compromised. During 2017, however, paper says “these methods have become secondary to purchasing certificates from underground vendors”.

The paper cited platform protections like SmartScreen as driving this change.

During 2017, the researchers followed the fortunes of “four leading vendors of code-signing certificates”. One seller turned over a new certificate every couple of days, and for around 50 code-signing certificates they generated US$16,150, suggesting individual certificates are only worth a few hundred each.

That might not be enough to defeat Windows Defender SmartScreen, however. As the paper explained, when SmartScreen encounters a certificate for the first time, it doesn't have a reputation associated with the cert so will raise a warning the user has to click-through during installation.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top