On 06/22/2011 09:40 AM, Steven Bellovin wrote:
http://www.darkreading.com/advanced-threats/167901091/security/application-security/231000129/malware-increasingly-being-signed-with-stolen-certificates.html
Not surprising to most readers of this list, I suspect...
The interesting thing is that code signing schemes have been around for
decades but 2010 is the first time malware even bothered to steal
signing keys. :-)
What happens if the bad guy just strips the signature? What are the
circumstances under which an OS or user+OS will refuse to run code that
just isn't signed at all?
64-bit drivers for Windows Vista and later. Some locked down "walled
garden" environments, almost always jail-breakable in practice.
When does the name of the party that signed it actually matter?
What if the bad guy signs the malware with some unrelated party's cert?
When any valid signature will do, the effective security provided by the
code signing scheme decreases exponentially with the total number of
signing certificates issued. MSIE displays the name to the user when
prompting to run ActiveX controls. The user is expected to be able to
determine if the name on the control is correct and refuse to run it if not.
Even if the correct party is required to have signed the code, the bad
guy can commonly redistribute an older (properly signed) version with a
security hole which he then exploits. Thus revocation is even more
critical than with identity certificates.
Code signing. Occasionally useful.
- Marsh
_______________________________________________
cryptography mailing list
cryptography@randombit.net
http://lists.randombit.net/mailman/listinfo/cryptography
