Can malware have signed code?
Many pieces of malware have been signed, including Stuxnet, and the malware recently bundled with CCleaner have been signed, in the case of Stuxnet this was probably done by stealing the signing certificate, whereas in the case of the CCleaner attack it seems it was done by infecting the build server, so that it would inject malware in before signing the release.
How can Microsoft guarantee that only Certificate Authorities (CAs) can create signed code?
The CAs do not directly create code, they issue certificates, which developers then use to sign their executables.
For example, if FooBar Widgets released an app, they could sign it with a certificate like this:
If your computer trusts the Root CA then it will trust the certicate for FooBar Widgets, and show the signed prompt for the program, instead of the unsigned one.
As such there are 4 main ways to try to get around this form of code signing:
- Break the signing scheme (like Flame did)
- Trick the CA into making a fake cert (More common in SSL certs)
- Steal the Signing Cert (Stuxnet style)
- Trick the company into signing your malware (CCLeaner style)