We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

F-Secure finds malware signed with stolen digital certificate

The certifcate allowed the malicious software to appear legitimate when installed

Researchers from security vendor F-Secure have spotted a rare malicious software sample that carried a valid code-signing certificate from a Malaysian governmental institution.

A code-signing certificate is a kind of digital signature that ensures the authenticity and integrity of an application to be run on a computer. Malicious software programs often present fake digital signatures, but ones that are legitimate and attached to malware are rare, said Mikko Hypponen, chief research officer for F-Secure.

The certificate was signed by "anjungnet.mardi.gov.my," which is part of Malaysia's Agricultural Research and Development Institute. Hypponen said F-Secure contacted the organization, which then found that a Windows server responsible for generating the certificates had been hacked.

The organization said it was unsure how long the server may have been compromised, Hypponen said.

Hypponen said the malware using the certificate was a "backdoor," or an application that can steal information or download other programs to an infected machine. The malware was distributed by a PDF file that had been rigged to exploit a vulnerability in Adobe's Reader 8 application.

Obtaining the secret key isn't enough to generated a code-signing certificate, Hypponen said. An attacker would also have to know a password in order to generate a certificate. He said that could have been obtained by infecting one of the organization's computers with a keylogging program.

It is quite rare for malware to have a valid certificate, although the one associated with this malware is no good now since it expired at the end of September. Nonetheless, since the discovery, the secret key used to generate the certificate has been revoked.

Other components of the malware were also digitally signed, though not by the Malaysian government entity. Hyponnen said the other components were signed by "esupplychain.com.tw," an unknown entity.

Send news tips and comments to [email protected]


IDG UK Sites

Apple WWDC 2015 rumours: iOS 9, OS X 10.11, Apple TV & more

IDG UK Sites

Why I think the Apple Watch sucks and you'd be mad to buy it

IDG UK Sites

Kung Fury VFX behind-the-scenes: how Fido blew up everything for this year's most over-the-top film

IDG UK Sites

What will Apple launch at WWDC 2015, with one week to go? Apple TV, Macs, Beats Music, iOS 9, OS X 1......