Why a self-signed digital certificate (X.509) cannot be altered?

Question

I'm not experienced in code signing but I was thinking about this: as you know, there are various tools for self-signing digital certificate generation (as makecert from Windows or OpenSSL). Now, It would be great if a malware developer could sign his malware's code from a trusted CA. He can only sign it in two ways:

1. Pays a trusted CA to generate a certificate with wich he will sign his malware;
2. Creates a self-signed certificate where, for obvious reasons, the authority that release the certificate is equal to the subject's name

Particularly, the second point regards my question: if the algorithm to generate a digital certificate is known, I could write my own certificate generator to sign my application, where the Issuer is a well known CA's name; then I add the newly generated cert in the Trusted Root Certificate Authority (in Windows OS). Now, when someone opens the application, the certificate is installed in the TRCA and then the malware starts. The malware is signed from the certificate that has just been added and it seems that it comes from a well known source due to the CA's name. I know that, if it could be possible, the CA and all the cryptography stuff wouldn't exist and it would be very simple to generate a certificate on my own where the releaser is a CA. So my question is: why there's no way to generate a self-signed certificate where the Issuer is different from the Subject?

Answer 1

Yes, you can make a self-signed certificate with any subject name you want. It's easily doable with free tools. Getting a signing certificate with a fake subject name signed by a truthworthy issuer is another story - they take verification of identity fairly seriously.

Another thing that isn't easy (in fact assumed to be impossible) is to figure out the private key of the legitimate CA. So if you are faking a CA, you'll most likely end up making up a new public/private key pair and signing that. Any entity that explicity trusts a specific public key will NOT trust your fake CA (true for the MS certificate store).

What you cannot do - easily - is modify the Trusted Certificate store on a computer that you don't already have access to. This isn't an operation that is available from most web browsers - it takes at least user-level access, although some operating systems can be restricted further to administrator level access. In essence, to extend the realm of trust, you yourself must be trusted.

Which begs the question - if you've gotten access at this level to a machine - why bother signing the malware? Just install it and save yourself the headache of doing code signatures.

There, are, however two really interesting attacks in this area:

• Social Engineering - in many cases, when a user is browsing, the browser will prompt the user when an unknown CA is encountered - the user is asked to explicitly trust the signer, and if the user has the capability, the option is there to install the CA certificate as a trusted CA. So... there's all sorts of ways of setting up a site to helpfully advice the user to trust you.

• If it's not validated properly, you have a problem - the big famous one was FLAME, which used a fake Microsoft signing certificate - it wasn't validated properly and many servers did, in fact, upload malware.

Not the easiest attack - you really have to know a product and how it's doing certificate validation to get something like this through - but bad design/implementation can lead to flaws, so it's mostly about how much time the attacker can spend to find the hole.

Answer 2

This is by definition. A self-signed certificate is signed by the subject itself. This means a self-signed certificate is defined by having the same entry as issuer and subject.

As you ask for a certificate where the issuer is different to the subjet this is by definition not a self-signed certificate.

Also know that you cannot fake the issuer as the certificate is signed by the issuer and that means you need the private key of the issuer.

Answer 3

There is nothing that prevents you from saying you are anyone you want in a self-signed certificate. What keeps it secure is the signing itself. Verisign isn't identified by it saying in text that it is signed by Verisign. It is identified as being Verisign because users's computers come with a Trusted Root Certificate for Verisign which is used to verify the signature that Verisign places on the certificates they sign. The text is just there to aid looking up the certificate on the client so that the signature can be verified.

So in your case where you say "I'm verisign" and sign it yourself, a client that tries to validate the signature goes and looks up their Trusted copy of Verisign's cert (because that's what the signer is identified as) tries to validate the signature and the signature validation fails because you don't have Verisign's private key.