Google Warns of a New Way Hackers Can Make Malware Undetectable on Windows

Cyber Security

Cybersecurity researchers have disclosed a novel technique adopted by threat actors to deliberately evade detection with the help of malformed digital signatures of its malware payloads.

“Attackers created malformed code signatures that are treated as valid by Windows but are not able to be decoded or checked by OpenSSL code — which is used in a number of security scanning products,” Google Threat Analysis Group’s Neel Mehta said in a write-up published on Thursday.

The new mechanism was observed to be exploited by a notorious family of unwanted software known as OpenSUpdater that’s used to download and install other suspicious programs on compromised systems. Most targets of the campaign are users located in the U.S. who are prone to downloading cracked versions of games and other grey-area software.

The findings come from a set of OpenSUpdater samples uploaded to VirusTotal at least since mid-August.

Malware Undetectable on Windows

Not only are the artifacts signed with an invalid leaf X.509 certificate that’s edited in such a manner that the ‘parameters’ element of the SignatureAlgorithm field included an End-of-Content (EOC) marker instead of a NULL tag. Although such encodings are rejected as invalid by-products using OpenSSL to retrieve signature information, checks on Windows systems would permit the file to be run without any security warnings.

Enterprise Password Management

“This is the first time TAG has observed actors using this technique to evade detection while preserving a valid digital signature on PE files,” Mehta said.

“Code signatures on Windows executables provide guarantees about the integrity of a signed executable, as well as information about the identity of the signer. Attackers who are able to obscure their identity in signatures without affecting the integrity of the signature can avoid detection longer and extend the lifetime of their code-signing certificates to infect more systems.”

Products You May Like

Articles You May Like

GitLab grew up in GitHub’s shadow — now it’s worth twice what Microsoft paid for its chief rival
Redmi Smart TV X (2022) Confirmed to Feature 120Hz Display Ahead of October 20 Launch
Instacart acquires smart checkout startup Caper AI for $350M
Here’s How Apple’s ‘Buy Now, Pay Later’ Service Will Work
Apple listened to its most loyal customers and fixed its laptop problems from the last five years

Leave a Reply

Your email address will not be published. Required fields are marked *