Stolen D-Link digital certificate malware 




Stolen D-Link digital certificate malware



Noredine BAHRI
Noredine BAHRI
  • Technical Writer
  • Entrepreneur
  • Founder and CEO
  • Developer
  • Blogger and IT Analyst
2018-07-09 16:27:55

| Share
| Share
| Share
Stolen D-Link digital certificate malware

Digitally signed malware has become much more common in recent years to mask malicious intentions.

Security researchers have discovered a new malware campaign misusing stolen valid digital certificates from Taiwanese tech-companies, including D-Link, to sign their malware and making them look like legitimate applications.

As you may know, digital certificates issued by a trusted certificate authority (CA) are used to cryptographically sign computer applications and software and are trusted by your computer for execution of those programs without any warning messages.

However, malware author and hackers who are always in search of advanced techniques to bypass security solutions have seen been abusing trusted digital certificates in recent years.

Hackers use compromised code signing certificates associated with trusted software vendors in order to sign their malicious code, reducing the possibility of their malware being detected on targeted enterprise networks and consumer devices.

Security researchers from ESET have recently identified two malware families, previously associated with cyberespionage group BlackTech, that have been signed using valid digital certificates belonging to D-Link networking equipment manufacturer and another Taiwanese security company called Changing Information Technology.

The first malware, dubbed Plead, is a remotely controlled backdoor designed to steal confidential documents and spy on users.

The second malware is also a related password stealer designed to collect saved passwords from Google Chrome, Microsoft Internet Explorer, Microsoft Outlook, and Mozilla Firefox.

Researchers notified both D-link and Changing Information Technology about the issue, and the companies revoked the compromised digital certificates on July 3 and July 4, 2018, respectively.

Since most antivirus software fails to check the certificate's validity even when companies revoke the signatures of their certificates, the BlackTech hackers are still using the same certificates to sign their malicious tools.

"The ability to compromise several Taiwan-based technology companies and reuse their code-signing certificates in future attacks shows that this group is highly skilled and focused on that region," the researchers said.

It is not the first time when hackers have used valid certificates to sign their malware. The infamous Stuxnet worm that targeted Iranian nuclear processing facilities in 2003 also used valid digital certificates.

Also, the 2017 CCleaner hack, wherein hackers replaced the original CCleaner software with the tainted downloads, was made possible due to digitally-signed software update.

click the next for more ...
Alert ! Godaddy Web hosting server hack
Alert ! Godaddy Web hosting server hack
Alert ! Godaddy Web hosting server hack

.
Hacker Leaked Celebrities Naked Photos and  Gets 8 Months check the story!
Hacker Leaked Celebrities Naked Photos and Gets 8 Months check the story!

The fourth celebrity hacker—who was charged earlier this year with hacking into over 250 Apple iCloud accounts belonged to Jennifer Lawrenc


Hacker Leaked Celebrities Naked Photos and  Gets 8 Months check the story!
Hacker Leaked Celebrities Naked Photos and Gets 8 Months check the story!

The fourth celebrity hacker—who was charged earlier this year with hacking into over 250 Apple iCloud accounts belonged to Jennifer Lawrenc


Hacker Leaked Celebrities Naked Photos and  Gets 8 Months check the story!
An Interview Question on Spring

Spring Singletons are not Java Singletons. Let's go over the important differences between them and how Spring singletons interact within containe


Hacker Leaked Celebrities Naked Photos and  Gets 8 Months check the story!
Introducing Android 9 Pie

After more than a year of development and months of testing by early adopters, we're ready to launch Android 9 Pie, the latest release of Android,


Hacker Leaked Celebrities Naked Photos and  Gets 8 Months check the story!
7 company will never see another dollar from you

7 / Terminix : basilcinnamonchives  said “My roommate at the time worked on a farm. We were aware of the possiblity he could bring fle


Hacker Leaked Celebrities Naked Photos and  Gets 8 Months check the story!
7 Absolute Weirdest Wedding Dresses Ever

There are only few occasions in life when your'e the center of attention and everybody's celebrating you. One of these occasions is, of course



© 2013-2018 best of geeks. All rights reserved.