English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

A Web of (Mis)Trust?

Kurt Baumgartner
Kaspersky Lab Expert
Posted March 23, 18:07  GMT
0.3
 

At our international press tour held in Moscow in early February, we spoke about the dissolution of trust on the internet and discussed the possibility of Certificate Authority subversion and the impact of abused digital certificates.

Our speculation was partly driven by the abuse of trust that Kaspersky Lab monitored and prevented by the stolen Stuxnet digital certificates.

This unfortunate moment is arriving sooner than we wanted. This past week, another concrete example of the very foundation of trust on the web was shaken with the final coordination of an effort between a compromised Certificate Authority and web browser providers. The compromised Certificate Authority and browser developers needed to blacklist a set of digital certificates for high value sites that malicious attackers issued for their own use. The end result is that attackers assumed the credibility of some major web presences with the assurance of the Certificate Authority. Mozilla provided brief description of impact: "Users on a compromised network could be directed to sites using the fraudulent certificates and mistake them for the legitimate sites. This could deceive them into revealing personal information such as usernames and passwords. It may also deceive users into downloading malware if they believe it's coming from a trusted site."

What does that mean to you? Well, a short list of some of the impacted sites include:
login.live.com
mail.google.com
www.google.com
login.yahoo.com (3 certificates)
login.skype.com
addons.mozilla.org
"Global Trustee"

In a hypothetical scenario, you may have received an email with a link that you clicked on, or your browser may have been redirected to what appeared to be one of these sites. The browser indicated that it trusts the site, so you login with your user and pass. For some reason, you get redirected and login again to the site. At this point, a part of your online identity and access to your email or IM is compromised by an attacker. Again, this is purely hypothetical.

In followup to the event, a crlwatch project has been announced within a corresponding lengthy writeup on the technical matters of the incident.

The crlwatch project itself will help monitor the revocation of certs in response to breaches like this one.

More data is being provided as I write this post. It will be updated as more details come in.


3 comments

Oldest first
Threaded view
 

Eagle

2011 Mar 25, 19:01
1
 

How can an antivirus detect them as a malware if an application has a certificate? Does it mean that...

How can an antivirus detect them as a malware if an application has a certificate? Does it mean that malware could not be prevented in the years to come?

Reply    

Kurt Baumgartner

2011 Mar 29, 15:50
0
 

Re: antivirus detect them as a malware?

Hi Eagle!

First, the certs related to this incident were SSL certs and could not have been used to sign executables that would be whitelisted.

Nonetheless, the concept poses an interesting dilemma - we did see the issue of truly stolen certificates arise with the Stuxnet executables (we have seen similar fakes with other fakeav, bot and spyware executables). Remember, they were from major semiconductor manufacturers and would be difficult to immediately revoke:
http://www.securelist.com/en/blog/271/Myrtus_and_Guava_Episode_2

But regardless of the stolen, legitimate certs, antimalware products were and are still able to detect the signed stuxnet malcode. It may buy authors some time in targeted scenarios, but there are many ways for antimalware companies to handle anomalies that may appear in reference to their whitelisting program - behavioral, emulated, heuristics, statistical based, etc. Partly because security companies are not completely bound to respect the legitimacy of a given digital certificate and have many tools for identification at their disposal.

In other "cheap" scenarios, malware distributors copy and paste digital signatures from legitimate applications onto their own malcode. These are easily ignored by antimalware products and sometimes aid in malware detection.

Malware will be prevented for years to come. :)

Reply    

Eagle

2011 Mar 31, 18:39
0
 

Amazing!

woow...thanks for your clear explanation..

Reply    
If you would like to comment on this article you must first
login


Bookmark and Share
Share

Related Links