Many organizations have as of late begun adopting certain
strategies of using code-signing certificates to authenticate their software
and protect it against tampering. Indeed, even Malware authors have for quite
some time been utilizing such certificates for their malicious payloads so as
to sneak past enterprise anti-malware tools.
A New research done by the Recorded Future shows that a
growing number of code-signing certificates in the cyber underground are
actually being created on demand for specific buyers by Dark Web vendors
utilizing stolen corporate identities. Each certificate is unique to the buyer
and is usually delivered within two- to four days.
The certificates are notwithstanding being issued by
reputable companies for example Symantec, Comodo, and Thawte, and are
accessible at costs ranging from $299 to $1,599.
This usage of code-signing certificates to distribute
malware is not new but recently more malware authors have started depending on
the strategy as a way to distribute malware.
"We do not have information on what percentage of all certificates
circulating in the Dark Web were obtained using compromised corporate
credentials," says Andrei Barysevich, director of advance collection at
Recorded Future. "However, considering the malicious intent of hackers
when utilizing such certificates, it is safe to assume that a high proportion
of them were obtained fraudulently."
The certificates issued give users an approach to confirm
the identity of the publisher and the integrity of the code. The Malware
however is difficult to spot since it has been digitally signed with a valid
code-signing certificate as it also happens that a majority of the anti-malware
tools and browsers remain under the impression that the payload can be trusted
because it is from a trusted publisher.
A recent incident that sparked wide spread interest was
reported last October, by a security vendor Venafi that followed a six-month
investigation conducted to show a thriving market for code signing certificates
on the Dark Web.
The research,
conducted by the Cyber Security Research Institute, showed that such
certificates are more expensive than even the stolen US passports, credit
cards, and handguns. Venafi found that stolen code-signing certificates are
being utilized as a part of a wide range of malicious activity including
man-in-the-middle attacks, malware obfuscation, website spoofing, and data
exfiltration and can get up to $1,200 in underground markets.
Recorded Future researchers say that their investigation
shows that the cybercriminals are currently offering new code-signing
certificates and domain-name registration services with SSL certificates.
They first observed a Dark Web vendor selling such
certificates in 2015. From that point onward, they have seen no less than three
new actors selling code-signing certificates obtained from major CAs using
stolen corporate credentials. One of the vendors has even proceeded on to other
activities while the remaining two are as of now continuing to sell counterfeit
certificates primarily to Russian threat actors.
The cost associated with these certificates implies to the
fact that they are likely to be of most interest to hackers with specific
motives in mind, Barysevich says.
"Attackers who are engaged in targeted campaigns, such as
corporate espionage or bank infiltration, are the most likely buyers of
counterfeit code-signing certificates," he added further.
"That being said, there are many applications of compromised SSL
EV {Extended Validation Assurance} certificates, and they could be used in a
more widespread malware campaign."
The essential certificates without EV assurance are in any
case available for $600 from the vendors, or twice the amount of $295 that an
organization would normally pay for a code-signing certificate for legitimate
use.