Certified Malware in South Korea: A Localized Study of Breaches of Trust in Code-Signing PKI Ecosystem

Abstract

Code-signing PKI ecosystems are vulnerable to abusers. Kim et al. reported such abuse cases, e.g., malware authors misused the stolen private keys of the reputable code-signing certificates to sign their malicious programs. This certified malware exploits the chain of the trust established in the ecosystem and helps an adversary readily bypass security mechanisms such as anti-virus engines. Prior work analyzed the large corpus of certificates collected from the wild to characterize the security problems. However, this practice was typically performed in a global perspective and often left the issues that could happen at a local level behind. Our work revisits the investigations conducted by previous studies with a local perspective. In particular, we focus on code-signing certificates issued to South Korean companies. South Korea employs the code-signing PKI ecosystem with its own regional adaptations; thus, it is a perfect candidate to make a comparison. To begin with, we build a data collection pipeline and collect 455 certificates issued for South Korean companies and are potentially misused. We analyze those certificates based on three dimensions: (i) abusers, (ii) issuers, and (iii) the life-cycle of the certificate. We first identify that the strong regulation of a government can affect the market share of CAs. We also observe that several problems in certificate revocation: (i) the certificates had issued by local companies that closed the code-signing business still exist, (ii) only 6.8% of the abused certificates are revoked, and (iii) eight certificates are not revoked properly. All of those could lead to extending the validity of certified malware in the wild. Moreover, we show that the number of abuse cases is high in South Korea, even though it has a small population. Our study implies that Korean security practitioners require immediate attention to code-signing PKI abuse cases to safeguard the entire ecosystem.

A Appendix

Table 4. SignTool error code & message.

Table 5. Breakdowns. Error code of Korean malicious PE files (left), PE files and certificates (right).

Fig. 5.

Code-signing process. (1) A publisher applies for a code-signing certificate to a code-signing CA with her/his identifications such as government-issued photo IDs, (2) After vetting, the CA issues a code-signing certificate to the publisher, (3) Using the $\mathtt {SignTool}$ (a signing tool provided by Microsoft), the software publisher signs a binary sample with the certificate, (4) when a TimeStamp Authority (TSA) is specified for timestamping (c.f., Sect. 2.2), the signing tool sends the hash value of the binary sample to the TSA server, (5) The TSA server issues the timestamp and signs the timestamp with the TSA’s private key, and send them back to the signing tool, (6) The signing tool finally embeds the code-signing and the TSA certificate chain, the digital signature, and the timestamp into the binary sample, and (7) Finally, the publisher distributes the signed binary sample in the wild.