| Adobe's code signing certificate has been stolen So it appears that a build server at Adobe was compromised, and the criminals managed to make off with a code-signing certificate bearing a shiny "Adobe Systems Inc." string.
The code signing certificate has already been utilized to sign malware. Adobe say they will shortly revoke the certificate and have it added to Verisign's certificate revocation list.
Full details at »blogs.adobe.com/asset/2012/09/in···ate.html
--
Mischel Internet Security - Developer of TrojanHunter |
|
 StuartMWWho Is John Galt?Premium
join:2000-08-06
Galt's Gulch
kudos:2
 ·CenturyLink
3 edits | LOL
Sorry, I know it isn't really funny but Adobe seems to be be run by The Three Stooges Larry/Curly/Moe (pick one).
Actually:
Adobe = Larry
Sun = Curly
Microsoft = Moe
(feel free to change the order)
I usually check the Digital Certificates of stuff I download but I'm sure many don't.
--
Don't feed trolls--it only makes them grow! |
|
 Elite
join:2002-10-03
Orange, CT | reply to MagnusM
Poor Adobe. If Flash isn't getting exploited on 100s of thousands of consumer PCs, it's their build server.
Edit: punctuation
--
QUAD!!!! |
|
| reply to MagnusM
Strangely, Adobe don't plan to revoke the certificate until October 4th. Not sure the reasoning behind this, but maybe the revokation process simply takes a number of days to complete.
--
Mischel Internet Security - Developer of TrojanHunter |
|
 leiboldPremium,MVM
join:2002-07-09
Sunnyvale, CA
kudos:6
·SONIC.NET
| said by MagnusM:Strangely, Adobe don't plan to revoke the certificate until October 4th. Not sure the reasoning behind this, but maybe the revokation process simply takes a number of days to complete. Just guessing: they are identifying all Adobe software that was signed before the certificate was stolen and prepare updates for those software packages that are signed with a new certificate.
If they were issuing the certificate revocation first then owners of legitimate software would be negatively effected.
--
Got some spare cpu cycles ? Join Team Helix or Team Starfire! |
|
 Name GamePremium
join:2002-07-07
North Myrtle Beach, SC
kudos:7 | reply to MagnusM
Next time you bring news it is ok if it's good news.  |
|
| said by Name Game:Next time you bring news it is ok if it's good news.
That's not how I roll!
--
Mischel Internet Security - Developer of TrojanHunter |
|
| reply to leibold
said by leibold:Just guessing: they are identifying all Adobe software that was signed before the certificate was stolen and prepare updates for those software packages that are signed with a new certificate.
That's almost certainly it. Good call.
--
Mischel Internet Security - Developer of TrojanHunter |
|
StuartMWWho Is John Galt?Premium
join:2000-08-06
Galt's Gulch
kudos:2 Reviews:
·CenturyLink
| reply to Name Game
quote:
Doctor Adobe: I have some good news and I have some bad news.
Patient User: What's the good news?
Doctor Adobe: The good news is that the tests you took showed that you have 24 hours to live.
Patient User: That's the good news? What's the bad news?
Doctor Adobe: The bad news is that I forgot to call you yesterday!
--
Don't feed trolls--it only makes them grow! |
|
|
|
 siljalineI'm lovin' that double widePremium
join:2002-10-12
Montreal, QC
kudos:17
·Bell Sympatico
| reply to MagnusM
See also:
Adobe advisory APSA12-01
Hackers Breached Adobe Server in Order to Sign Their Malware
Adobe Revoking Code Signing Certificate Used To Sign Malware |
|
| reply to MagnusM
quote:
Flash Player isn't affected,
--
Gladiator Security Forum: www.gladiator-antivirus.com/
|
|
| reply to MagnusM
I received this feedback from Wiebke Lips at Adobe:
quote:
Please note that the certificate was NOT stolen. Adobe has stringent security measures in place to protect its code signing infrastructure. The private keys associated with the Adobe code signing certificates were stored in Hardware Security Modules (HSMs) kept in physically secure facilities. We confirmed that the private key associated with the Adobe code signing certificate was not extracted from the Hardware Security Module (HSM). For details, please refer to the blog post referenced above.
So it seems the malware files were signed by uploading them to the compromised build server, which then in turn signed the files. They private key itself was not actually accessed by the criminals. A post on twitter by Mikko Hypponen of F-Secure indicates that at least 5000 malware samples have been signed with this certificate, so the server must have been compromised for a while.
--
Mischel Internet Security - Developer of TrojanHunter |
|
Reviews:
·WestNet Broadband
| said by MagnusM:So it seems the malware files were signed by uploading them to the compromised build server, which then in turn signed the files. They private key itself was not actually accessed by the criminals. A post on twitter by Mikko Hypponen of F-Secure indicates that at least 5000 malware samples have been signed with this certificate, so the server must have been compromised for a while.
How recent was this, has it been date stamped?
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke
|
|
| Seems the first tweet (»twitter.com/mikko/status/251429422807265280) was a bit unclear:
quote:
Our sample repository has 5127 files that have been signed with the compromised Adobe certificate. pic.twitter.com/t0o9M0YA
Today, he tweeted this update (»twitter.com/mikko/status/2514561···739648):
quote:
We have thousands of clean, official Adobe files signed with the compromised certificate. Only 3 bad files.
--
Mischel Internet Security - Developer of TrojanHunter |
|
Reviews:
·WestNet Broadband
| We have thousands of clean, official Adobe files signed with the compromised certificate. Only 3 bad files.
Something to be kept low key....
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke
|
|
| That confused me too at first, but I believe they store clean files in their sample repository, so there were 5127 files in total, 5124 of which were legitimate signed Adobe files and then 3 malware files.
--
Mischel Internet Security - Developer of TrojanHunter |
|
StuartMWWho Is John Galt?Premium
join:2000-08-06
Galt's Gulch
kudos:2 | reply to norwegian
Adobe--it's all a Flash in the pan  |
|
Reviews:
·WestNet Broadband
| reply to MagnusM
Understand that could be true too.
I was more curious of the date stamp anyway if known, whether it was 3 days or so ago or older. The rest was just insight into figures; which as you point out can be read many ways without the database facts that need to go with it. |
|
StuartMWWho Is John Galt?Premium
join:2000-08-06
Galt's Gulch
kudos:2 Reviews:
·CenturyLink
| I doubt you'll find out much more info. Adobe will most likely keep the facts very close to their chest. The classic "nothing to see here... move along". That's how its handled these days.
A number of large US banks were attacked in the last week and almost all press releases said something to the effect
"We take security seriously and are constantly monitoring it"
"There was no effect on customer accounts"
blah blah blah...
--
Don't feed trolls--it only makes them grow! |
|
Name GamePremium
join:2002-07-07
North Myrtle Beach, SC
kudos:7
1 edit | reply to MagnusM
Serial Number of the compromised Adobe certificate is 15 e5 ac 0a 48 70 63 71 8e 39 da 52 30 1a 04 88
»twitter.com/mikko/status/2514324···/photo/1
Security Advisory: Upcoming Revocation of Adobe code signing certificate
DETAILS
Adobe is investigating what appears to be the misuse of an Adobe code signing certificate. Adobe is aware at this time of two malicious utilities from a single source that appeared to be digitally signed using a valid Adobe code-signing certificate.
The first malicious utility is pwdump7 v7.1. This utility extracts password hashes from the Windows OS and is sometimes used as a single file that statically links the OpenSSL library libeay.dll. The sample we received included the two files separate and individually signed.
PwDump7.exe:
MD5 hash: 130F7543D2360C40F8703D3898AFAC22
File size: 81.6 KB (83,648 bytes)
Signature timestamp: Thursday, July 26, 2012 8:44:40 PM PDT (GMT -7:00)
MD5 hash of file with signature removed: D1337B9E8BAC0EE285492B89F895CADB
libeay32.dll
MD5 hash: 095AB1CCC827BE2F38620256A620F7A4
File size: 999 KB (1,023,168 bytes)
Signature timestamp: Thursday, July 26, 2012 8:44:13 PM PDT (GMT -7:00)
MD5 hash of file with signature removed: A7EFD09E5B963AF88CE2FC5B8EB7127C
The second malicious utility, myGeeksmail.dll, appears to be a malicious ISAPI filter. Unlike the first utility, we are not aware of any publicly available versions of this ISAPI filter.
myGeeksmail.dll
MD5 hash: 46DB73375F05F09AC78EC3D940F3E61A
File size: 80.6 KB (82,624 bytes)
Signature timestamp: Wednesday, July 25, 2012 8:48:59 PM (GMT -7:00)
MD5 hash of file with signature removed: 8EA2420013090077EA875B97D7D1FF07 |
|
