Subvert Trust Controls: Code Signing

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. [1] The certificates used during an operation may be created, acquired, or stolen by the adversary. [2] [3] Unlike Invalid Code Signature, this activity will result in a valid signature.

Code signing to verify software on first run can be used on modern Windows and macOS/OS X systems. It is not used on Linux due to the decentralized nature of the platform. [1]

Code signing certificates may be used to bypass security policies that require signed code to execute on a system.

ID: T1553.002
Sub-technique of:  T1553
Tactic: Defense Evasion
Platforms: Windows, macOS
Data Sources: Binary file metadata
Defense Bypassed: Windows User Account Control
Version: 1.0
Created: 05 February 2020
Last Modified: 10 February 2020

Procedure Examples

Name Description
Anchor

Anchor has been signed with valid certificates to evade detection by security tools.[4]

APT41

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.[5]

BackConfig

BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.[6]

BOOSTWRITE

BOOSTWRITE has been signed by a valid CA.[7]

ChChes

ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.[8][9][10]

CopyKittens

CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.[11]

Darkhotel

Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.[12][13]

Daserf

Some Daserf samples were signed with a stolen digital certificate.[14]

Ebury

Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.[15]

Epic

Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.[16]

FIN6

FIN6 has used Comodo code-signing certificates.[17]

FIN7

FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.[18][19]

Gazer

Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."[20][21]

GreyEnergy

GreyEnergy digitally signs the malware with a code-signing certificate.[22]

Helminth

Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.[23]

Honeybee

Honeybee uses a dropper called MaoCheng that harvests a stolen digital signature from Adobe Systems.[24]

Janicab

Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.[25]

Leviathan

Leviathan has used stolen code signing certificates to sign malware.[26][27]

LockerGoga

LockerGoga has been signed with stolen certificates in order to make it look more legitimate.[28]

Metamorfo

Metamorfo has digitally signed executables using AVAST Software certificates.[29]

Molerats

Molerats has used forged Microsoft code-signing certificates on malware.[30]

More_eggs

More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.[17]

Nerex

Nerex drops a signed Microsoft DLL to disk.[31]

Patchwork

Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.[6]

PipeMon

PipeMon, its installer, and tools are signed with stolen code-signing certificates.[32]

PROMETHIUM

PROMETHIUM has signed code with self-signed certificates.[33]

QuasarRAT

A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.[34]

RTM

RTM samples have been signed with a code-signing certificates.[35]

Silence

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).[36]

StrongPity

StrongPity has been signed with self-signed certificates.[33]

Suckfly

Suckfly has used stolen certificates to sign its malware.[37]

Sunburst

Sunburst was digitally signed by SolarWinds from March - May 2020.[38]

TA505

TA505 has signed payloads with code signing certificates from Thawte and Sectigo.[39][40][41]

TrickBot

TrickBot has come with a signed downloader component.[4]

UNC2452

UNC2452 was able to get Sunburst signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.[38]

Winnti Group

Winnti Group used stolen certificates to sign its malware.[42]

Wizard Spider

Wizard Spider has used Digicert code-signing certificates for some of its malware.[43]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Collect and analyze signing certificate metadata on software that executes within the environment to look for unusual certificate characteristics and outliers.

References

  1. Wikipedia. (2015, November 10). Code Signing. Retrieved March 31, 2016.
  2. Ladikov, A. (2015, January 29). Why You Shouldn’t Completely Trust Files Signed with Digital Certificates. Retrieved March 31, 2016.
  3. Shinotsuka, H. (2013, February 22). How Attackers Steal Private Keys from Digital Certificates. Retrieved March 31, 2016.
  4. Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.
  5. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  6. Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020.
  7. Carr, N, et all. (2019, October 10). Mahalo FIN7: Responding to the Criminal Operators’ New Tools and Techniques. Retrieved October 11, 2019.
  8. Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017.
  9. Nakamura, Y.. (2017, February 17). ChChes - Malware that Communicates with C&C Servers Using Cookie Headers. Retrieved March 1, 2017.
  10. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  11. ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.
  12. Kaspersky Lab's Global Research and Analysis Team. (2014, November). The Darkhotel APT A Story of Unusual Hospitality. Retrieved November 12, 2014.
  13. Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.
  14. DiMaggio, J. (2016, April 28). Tick cyberespionage group zeros in on Japan. Retrieved July 16, 2018.
  15. M.Léveillé, M.. (2014, February 21). An In-depth Analysis of Linux/Ebury. Retrieved April 19, 2019.
  16. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  17. Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.
  18. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
  19. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.
  20. ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017.
  21. Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017.
  22. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  1. ClearSky Cybersecurity. (2017, January 5). Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford. Retrieved May 3, 2017.
  2. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  3. Thomas. (2013, July 15). New signed malware called Janicab. Retrieved July 17, 2017.
  4. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  5. Plan, F., et all. (2019, March 4). APT40: Examining a China-Nexus Espionage Actor. Retrieved March 18, 2019.
  6. Greenberg, A. (2019, March 25). A Guide to LockerGoga, the Ransomware Crippling Industrial Firms. Retrieved July 17, 2019.
  7. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
  8. Villeneuve, N., Haq, H., Moran, N. (2013, August 23). OPERATION MOLERATS: MIDDLE EAST CYBER ATTACKS USING POISON IVY. Retrieved April 1, 2016.
  9. Ladley, F. (2012, May 15). Backdoor.Nerex. Retrieved February 23, 2018.
  10. Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.
  11. Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020.
  12. Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.
  13. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  14. Group-IB. (2019, August). Silence 2.0: Going Global. Retrieved May 5, 2020.
  15. DiMaggio, J.. (2016, March 15). Suckfly: Revealing the secret life of your code signing certificates. Retrieved August 3, 2016.
  16. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  17. Salem, E. (2019, April 25). Threat Actor TA505 Targets Financial Enterprises Using LOLBins and a New Backdoor Malware. Retrieved May 28, 2019.
  18. Vilkomir-Preisman, S. (2019, April 2). New ServHelper Variant Employs Excel 4.0 Macro to Drop Signed Payload. Retrieved May 28, 2019.
  19. Hiroaki, H. and Lu, L. (2019, June 12). Shifting Tactics: Breaking Down TA505 Group’s Use of HTML, RATs and Other Techniques in Latest Campaigns. Retrieved May 29, 2020.
  20. Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.
  21. The DFIR Report. (2020, November 5). Ryuk Speed Run, 2 Hours to Ransom. Retrieved November 6, 2020.