Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Malware Signed With Stolen Government Certificate

Posted by samzenpus on from the malaysian-malady dept.

Trailrunner7 writes "Security researchers claim that malware spreading via malicious PDF files is signed with a valid certificate stolen from the Government of Malaysia, in just the latest evidence that scammers are using gaps in the security of digital certificates to help spread malicious code. The malware, identified by F-Secure as a Trojan horse program dubbed Agent.DTIW, was detected in a signed Adobe PDF file by the company's virus researchers recently. The malicious PDF was signed using a valid digital certificate for mardi.gov.my, the Agricultural Research and Development Institute of the Government of Malaysia. According to F-Secure, the Government of Malaysia confirmed that the certificate was legitimate and had been stolen 'quite some time ago.'"

34 comments

  1. quite some time ago? by Moheeheeko · · Score: 4, Insightful

    We talking days? weeks? months? years? And why wasnt it immediately flagged as stolen?

    1. Re:quite some time ago? by crunchy666 · · Score: 0

      Does it matter how long ago? A world government doesn't even think this is worth reporting to anyone.... Is SSL even secure anymore?

    2. Re:quite some time ago? by DriedClexler · · Score: 3, Funny

      And why is it both stolen AND a legitimate cert?

      Also, who the hell actually installs software just because the Malaysian government signs it?

      "Hm, I'm not sure I want to run this code ... seems like it could put my system at risk. Oh, wait, the Malaysian government signed it! What a fool I was to spend even a moment in worry!"

      --
      Information theory is life. The rest is just the KL divergence.
    3. Re:quite some time ago? by idontgno · · Score: 5, Informative

      Also, who the hell actually installs software just because the Malaysian government signs it?

      It's not "who", it's "what". As in "What operating system trusts signed <foo> more than unsigned equivalent?" As in "All of them."

      A signed cert opens doors that most users aren't even aware of. Add to that (in this case) an existing remote arbitrary code execution exploit in unpatched vulnerable versions of Acrobat Reader 8, and you've got a lovely recipe for malware drive-by installation.

      --
      Welcome to the Panopticon. Used to be a prison, now it's your home.
    4. Re:quite some time ago? by DriedClexler · · Score: 1

      Oh, crap! Didn't know that!

      *opens up trusted cert list*

      --
      Information theory is life. The rest is just the KL divergence.
    5. Re:quite some time ago? by fast+turtle · · Score: 1

      and this is exactly why I don't trust any cert until I know exactly who issued it. In my case, that's a grand total of 8 certs I actually need to trust on a regular basis, not the damn mess that FF/IE/Opera and Chrome all insist are trustworthy

      --
      Mod me up/Mod me down: I wont frown as I've no crown
    6. Re:quite some time ago? by TClevenger · · Score: 4, Insightful

      I'd love to see a "NoScript" equivalent for CAs. Let ME decide if I should approve a certificate signed by the Hong Kong Post Office. (Yes, they're in there.)

    7. Re:quite some time ago? by Anonymous Coward · · Score: 0

      That's unnecessary. You can easily remove any of the trusted CAs from your browser. In Firefox, it's under Preferences/Advanced/View Certificates.
      I find you worrying about the Hong Kong Post Office CA amusing. All a CA does is check the guy is who he says he is, nothing more. With enough money they could buy HK's CA just like they could buy AOL's.

    8. Re:quite some time ago? by Anonymous Coward · · Score: 1

      > Is SSL even secure anymore?

      It hasn't been since the beginning. But few bothered to notice since any opposition to the epic fail of the CA-model got side-swept in the 90's gold-rush towards "e-commerce" anyway. People (mostly pointy-haired) wanted a quick solution, and that's what they, and unfortunately we all, got.

    9. Re:quite some time ago? by Anonymous Coward · · Score: 0

      Have a look at "Certificate Patrol"

    10. Re:quite some time ago? by KiloByte · · Score: 1

      Except that there are multiple paths a certificate can be signed. For example, to remove CNNIC, you have to distrust Entrust as well.

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
  2. Why isn't this certificate revoked? by Anonymous Coward · · Score: 3, Insightful

    The article makes no mention of the signing certificate being revoked. Why hasn't the signing certificate been revoked?

    1. Re:Why isn't this certificate revoked? by Anonymous Coward · · Score: 1

      Why hasn't the signing certificate been revoked?

      Is there a working revocation scheme for such certificates? An attack against the the revocation protocol for SSL certificates was demonstrated quite some time ago. It just took one single byte to defeat the entire protocol. And last I checked the running of a signed java applet, the browser didn't even attempt to check for revocation. Are signatures on PDF files any easier to revoke? (And since when was PDF files an executable format?)

    2. Re:Why isn't this certificate revoked? by idontgno · · Score: 3, Interesting
      I imagine it wasn't reported for revocation because (A) some bureaucrat would have to publicly 'fess up to a nasty boo-boo, and (B) that might inconvenience legitimate users of that certificate chain and (C) make lots of extra work for the fellow bureaucrats to replace the poisonous certificate and publicize its replacement in the using public.

      So, yeah. Allowing the certificate to glimmering is obviously the better solution. There's no downside as long as no one uses the stolen certificate for evil purposes. And if they do, there's probably enough plausible deniability to buy time to do the revocation only when it's absolutely necessary, like buying fire insurance while the roof is burning.

      --
      Welcome to the Panopticon. Used to be a prison, now it's your home.
    3. Re:Why isn't this certificate revoked? by Anonymous Coward · · Score: 1

      What's the point when most clients (including browsers) don't look at revocation lists due to the latency it adds. OCSP stapling offers some hope, but is rarely used.

  3. Is there: +4, Informative by Anonymous Coward · · Score: 0, Funny

    a download site for Stuxnet.

    I'd like to make it a GNU Project .

    Yours In Novosibirsk,
    K. Trout, C.T.O.

    1. Re:Is there: +4, Informative by Anomalyst · · Score: 1

      Dear Mr. Trout,
      "Life is no way to treat an animal." would make an excellent epitaph.

      --
      There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
  4. "gaps in the security of digital certificates" by Monkier · · Score: 2

    So the gap is "the secret key must be kept secret"? I don't see that as a digital certificate failing. It's also the reason we have revocation lists.

    1. Re:"gaps in the security of digital certificates" by putaro · · Score: 2

      No, the gap is that there are too many trusted parties and when some idiot on the other side has a security breach it is affecting people everywhere.

  5. It is not theft by houghi · · Score: 4, Funny

    It is copyright infringement.

    --
    Don't fight for your country, if your country does not fight for you.
    1. Re:It is not theft by uufnord · · Score: 1

      Should I have modded you as funny? X.509 certificates don't contain copyright notices anywhere within them. I believe they would be treated as non-copyrightable, since they are statements of fact, and not creative works. So, no it's not theft, and it's not copyright infringement. It's merely "copied"..

      malware spreading via malicious PDF files is signed with a valid certificate which was copied from the Government of Malaysia...

  6. Revocation List? by Logarhythmic · · Score: 4, Informative

    Isn't this precisely what certificate revocation lists are for?

    --
    "Before criticizing someone, first walk a mile in his shoes. Then, you'll be a mile away... and you'll have his shoes."
    1. Re:Revocation List? by Anonymous Coward · · Score: 1

      Unfortunately, the stolen certificate in question had an invalid CRL, which means this certificate could not be revoked at all. This is also one of the mentioned 22 certificates with weak 512-bit key.

      In related news, the CA in question was revoked by major browser vendors exactly due to this bad practice.
      http://tech.slashdot.org/story/11/11/04/1539253/microsoft-mozilla-and-google-ban-malaysian-intermediate-ca

  7. I'm sure it'll be fine. We all need to ... by Anonymous Coward · · Score: 0

    Relax, don't do it. When you want to go to it.

    I don't read good.

  8. stolen digital certificate by microphage · · Score: 1

    How exactly do you go about stealing a digital certificate? Can you revoke the cert after the event? What happens to legitimate sites using the stolen cert?

  9. Sweet!!! by Anonymous Coward · · Score: 0

    Now I'll make some more $$ off of the dumb-asses who get their shit ass WinBlowz computers owned by going to infected pron links. Score!!!!

  10. Re:Malaysia sucks by udippel · · Score: 1

    Dear AC, don't worry.The mod who modded you down can hardly be blamed. He doesn't know about Dr. M, and he probably doesn't speak Bahasa Malaysia neither. So something was whooshing over her head.

  11. Makes virus detection tricky by jamesh · · Score: 1

    When faced with a virus that none of the existing tools detect, I open up Process Explorer, tell it to verify signatures, and then check for any currently loaded objects with a signature that can't be verified (or no signature). It's just one part of the investigation but it's certainly a good start.

    This increase in stolen certs is troubling.

    1. Re:Makes virus detection tricky by Anonymous Coward · · Score: 0

      This is why I use a HIPS that blocks everything by default unless manually whitelisted, even OS components. But sure this isn't for everyone.

  12. Asking the wrong question by ThatsNotPudding · · Score: 1

    The right question: why the fuck does the Agricultural Research and Development Institute of the Government of Malaysia even need a CA??

    1. Re:Asking the wrong question by heypete · · Score: 1

      They don't.

      A Malaysian CA was issuing bad certificates from their intermediate CA that was chained to Entrust. They were allowing weak, 512-bit RSA keys to be signed, as well as not including any certificate extensions (and thus the certificates were treated as valid for all purposes by many OSs and browsers, as opposed to being limited to only what the extensions stated). Entrust revoked the intermediate CA. Evidently the Malaysia CA also had broken CRL locations burned into the certs (or didn't include any CRL information, I don't quite recall), and

      Since the certificate had no extensions, it was usable as a code-signing certificate and used to sign malware. The same thing would could have happened if the bad guys managed to steal a regular code-signing cert and the revocation was broken.

  13. The certificate expired 29th September by Anonymous Coward · · Score: 0

    http://www.f-secure.com/weblog/archives/mardi-cert_malaysian.PNG

    How is this a 'Valid certificate' again ?