Broadband Tech > Security > Security > Malwarebytes uncovers digital certificate-spoofing Trojan

Malwarebytes uncovers digital certificate-spoofing Trojan

quote:

---

Security vendor Malwarebytes has uncovered a banking Trojan capable of bypassing traditional security by spoofing legitimate digital certificates.

The certificate used by the malware is usually legitimate but it's now being sent out by a fake-company set up to get hold of the certificates from Digicert.

The certificate allows the hacker to sneak a malicious PDF file infected with the Trojan past most computer security systems. Malwarebytes said that the malware had already targeted a slew of high-profile firms.

"The malware is a banking/password stealer using email to spread. It appears to be a PDF invoice with a valid certificate issued to a real Brazilian software company which was issued by SSL certificate authority DigiCert," senior security researcher at Malwarebytes Jerome Segura told V3.

---

»www.v3.co.uk/v3-uk/news/2241517/···-attacks, the link included in the article, is also most interesting. And disquieting.

quote:

---

The certificates were issues to a company called "Buster Paper Comercial Ltda" which apparently only existed on paper. The company was used to request a certificate from CA Digicert.

Digicert told CIO Magazine that it did issue the certificate because at the time "Buster Paper Comercial Ltda was a legally registered business as confirmed through the Brazilian Ministerio da Fazenda: Cadastro Sincronizado Nacional." The certificate has since been revoked.

---

reply to chachazz
Also cited at MBAM Blog:
»blog.malwarebytes.org/intelligen···ous-mix/