Google finds adware strain abusing novel file signature evasion technique

guest · Sep 23, 2021

Google finds adware strain abusing novel file signature evasion technique
September 23, 2021
https://therecord.media/google-finds-adware-strain-abusing-novel-file-signature-evasion-technique/

One of Google’s security teams said it found a malware strain abusing a new technique to evade detection from security products by cleverly modifying the digital signature of its payloads.

Discovered by Neel Mehta, a security researcher for the Google Threat Analysis Group (TAG), the technique was seen abused by an adware strain named OpenSUpdater.

In these new samples, the signature was edited such that an End of Content (EOC) marker replaced a NULL tag for the ‘parameters’ element of the SignatureAlgorithm signing the leaf X.509 certificate. EOC markers terminate indefinite-length encodings, but in this case an EOC is used within a definite-length encoding (l= 13).
Click to expand...

“This is the first time TAG has observed actors using this technique to evade detection while preserving a valid digital signature on PE files,” Mehta explained today.
The Google researcher said he reported the issue to Microsoft so the Redmond-based company can start work on modifying its signature checking algorithms.

Files infected with the OpenSUpdater adware are currently distributed via game cracks and pirated software.
Click to expand...

Google: Financially motivated actor breaks certificate parsing to avoid detection

In the case of the attack outlined below, we see that attackers created malformed code signatures that are treated as valid by Windows but are not able to be decoded or checked by OpenSSL code — which is used in a number of security scanning products. We believe this is a technique the attacker is using to evade detection rules.

Our team is working in collaboration with Google Safe Browsing to protect users from downloading and executing this family of unwanted software. Users are encouraged to only download and install software from reputable and trustworthy sources.
Click to expand...

EASTER · Sep 23, 2021

“This is the first time TAG has observed actors using this technique to evade detection while preserving a valid digital signature on PE files,” Mehta explained today.
The Google researcher said he reported the issue to Microsoft so the Redmond-based company can start work on modifying its signature checking algorithms.

Files infected with the OpenSUpdater adware are currently distributed via game cracks and pirated software.
Click to expand...

It was only a matter of time before another evasion method came thru to penetrate the system

Log in or Sign up

Google finds adware strain abusing novel file signature evasion technique

guest Guest

EASTER Registered Member

Log in or Sign up

Google finds adware strain abusing novel file signature evasion technique

guest Guest

EASTER Registered Member

Useful Searches