Undetectable Worms

wat0114 · Oct 13, 2009

Thank you for the info, Franklin!

renegade08 · Oct 14, 2009

Windchild said:

Conversely, I think you're looking at this the wrong way, but isn't that just how these things go. As I said in my previous post: "It's one thing to have some random no-name company's signature on a file, and a completely different thing to have a known legit company's valid signature on it."

Yes, trusting the certificate authority is obviously the required first step. If you do not even trust the CA, then the whole signature means nothing to you. But, even if you trust the CA, that does NOT mean the file or web site is somehow guaranteed safe. It just means that according to that CA the file or website came from whoever has their name in the signature and in that sense is "authentic" as in "it really did come from that source" - but realize that this does not mean "safe" or "can't be malicious". After you know this, you have to decide whether you trust the someone whose name is in the signature. You trust the company, in other words, or do not trust it. If some CA trusted by you claims this file is from "Microsoft Corporation", then you need to decide whether you trust Microsoft Corporation or not. If you don't trust them, then you don't trust the file either. If you do trust them, you might trust the file - hopefully after you've considered the possibility that the CA has issued a certificate with MS' name to some bad guy who isn't MS. On the other hand, if the file is signed by some company called "Randomstf Inc" that you don't know and that you can't find with Google, then perhaps you shouldn't trust that file even if your favourite certificate authority has co-signed it. Perhaps my point is clear enough by now.

"Certificates being issued to malware domains" begs the question "what certificates are they getting, their own certificates or those of some other party?" If malware domain "evilmalware.com" has been issued a cert that assures they really are "evilmalware.com", why is this a problem to anyone who understands how these things work? It's not. This is about proof of origin and identity, and in the case of files also that the file has not been modified or corrupted. It's not about proof of safety or benevolent intent. There would only be a problem if evilmalware.com got issued a certificate that assures they're in fact "Microsoft Corporation" or any other trusted party who they really are not.

Getting a cert to your own or some made up name is not that difficult. But getting a cert to someone else's name is much more difficult. Off the top of my head, for the more trusted CAs, I remember one case years ago where Verisign issued a certificate with the name "Microsoft Corporation" to some conman who wasn't MS. That stuff is rare. Which is why digital signatures do help a lot more than just "a bit", if you know how they work. If you don't, then they obviously may help nothing and can contribute to a false sense of security ("if it's got a cert, it has to be safe"). Obviously, the choice of CAs that you trust is pretty critical: if your trusted CAs are too loose with giving certs, then you can no longer get a reasonable proof of origin and identity from the signatures. So, as always, be careful with who you trust.

But to summarize, you might put it all this way: How many people here have seen malicious files that have valid digital signatures of some trusted company, like MS? How many such files have you seen? How many malicious files have you seen with valid signatures of "Microsoft Corporation" with "Microsoft Root Authority" at the bottom of the cert chain? Anyone got any numbers?
Click to expand...

This is so far the best informative post about above mentioned things that i've seen at the net, and opposite of mostly non-informative and witch hunt hundreds of threads and thousands of post from people that don't understand or don't want to understand how some stuff work.

Most people should be redirected here, first to read this several times, think well, and then give their opinion.

Thanks.

Athletic · Oct 14, 2009

nosirrah said:

A lot of malware has anti sandbox and onlyline analyze tech as well so you often will get results you cant trust .
Click to expand...

What do you mean by this? Bypassing or something else...

I have all my automatic updates(on programs,and windows)set to OFF,and I only update manual few programs....my first line defence is downloading from good resource,and only well known programs....

nosirrah · Oct 14, 2009

Athletic said:

What do you mean by this? Bypassing or something else...

I have all my automatic updates(on programs,and windows)set to OFF,and I only update manual few programs....my first line defence is downloading from good resource,and only well known programs....
Click to expand...

Acts differently/aborts if any of the various non real world PC environments are detected . This is done for a variety of reasons but the one that effects users is to trick you into thinking that a file is harmless .

wat0114 · Oct 14, 2009

Like disappearing from the download location shortly after the install process begins, is one vm-aware reaction I've seen recently.

Log in or Sign up

Undetectable Worms

wat0114 Guest

renegade08 Registered Member

Athletic Registered Member

nosirrah Malware Fighter

wat0114 Guest

Log in or Sign up

Undetectable Worms

wat0114 Guest

renegade08 Registered Member

Athletic Registered Member

nosirrah Malware Fighter

wat0114 Guest

Useful Searches