2

When I run an exe that has signed code on Windows, I feel kind of safe. But I wonder if walware can have signed code? According this this article

Microsoft Authenticode® is a technology that can help ensure the source of code. It does not ensure that code is safe to run, but it can ensure that the code is associated with an entity in a trust chain.

Can walware's hacker just create a signed code for themselves to trick Windows that this software has signed code? How can Microsoft guarantee that only Certificate Authorities (CAs) can create signed code?

12

Can malware have signed code?

Yes.

Many pieces of malware have been signed, including Stuxnet, and the malware recently bundled with CCleaner have been signed, in the case of Stuxnet this was probably done by stealing the signing certificate, whereas in the case of the CCleaner attack it seems it was done by infecting the build server, so that it would inject malware in before signing the release.

How can Microsoft guarantee that only Certificate Authorities (CAs) can create signed code?

The CAs do not directly create code, they issue certificates, which developers then use to sign their executables.

For example, if FooBar Widgets released an app, they could sign it with a certificate like this:

Root CA
   Intermediate CA
       FooBar Widgets

If your computer trusts the Root CA then it will trust the certicate for FooBar Widgets, and show the signed prompt for the program, instead of the unsigned one.

As such there are 4 main ways to try to get around this form of code signing:

  • Break the signing scheme (like Flame did)
  • Trick the CA into making a fake cert (More common in SSL certs)
  • Steal the Signing Cert (Stuxnet style)
  • Trick the company into signing your malware (CCLeaner style)

References

  • So... the signed code system is not really trustful - or it's useless? – 123iamking Dec 28 '17 at 1:07
  • 4
    It acts as another layer of defence, and coupling with a small set of trusted CAs, or pined certs like for android apps can make attacking even harder. – jrtapsell Dec 28 '17 at 1:11
  • On the negative side, in places where it is made mandatory it can be used to lock people out of running their own code on their own devices. – jrtapsell Dec 28 '17 at 1:12
  • Ok, so what I understand is: signed code make it hard for malware, but not impossible. – 123iamking Dec 28 '17 at 1:14
  • Yes, it means you don't just have to make malware, but then somehow get it signed also. – jrtapsell Dec 28 '17 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.