Security loopholes aren’t a hacker’s only gateway to infecting a system. Sometimes legitimate certificates spread malware, remaining a threat for years. This type of threat is not going away anytime soon.
So, what is a certificate? Why are they important? Who is abusing them and for what reason? Read on to find out:
Certificates are a type of machine identity that are used to cryptographically sign executable code, documents and even websites. They prove that a machine, whether it’s code, a website or application, can be trusted to be secure.
Why are Certificates Important?
Applications that use a certificate are seen as more trustworthy by users. Trusted applications will not be stopped by antivirus or anti-malware technologies. Trusted websites are more likely to be used for sensitive actions, such as online banking.
Certificates are considered secure because they use Public Key Infrastructure (PKI). PKI is an asymmetric system, using two keys to encrypt communications; public and private keys. A Public key is used to encrypt data, whether that be on the user’s browser, data, or part of a message to be sent. Private Keys are then used to decrypt the data that was encrypted by the Public Key, once it arrives at the website or server. This system is considered secure because only the Private key can decrypt the Public Key data.
TLS Certificates as an Example
A TLS (Transport Layer Security) certificate contains the Public Key of a website, which allows the user’s information to be encrypted and sent to the website, making a session with the website secure. The website then decrypts the secure session data using the private key.
If an organization wants a secure website that uses encryption, then a certificate needs to be obtained.
Obtaining this gives the website the green lock that most non-technical users are familiar with.
In general, TLS Certificates are used to prevent malicious websites from pretending to be legitimate websites. Attackers can create fake websites to steal credentials and/or deliver malware.
Digital Certificates are primarily used to ensure that software is legitimate and not malware, helping non-technical users to easily identify malicious internet properties.
Certificate Authorities (CAs) and Software Companies
Sticking with the TLS Certificate example, Certificate Authorities are entities that issue TLS certificates and act as a trusted (approved) third party. CAs are trusted because they require payment and proof of identity to tie the code, document, or application to the legitimate organization. They verify that the Certificate actually belongs to the person, organization, or entity that is noted in the certificate.
Software companies do the same for their own software; they sign and certify their code to prove that it belongs to them. The aim is to prevent malicious attackers from masquerading malware as legitimate software.
CAs and Software Companies on Attackers Hit Lists
Getting malware signed by a legitimate company, or getting a website signed by a trusted CA, is a top priority for malicious attackers. If they can create their own ‘legitimate’ certificates that others trust, they can run malicious code or malicious websites that are seen as ‘trusted.’ This allows malicious attackers to run code that would not be possible without the certificate.
It is much easier for an attacker to steal a certificate than attempt to bypass anti-virus, application whitelisting, intrusion prevention and all the other tools defenders have. With a certificate, the malware is allowed to run in a trusted state. Bypassing these technologies can save a cybercriminal organization considerable development time and money.
All the benefits above mean attackers are well-practiced at targeting certificate authorities and software companies.
Cybercriminals Dedicated to Stealing Trusted Certificates
The benefit of having legitimate certificates for their malware is so great that there are criminal organizations dedicated solely to stealing certificates and selling them to other cybercriminals. These criminal organizations have now even created malware designed just to steal digital certificates.
Other Tricks that Help Attackers
Antivirus software can require high processing power, due to the in-depth nature of scanning. In order to save processing power, anti-virus software can decide not to scan digitally certified software, thus de-prioritizing them. Attackers are very aware of this and will sign their own malware similar to known trusted software companies in order to avoid examination by anti-virus software.
Attacks Not Stopping Any Time Soon
Digital certificates are extremely valuable to attackers, allowing them to bypass ever-expanding defensive technology. Unsurprisingly, these attacks are expected to remain extremely popular for the foreseeable future.
Florin Lazurca is head of technical marketing for machine identity security at CyberArk.
