Criminals Obtain Code-Signing Certificates Using Stolen Corporate IDs

Malware authors have for some time been using code-signing certificates for their malicious payloads so they can sneak past enterprise anti-malware tools. But contrary to popular belief, not all of the certificates that are being used to distribute malware are stolen from their legitimate owners.

New research by Recorded Future shows that a growing number of code-signing certificates in the cyber underground are actually being created on demand for specific buyers by Dark Web vendors using stolen corporate identities. Each certificate is unique to the buyer and is usually delivered within two- to four days.

The certificates, available for prices ranging from $299 to $1,599, are being issued by reputable companies such as Symantec, Comodo, and Thawte, and are proving very effective at malware obfuscation, Recorded Future said in a report this week.

"We do not have information on what percentage of all certificates circulating in the Dark Web were obtained using compromised corporate credentials," says Andrei Barysevich, director of advance collection at Recorded Future. "However, considering the malicious intent of hackers when utilizing such certificates, it is safe to assume that a high proportion of them were obtained fraudulently." 

The use of code-signing certificates to distribute malware is not new. But more malware authors have recently begun resorting to the tactic as a way to distribute malware.

Organizations use code-signing certificates to authenticate their software and protect it against tampering. The certificates give users a way to verify the identity of the publisher and the integrity of the code. Malware that has been digitally signed with a valid code-signing certificate can be hard to spot. Most anti-malware tools and browsers assume the payload can be trusted because it is from a trusted publisher.

Security vendor Venafi last October reported that a six-month investigation it had conducted showed a thriving market for code signing certificates on the Dark Web.

The research, conducted for Venafi by the Cyber Security Research Institute, showed such certificates to be more expensive even than stolen US passports, credit cards, and even handguns. Venafi found that stolen code-signing certificates can fetch up to $1,200 in underground markets and are being used in a wide range of malicious activity including man-in-the-middle attacks, malware obfuscation, website spoofing, and data exfiltration.

Recorded Future says its investigation shows cybercriminals are currently offering new code-signing certificates and domain-name registration services with SSL certificates. The vendors of these services register the counterfeit certificates using stolen information belonging to legitimate organizations. There is little indication that impacted companies are aware their identity data is being used to illegally obtain code-signing certificate for use by malware authors.

Recorded Future researchers first observed a Dark Web vendor selling such certificates in 2015. Since then, they have seen at least three new actors selling code-signing certificates obtained from major CAs using stolen corporate credentials. One of the vendors has moved on to other activities while the remaining two are currently continuing to sell counterfeit certificates primarily to Russian threat actors.

One of the vendors specializes only in Class 3 certificates that do not support the so-called Extended Validation (EV) assurance, while the other sells EV certificates as well, Recorded Future said. The basic certificates without EV assurance are available for $600 from the vendors, or twicenthe $295 that an organization would normally pay for a code-signing certificate for legitimate use.

A threat-actor that wants to buy a high-assurance version of a code-signing certificate can get one for $1,599 — a 230% markup compared to the price of an authenticate certificate, Recorded Future said. A fully authenticated domain with EV SSL encryption and code-signing support costs $1,799 currently.

"Surprisingly, across the vast number of cybercriminal communities we monitor, we only identified two vendors of compromised certificates, both of whom are Russian-speaking," Barysevich says. "They were, however, offering their products indiscriminately to any willing buyer."

The cost associated with these certificates means they are likely to be of most interest to hackers with specific motives in mind, he says. "Attackers who are engaged in targeted campaigns, such as corporate espionage or bank infiltration, are the most likely buyers of counterfeit code-signing certificates," Barysevich says.

"That being said, there are many applications of compromised SSL EV certificates, and they could be used in a more widespread malware campaign."

Related Content:

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.