This article has been indexed from E Hacking News – Latest Hacker News and IT Security News
Google researchers have identified malware developers generating malformed code signatures that appear to be valid in Windows to bypass security software.
This technique is actively used to spread OpenSUpdater, a family of unwanted software known as riskware, which plants advertisements into targets’ browsers and installs other redundant programs on their machines.
Researchers believe the financially motivated threat actors behind OpenSUpdater will attempt to infect as many devices as possible and are specifically targeting US citizens who are looking to download game cracks and other pirated software.
Novel approach
Last month, security researcher Neel Mehta from Google Threat Analysis Group (TAG) spotted that the creators of an unwanted software known as OpenSUpdater began signing their packages with valid but purposely malformed certificates, accepted by Windows but refused by OpenSSL.
By disrupting OpenSSL’s certificate parsing, some security systems would
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: Malware Creators Use Malformed Certificates To Trick Windows Validation