Malaysian Government signing key stolen

By

Used to sign trojan.

The Government of Malaysia has had a code signing certificate stolen and used to sign malware.

Malaysian Government signing key stolen

The breach was discovered after researchers at security firm F-Secure found a trojan signed by the certificate owned from the Government.

Officials from the Malaysian Agricultural Research and Development Institute told F-Secure the certificate was stolen "quite some time ago".

Credit: F-Secure

The signed trojan would not be flagged by risk mitigation warnings that alert users if unsigned applications were downloaded from the internet.

“In some of these cases, the certificate has been created by the criminals just for the purpose for signing malware. In other cases they steal code signing certificates (and their passphrases) so they can sign code as someone else,” CTO Mikko Hypponen said.

“It's not that common to find a signed copy of malware. It's even rarer that it's signed with an official key belonging to a government.”

The trojan spread via malicious PDF files that exploited Adobe Reader 8. The malware downloaded components from a server called worldnewsmagazines.org signed by www.esupplychain.com.tw.

Problems facing the PKI trust model have been demonstrated in a string of recent hacks of some of the 600 certificate authorities that are entrusted to sign digital certificates.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments

Top US diplomat impersonated with AI by unknown actor

Top US diplomat impersonated with AI by unknown actor

UK police arrest four over cyberattacks on M&S, Co-op and Harrods

UK police arrest four over cyberattacks on M&S, Co-op and Harrods

Google Gemini for Workspace vulnerable to prompt injection attacks

Google Gemini for Workspace vulnerable to prompt injection attacks

Log In

  |  Forgot your password?