We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
78,785 News Articles

F-Secure finds malware signed with stolen digital certificate

The certifcate allowed the malicious software to appear legitimate when installed

Researchers from security vendor F-Secure have spotted a rare malicious software sample that carried a valid code-signing certificate from a Malaysian governmental institution.

A code-signing certificate is a kind of digital signature that ensures the authenticity and integrity of an application to be run on a computer. Malicious software programs often present fake digital signatures, but ones that are legitimate and attached to malware are rare, said Mikko Hypponen, chief research officer for F-Secure.

The certificate was signed by "anjungnet.mardi.gov.my," which is part of Malaysia's Agricultural Research and Development Institute. Hypponen said F-Secure contacted the organization, which then found that a Windows server responsible for generating the certificates had been hacked.

The organization said it was unsure how long the server may have been compromised, Hypponen said.

Hypponen said the malware using the certificate was a "backdoor," or an application that can steal information or download other programs to an infected machine. The malware was distributed by a PDF file that had been rigged to exploit a vulnerability in Adobe's Reader 8 application.

Obtaining the secret key isn't enough to generated a code-signing certificate, Hypponen said. An attacker would also have to know a password in order to generate a certificate. He said that could have been obtained by infecting one of the organization's computers with a keylogging program.

It is quite rare for malware to have a valid certificate, although the one associated with this malware is no good now since it expired at the end of September. Nonetheless, since the discovery, the secret key used to generate the certificate has been revoked.

Other components of the malware were also digitally signed, though not by the Malaysian government entity. Hyponnen said the other components were signed by "esupplychain.com.tw," an unknown entity.

Send news tips and comments to jeremy_kirk@idg.com


IDG UK Sites

Android One vs Android Silver vs Google Nexus: What is the difference?

IDG UK Sites

Apple updates MacBook Pro line-up: Price cuts & spec boosts for 6 MacBook Pro models

IDG UK Sites

Long live the internet fridge: the Internet of Things is coming

IDG UK Sites

How Prometheus' colourist Juan Ignacio Cabrera gave a tense, edgy feel to Chosen