Google Warns of a New Way Hackers Can Make Malware Undetectable on Windows

Cybersecurity researchers have disclosed a novel technique
adopted by threat actors to deliberately evade detection with the
help of malformed digital signatures of its malware payloads.

“Attackers created malformed code signatures that are treated as
valid by Windows but are not able to be decoded or checked by
OpenSSL code — which is used in a number of security scanning
products,” Google Threat Analysis Group’s Neel Mehta said^[1]
in a write-up published on Thursday.

The new mechanism was observed to be exploited by a notorious
family of unwanted software known as OpenSUpdater^[2]
that’s used to download and install other suspicious programs on
compromised systems. Most targets of the campaign are users located
in the U.S. who are prone to downloading cracked versions of games
and other grey-area software.

The findings come from a set of OpenSUpdater samples^[3]
uploaded^[4]
to VirusTotal at least since mid-August.

Not only are the artifacts signed with an invalid leaf X.509 certificate^[5]
that’s edited in such a manner that the ‘parameters’ element of the
SignatureAlgorithm^[6]
field included an End-of-Content (EOC) marker instead of a NULL
tag. Although such encodings are rejected as invalid by-products
using OpenSSL to retrieve signature information, checks on Windows
systems would permit the file to be run without any security
warnings.

“This is the first time TAG has observed actors using this
technique to evade detection while preserving a valid digital
signature on PE files,” Mehta said.

“Code signatures on Windows executables provide guarantees about
the integrity of a signed executable, as well as information about
the identity of the signer. Attackers who are able to obscure their
identity in signatures without affecting the integrity of the
signature can avoid detection longer and extend the lifetime of
their code-signing certificates to infect more systems.”