Google researchers have identified malware developers generating malformed code signatures that appear to be valid in Windows to bypass security software.
This technique is actively used to spread OpenSUpdater, a family of unwanted software known as riskware, which plants advertisements into targets’ browsers and installs other redundant programs on their machines.
Researchers believe the financially motivated threat actors behind OpenSUpdater will attempt to infect as many devices as possible and are specifically targeting US citizens who are looking to download game cracks and other pirated software.
Novel approach
Last month, security researcher Neel Mehta from Google Threat Analysis Group (TAG) spotted that the creators of an unwanted software known as OpenSUpdater began signing their packages with valid but purposely malformed certificates, accepted by Windows but refused by OpenSSL.
By disrupting OpenSSL’s certificate parsing, some security systems would not detect the malware samples that use OpenSSL-based detection criteria and permitted to carry out their harmful operations on victims’ PCs.
“Since mid-August, OpenSUpdater samples have carried an invalid signature, and further investigation showed this was a deliberate attempt to evade detection. Security products using OpenSSL to extract signature information will reject this encoding as invalid. However, to a parser that permits these encodings, the digital signature of the binary will otherwise appear legitimate and valid,” Mehta explained.
It looks like the OpenSUpdater is able to bypass security defenses by enabling the samples deployed on a victim’s computer. This can happen as any security solutions using OpenSSL to parse digital signatures will virtually ignore the samples’ malicious nature because they will reject the signature information as invalid, confusing, and breaking the malware scan process.
“Since first discovering this activity, OpenSUpdater’s authors have tried other variations on invalid encodings to further evade detection. This is the first time TAG has observed actors using this technique to evade detection while preserving a valid digital signature on PE files,” Mehta added.
The Google TAG team has collaborated with the Google Safe Browsing team in an attempt to block this family of unwanted software from further spreading onto other victims’ computers, BleepingComputer reported. Additionally, security researchers have advised Google users to download and install software only from trustworthy sources.