Featured Articles

IHS teardown reveals Galaxy S5 BOM

IHS teardown reveals Galaxy S5 BOM

Research firm IHS got hold of Samsung’s new flagship smartphone and took it apart to the last bolt to figure out…

More...
Galaxy S5, HTC One M8 available selling well

Galaxy S5, HTC One M8 available selling well

Samsung’s Galaxy S5 has finally gone on sale and it can be yours for €699, which is quite a lot of…

More...
Intel lists Haswell refresh parts

Intel lists Haswell refresh parts

Intel has added a load of Haswell refresh parts to its official price list and there really aren’t any surprises to…

More...
Respawn confirms Titanfall DLC for May

Respawn confirms Titanfall DLC for May

During his appearance at PAX East panel and confirmed on Twitter, Titanfall developer Respawn confirmed that the first DLC pack for…

More...
KFA2 GTX 780 Ti Hall Of Fame reviewed

KFA2 GTX 780 Ti Hall Of Fame reviewed

KFA2 gained a lot of overclocking experience with the GTX 780 Hall of Fame (HOF), which we had a chance to…

More...
Frontpage Slideshow | Copyright © 2006-2010 orks, a business unit of Nuevvo Webware Ltd.
Wednesday, 21 March 2012 11:16

Hackers nick digital certificate

Written by Nick Farrell



Insecurity expert warns to be careful where you sign


Kaspersky Lab has discovered that a recently distributed Trojan, Mediyes, was digitally signed using a stolen private signature key whose digital certificate was owned by Swiss firm Conpavi AG.

According to John Grimm of Thales e-Security what the situation shows is how digitally signed code is assessed more favorably by anti-virus vendors from a risk perspective, so stealing the key and creating a perfectly valid signature on the code helps further promulgate the nefarious Trojan before it can be detected.

He said that whenever evidence surfaces such as this, we worry that people will incorrectly assume that the concepts of digital signatures and key management are flawed. The problem is not the concept; the problem is that those responsible for the keys and the digital signature process are not following standards of due care. If the keys are not afforded proper protection, it's easy to find them, steal them and create “valid” signatures over maliciously modified code.

He  advises companies never to allow anyone to come into possession of the full plain text of a private or secret key. While the circumstances in this situation are still to become clear, the private key was indeed somehow compromised, which means someone was able to access it in full plain text.

While not listed as a standard of due care, best practice suggests encryption keys should be protected in high assurance hardware-- not software-- since it's an absolute failsafe way to ensure the keys are not exposed outside the protected boundary of a certified, tamper-proof device. The lesson learned here, once the dust has settled, is to ensure that keys involved in code signing are protected in dedicated hardware as opposed to being stored on more vulnerable host computers.


Nick Farrell

E-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it
blog comments powered by Disqus

To be able to post comments please log-in with Disqus

 

Facebook activity

Latest Commented Articles

Recent Comments