With the massive Sony leaks (including their private keys/certificate), i was wondering:
How do major AVs deal with signed binaries? ie:
Does it influence their detecting ability of the signed malware? If so, how? For example:
- Do they check CRLs and get the binaries with revoked certificates under stronger scrutiny?
- Do they only check if the certificate was valid at the time of signature?
- If 1 or 2 is valid (ie certificate not revoked or binary signed when it was still valid), do the AV blindly accept as legit even if it's a well-known malware that already has it signature among most AV products?
It seems that windows rarely check CRLs and that it might sometimes be complex, inconvenient and expensive to revoke a certificate if it was widely used to sign legitimate binaries in the past. So if they do, is it worth it from the AV point of view?
The point of this question is mainly assessing this assertion from this article from 2012:
Malware authors are interested in signing installers and not just the drivers, because some antivirus solutions assume that digitally signed files are legitimate and don't scan them, said Bogdan Botezatu, a senior e-threat analyst at antivirus vendor BitDefender. "Additionally, signed modules are more likely to be included in whitelisting collections meaning, the chance of them being fully analyzed is lower and they remain undetected for longer period of times," Raiu said.
i don't know much about code-signing, so the problem might be more subtle, thank you for correcting me i i ask the wrong questions :)