AV detection of signed malware

Question

With the massive Sony leaks (including their private keys/certificate), i was wondering:

How do major AVs deal with signed binaries? ie:

Does it influence their detecting ability of the signed malware? If so, how? For example:

1. Do they check CRLs and get the binaries with revoked certificates under stronger scrutiny?
2. Do they only check if the certificate was valid at the time of signature?
3. If 1 or 2 is valid (ie certificate not revoked or binary signed when it was still valid), do the AV blindly accept as legit even if it's a well-known malware that already has it signature among most AV products?

It seems that windows rarely check CRLs and that it might sometimes be complex, inconvenient and expensive to revoke a certificate if it was widely used to sign legitimate binaries in the past. So if they do, is it worth it from the AV point of view?

The point of this question is mainly assessing this assertion from this article from 2012:

Malware authors are interested in signing installers and not just the drivers, because some antivirus solutions assume that digitally signed files are legitimate and don't scan them, said Bogdan Botezatu, a senior e-threat analyst at antivirus vendor BitDefender. "Additionally, signed modules are more likely to be included in whitelisting collections meaning, the chance of them being fully analyzed is lower and they remain undetected for longer period of times," Raiu said.

i don't know much about code-signing, so the problem might be more subtle, thank you for correcting me i i ask the wrong questions :)

Answer 1

How do major AVs deal with signed binaries? ie:

Does it influence their detecting ability of the signed malware? If so, how? For example:

Do they check CRLs and get the binaries with revoked certificates under stronger scrutiny?
Do they only check if the certificate was valid at the time of signature?
If 1 or 2 is valid (ie certificate not revoked or binary signed when it was still valid), do the AV blindly accept as legit even if

it's a well-known malware that already has it signature among most AV products?

Antivirus is a special kind of application, and the answer to your question is heavily implementation-dependent. There is no such thing as standard implementation for antivirus, each vendor have their own set of (usually patented) detection technology, and also continuously borrow (reverse engineer) from industry leaders. I'm only going to discuss major antivirus I know about on Windows platform.

Short answer to your question: Yes, code signing does influence most antivirus products, in one way or other.

For example, the signer "Microsoft Windows" and "Microsoft Windows Component Publisher" is usually hardcoded into the scan engine. This saves scan time and avoid any false positives on system files (which usually cause catastrophic damages). Some poorly implemented scan engines have a very high false positive rate, and heavily relies on white lists and digital signatures, but those from major vendor is usually better.

For stolen certificates, their serial number or hash is usually added to the antivirus vendor's database, which will then be downloaded to customer's computer in the next few hours. So major antivirus vendor in some way manage their own set of CRLs, to increase control and avoid scan slowdowns.

If a file signed by a stolen certificate is detected, most product would mark it as highly suspicious, no matter what the file content actually is.

Other valid signatures may decrease an executable file's score when they are being scanned by a heuristic engine, which may have an influence on the final verdict.

What if a malware is signed by a newly stolen certificate not known to the antivirus vendor? That really depends on which antivirus you're using and which company the stolen certificate belongs to. If you're able to sign a malware with Microsoft Windows Component Publisher, then I believe most antivirus would give it a green light. Major vendors like Intel or Adobe could have also been added to trust database.

Although rare, some antiviruses do not check for certificate at all, they only exclude file using white lists.

Answer 2

Source:http://blogs.mcafee.com/mcafee-labs/signed-malware-you-can-runbut-you-cant-hide

It’s been more than a year since McAfee became an Intel company, and the team and I have been privileged to be a part of designing and developing our DeepSAFE technology, as well as Deep Defender, the first available product that leverages this advancement. Recent threats in the news validate what we’ve been working on, and this blog serves an update to our followers.

Signed Malware Prevalence Digitally signed malware has received a lot of media attention recently. Indeed more than 200,000 new and unique malware binaries discovered in 2012 have valid digital signatures. Unique Malicious Binares Discovered With Valid Digital Signatures (cumulative starting Jan 2012) Source: McAfee Labs Sample Database

Why Sign? Attackers sign malware in an attempt to trick users and admins into trusting the file, but also in an effort to evade detection by security software and circumvent system policies. Much of this malware is signed with stolen certificates, while other binaries are self-signed or “test signed.” Test signing is sometimes used as part of a social engineering attack.

Test Signing Test signing is particularly useful to attackers on 64-bit Windows, on which Microsoft enforces driver signing. By default such drivers will not load. However, Microsoft provides developers with the means of disabling this policy, and malware authors have learned to do the same. Rootkits on 64-bit Windows–such as Necurs used by Banker, Advanced PC Shield 2012, and Cridex–use this approach to compromise the operating system. To combat this, Deep Defender Version 1.0.1 blocks test-signed drivers by default, while allowing ePO administrators to selectively exclude in-house kernel driver developer’s systems as necessary.

This is just one layer of protection, of course. Security is about “defense in depth,” from network to silicon. Real-time memory monitoring allows Deep Defender to identify the Necurs rootkit as it attempts to compromise the kernel.

Trying to Hide Being able to observe transient events in memory allows DeepSAFE to get past obfuscated file views that challenge traditional antivirus solutions. Case in point is the Mediyes Trojan referenced in the aforementioned press articles. A quick check of our sample database shows more than 7,000 unique binaries in this family. Yet memory rules written over a year ago to cover rootkit techniques are able to proactively identify the latest signed attack, even as a zero day.

After the attacks were known, the certificate was revoked

More to Come For some time we’ve seen malicious payloads that attempt to steal digital certificates for nefarious purposes, and we are likely seeing the fruits of that labor. With so much malware online, we are sure to see this trend of signed malware continue and increase. P.S. Deep Defender Version 1.0.1 is currently in beta and is expected to hit the market in Q2. If you’re interested in helping protect the world beyond the OS, we’re hiring.