Counterfeit Code Signing Certificates uses increasing: Recorded Future

itman · Feb 22, 2018

An analysis of counterfeit code signing certificates found that while usage is rising, the amount being charged by the malicious vendors is currently high enough from stopping the service from going mainstream.

“Contrary to a common belief that the security certificates circulating in the criminal underground are stolen from legitimate owners prior to being used in nefarious campaigns, we confirmed with a high degree of certainty that the certificates are created for a specific buyer per request only and are registered using stolen corporate identities, making traditional network security appliances less effective,” the study stated.

All the fake certificates are registered using the information from real corporations.

Insikt found that only a few antivirus products were able to spot the code signed certificates.
Click to expand...

https://www.scmagazine.com/counterf...es-increasing-recorded-future/article/746140/

Note: Do not click on the link in the article! Use this link instead: https://www.recordedfuture.com/code-signing-certificates/

Minimalist · Mar 12, 2018

Suspicious cert-sellers give badware a good name for just a few thousand bucks

There's a flourishing trade in illicit code-signing certificates, and even extended validation certificates can be purchased for a few thousand dollars.

That's the conclusion of a study by American and Czech researchers, with input from Symantec Labs (the company's technical director Christopher Gates is a co-author).
Click to expand...

https://www.theregister.co.uk/2018/03/12/susicious_digital_cetificate_sales/

Minimalist · Jun 26, 2018

Underground vendors can reliably obtain code signing certificates from CAs

More and more malware authors are switching to buying new, valid code signing certificates issued by Certificate Authorities instead of using stolen (compromised) ones, researchers have found.

They do not go directly to the CAs for that, but go through one of the vendors of Authenticode certificates offering the wares on underground forums, marketplaces and websites trading black market goods.
Click to expand...

https://www.helpnetsecurity.com/2018/06/26/code-signing-certificates-underground-market/

Rasheed187 · Jun 30, 2018

Minimalist said: ↑

Underground vendors can reliably obtain code signing certificates from CAs

https://www.helpnetsecurity.com/2018/06/26/code-signing-certificates-underground-market/
Click to expand...

OK so this basically means that just because software is signed it shouldn't be trusted. But I assume they can not impersonate legit certificates from well known software companies?

Log in or Sign up

Counterfeit Code Signing Certificates uses increasing: Recorded Future

itman Registered Member

Minimalist Registered Member

Minimalist Registered Member

Rasheed187 Registered Member

Log in or Sign up

Counterfeit Code Signing Certificates uses increasing: Recorded Future

itman Registered Member

Minimalist Registered Member

Minimalist Registered Member

Rasheed187 Registered Member

Useful Searches