Who's Online
There are currently, 76 guest(s) and 13 member(s) that are online.
You are Anonymous user. You can register for free by clicking here
Training Classes Calendar
|  |
Viruses and Digital Signatures Posted on Saturday, 06 March 2010 @ 07:29:21 EST Contributed by cdupuis
| Topic: Virus
Recently, Symantec received some malicious files which appeared to be signed by “Adobe Systems Incorporated”. On closer inspection, however, it was seen that the signature was just a ruse used by the malware author to give an air of legitimacy to the files. Virus writers are getting smarter and going that extra mile to digitally sign their files. Using this technique the malware authors could, for example, penetrate an environment where only signed files are allowed but the authenticity of the signature is not checked.
Although the files are signed, they are signed using an unauthenticated CA (Certificate Authority) which is masquerading as Verisign. A CA is a trusted third party that issues and signs the certificate and vouches for the authenticity of the file. Each CA should be registered and therefore recognized globally as a trusted signer. The signature on the certificate is verified by the signer’s public key.
What the malware authors have tried here is to create their own CA and attempt to use it to sign these malicious files. They chose a misleading name for their CA, namely "Verisign", but their private key used for signing will obviously be different from the authentic Verisign CA key. Therefore this renders their CA untrustworthy so that, while the file still has a valid signature, it is not from the real Verisign CA.
Also, although the file is correctly signed by a company called "Adobe Systems Incorporated," that company has been certified by their fake Verisign CA and therefore has no meaning or relation to the real "Adobe Systems Incorporated."
Shown below are the real and fake Verisign CA signed files. On the left you can see that the certificate chain is not trusted all the way to the root where as on the right side (a real Adobe file) the certification chain is trusted up to the root.


On Windows machines with User Access Control enabled, a warning similar to the one shown below will be displayed (warning that the publisher is unknown).

So, in a nutshell, creating “authentic-looking” certificates to make malicious files look legitimate is a trick which virus writers are employing to challenge today’s sophisticated security mechanisms. We have written about certificates being abused previously. The following blog article has more information: Phishing Toolkits Attacks are Abusing SSL Certificates.
So, play safe, and check the authenticity of the signature whenever one is present.
See original article on the Symantec Blog at: http://www.symantec.com/connect/blogs/viruses-and-digital-signatures
|  |
Login
Don't have an account yet? You can create one. As a registered user you have some advantages like theme manager, comments configuration and post comments with your name.
|
|
No Comments Allowed for Anonymous, please register |
|
Re: Viruses and Digital Signatures (Score: 1) by yanrikun on Wednesday, 05 May 2010 @ 02:21:52 EDT (User Info | Send a Message) | Never owned a bag in snakeskin before? Here is the perfect opportunity to join the cutting edge style. Some bags and accessories to try and snake skin, but below, the fabric is too light or artificial. Gucci Handbags [www.ebags-replicas.com] A quickarrest in May for the logo incorrect spacing shifted to theOutside, typographical errors or smudginess lightly. When you watch a monogram Gucci bag, the "Gshould all be the same proportion. ?Examine the seams. A bright watches is a great idea to liven up a dreary weather day and will ensure that all eyes are on you. Using watches with warm colors in the fall and the winter will brighten up and add pizzazz to any man��s winter ensemble. Cartier replica Watches [www.ereplicawatches.net] The description carry all originated in the 40s signifying its used as a shopper. These bags are perfect to hold all your necessary items as books, beachwear and others. Totes will eventually find their presence in boardrooms, boardwalks and beaches. Ladies MOP Diamond Dial Rolex Super President Among different models of Ladies watch, this model has also been quite popular. Its Italian made 18k yellow gold President bracelet, embedded with 232 diamonds, appears bold and powerful. Cheap Sunglasses [www.sunglassestrade.com] Accessories can make an extraordinary woman. But a silk watches for women ´swas not merely theaccessory, it is the voice of your very special status. Welcome to the world of brand watches. You delicate life begins here. Later, adding to its popularity, the new sapphire crystal was introduced, giving scratch resistance and waterproof security to the Datejust model.Now, it has become easier to own a masterpiece like Mens Rolex Datejust. Prada Handbags [www.ebags-replicas.com] What war worn in World Is Not Enough was Omega Seamaster Professional Chronometer, which could changed into hook. From then on, since people can only memorize short-term things and marketing done by watch producers, Omega Seamaster has replaced Rolex Submariner and become Bonds typical watch. Somewhere during that time, the benefits of having a logo and brand name to distinguish a product from its competitors was just being discovered, and Wilsdorf capitalized on this opportunity. Louis Vuitton Sunglasses> [www.sunglassestrade.com] For those who do not wear a long-term mechanical watches, should also have regular winding to make it machine-chip rotation. The Big Bang Purple Carat, Blue Carat and Orange Carat are making their debuts in both 18k red gold and black ceramic versions. Slightly smaller than the original Big Bang case diameter of 44.5mm, the "Carat" has 41mm case and a polished bezel set with topaz, amethysts or sapphires. Rolex replica Watches [www.ereplicawatches.net] Soon after AP released the Royal Oak City of Sails Chronograph to mark the success of Team Alinghi. Since then AP has also become involved in formula one racing and in 2004 honored juan pablo montoya with a limited edition piece followed in 2006 with a watch honoring Rueben Barrichello. In 1969, see the first power of quartz was available on the market. Quartz has special properties so when it is in the form ofa certain way and subject to an electric field, it bends. When the field is removed the crystal generates an electric field of its own because it returns to its original form. Replica Sunglasses [www.sunglassestrade.com] They also feature unique design which suits the needs of the athletes. Diving wa
Read the rest of this comment... |
|
|
|