Featured Articles

Nvidia GTX 980 reviewed

Nvidia GTX 980 reviewed

Nvidia has released two new graphics cards based on its latest Maxwell GPU architecture. The Geforce GTX 970 and Geforce GTX…

More...
Nvidia adjusts GTX 980 and GTX 970 pricing

Nvidia adjusts GTX 980 and GTX 970 pricing

It appears that Nvidia has been feeling the pulse of the market and took some note from comments regarding the original…

More...
iPhone 6 and 6 Plus reviews are up and they are good

iPhone 6 and 6 Plus reviews are up and they are good

Apple is dancing the same dance year after year. It releases the iPhone and two days before they start shipping it…

More...
Amazon announces three new tablets

Amazon announces three new tablets

Amazon has just released three new tablets starting with the $99 priced 6-inch Kindle Fire HD6. This is a 6-inch tablet…

More...
PowerColor TurboDuo R9 285 reviewed

PowerColor TurboDuo R9 285 reviewed

Today we will take a look at the PowerColor TurboDuo Radeon R9 285. The card is based on AMD’s new…

More...
Frontpage Slideshow | Copyright © 2006-2010 orks, a business unit of Nuevvo Webware Ltd.
Wednesday, 21 March 2012 11:16

Hackers nick digital certificate

Written by Nick Farrell



Insecurity expert warns to be careful where you sign


Kaspersky Lab has discovered that a recently distributed Trojan, Mediyes, was digitally signed using a stolen private signature key whose digital certificate was owned by Swiss firm Conpavi AG.

According to John Grimm of Thales e-Security what the situation shows is how digitally signed code is assessed more favorably by anti-virus vendors from a risk perspective, so stealing the key and creating a perfectly valid signature on the code helps further promulgate the nefarious Trojan before it can be detected.

He said that whenever evidence surfaces such as this, we worry that people will incorrectly assume that the concepts of digital signatures and key management are flawed. The problem is not the concept; the problem is that those responsible for the keys and the digital signature process are not following standards of due care. If the keys are not afforded proper protection, it's easy to find them, steal them and create “valid” signatures over maliciously modified code.

He  advises companies never to allow anyone to come into possession of the full plain text of a private or secret key. While the circumstances in this situation are still to become clear, the private key was indeed somehow compromised, which means someone was able to access it in full plain text.

While not listed as a standard of due care, best practice suggests encryption keys should be protected in high assurance hardware-- not software-- since it's an absolute failsafe way to ensure the keys are not exposed outside the protected boundary of a certified, tamper-proof device. The lesson learned here, once the dust has settled, is to ensure that keys involved in code signing are protected in dedicated hardware as opposed to being stored on more vulnerable host computers.


Nick Farrell

E-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it
blog comments powered by Disqus

 

Facebook activity

Latest Commented Articles

Recent Comments