Featured Articles

TSMC: Volume production of 16nm FinFET in 2H 2015

TSMC: Volume production of 16nm FinFET in 2H 2015

TSMC has announced that it will begin volume production of 16nm FinFET products in the second half of 2015, in late…

More...
AMD misses earnings targets, announces layoffs

AMD misses earnings targets, announces layoffs

AMD has missed earnings targets and is planning a substantial job cuts. The company reported quarterly earnings yesterday and the street is…

More...
Did Google botch the Nexus 6 and Nexus 9?

Did Google botch the Nexus 6 and Nexus 9?

As expected, Google has finally released the eagerly awaited Nexus 6 phablet and its first 64-bit device, the Nexus 9 tablet.

More...
Gainward GTX 970 Phantom previewed

Gainward GTX 970 Phantom previewed

Nvidia has released two new graphics cards based on its latest Maxwell GPU architecture. The Geforce GTX 970 and Geforce GTX…

More...
EVGA GTX 970 SC ACX 2.0 reviewed

EVGA GTX 970 SC ACX 2.0 reviewed

Nvidia has released two new graphics cards based on its latest Maxwell GPU architecture. The Geforce GTX 970 and Geforce GTX…

More...
Frontpage Slideshow | Copyright © 2006-2010 orks, a business unit of Nuevvo Webware Ltd.
Wednesday, 21 March 2012 11:16

Hackers nick digital certificate

Written by Nick Farrell



Insecurity expert warns to be careful where you sign


Kaspersky Lab has discovered that a recently distributed Trojan, Mediyes, was digitally signed using a stolen private signature key whose digital certificate was owned by Swiss firm Conpavi AG.

According to John Grimm of Thales e-Security what the situation shows is how digitally signed code is assessed more favorably by anti-virus vendors from a risk perspective, so stealing the key and creating a perfectly valid signature on the code helps further promulgate the nefarious Trojan before it can be detected.

He said that whenever evidence surfaces such as this, we worry that people will incorrectly assume that the concepts of digital signatures and key management are flawed. The problem is not the concept; the problem is that those responsible for the keys and the digital signature process are not following standards of due care. If the keys are not afforded proper protection, it's easy to find them, steal them and create “valid” signatures over maliciously modified code.

He  advises companies never to allow anyone to come into possession of the full plain text of a private or secret key. While the circumstances in this situation are still to become clear, the private key was indeed somehow compromised, which means someone was able to access it in full plain text.

While not listed as a standard of due care, best practice suggests encryption keys should be protected in high assurance hardware-- not software-- since it's an absolute failsafe way to ensure the keys are not exposed outside the protected boundary of a certified, tamper-proof device. The lesson learned here, once the dust has settled, is to ensure that keys involved in code signing are protected in dedicated hardware as opposed to being stored on more vulnerable host computers.


Nick Farrell

E-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it
blog comments powered by Disqus

 

Facebook activity

Latest Commented Articles

Recent Comments