I'm not experienced in code signing but I was thinking about this: as you know, there are various tools for self-signing digital certificate generation (as makecert from Windows or OpenSSL). Now, It would be great if a malware developer could sign his malware's code from a trusted CA. He can only sign it in two ways:
- Pays a trusted CA to generate a certificate with wich he will sign his malware;
- Creates a self-signed certificate where, for obvious reasons, the authority that release the certificate is equal to the subject's name
Particularly, the second point regards my question: if the algorithm to generate a digital certificate is known, I could write my own certificate generator to sign my application, where the Issuer is a well known CA's name; then I add the newly generated cert in the Trusted Root Certificate Authority (in Windows OS). Now, when someone opens the application, the certificate is installed in the TRCA and then the malware starts. The malware is signed from the certificate that has just been added and it seems that it comes from a well known source due to the CA's name. I know that, if it could be possible, the CA and all the cryptography stuff wouldn't exist and it would be very simple to generate a certificate on my own where the releaser is a CA. So my question is: why there's no way to generate a self-signed certificate where the Issuer is different from the Subject?