Legit digital certificates mask some malware, McAfee warns

October 05, 2013

McAfee research indicates that a steep rise in the amount of malware signed with legitimate digital certificates—not forged or stolen ones—is a growing threat that raises the question whether there should be some kind of "certificate reputation services" or other method to stop certificate abuse. Malware signed with legitimate certificates has soared since 2010 when roughly 1.3 percent of a sample set was found signed that way, according to McAfee. This roughly doubled to 2.9 percent in 2011, then rose to 6.6 percent in 2012. Though the rate is slightly lower so far this year, the total amount of certificate abuse continues to grow because the amount of new malware roughly doubles every year. Sudden, recent emergence Speaking at the company's annual user conference in Las Vegas last week, David Marcus, director of advanced research and threat intelligence, said McAfee Labs also found that legitimately signed Android malware, almost nonexistent in 2010, grew to be about 7 percent of all Android malware in 2012 and today constitutes 24 percent. "The certificates aren't actually malicious—they're not forged or stolen, they're abused," said Marcus. This means the attacker has gone out and gotten a legitimate certificate typically from a company associated with a top-root Certificate Authority such as Comodo, Thawte, or VeriSign. The attacker uses this legitimate certificate to sign malware code in order to be able to fool security defenses such as whitelisting or sandboxing, he said. To read this article in full or to leave a comment, please click here

Link: http://www.pcworld.com/article/2052587/legit-digital-certificates-mask-some-malware-mcafee-warns.html#tk.rss_all