Malaysian Government signing key stolen

The Government of Malaysia has had a code signing certificate stolen and used to sign malware.

The breach was discovered after researchers at security firm F-Secure found a trojan signed by the certificate owned from the Government.

Officials from the Malaysian Agricultural Research and Development Institute told F-Secure the certificate was stolen "quite some time ago".

Credit: F-Secure

The signed trojan would not be flagged by risk mitigation warnings that alert users if unsigned applications were downloaded from the internet.

“In some of these cases, the certificate has been created by the criminals just for the purpose for signing malware. In other cases they steal code signing certificates (and their passphrases) so they can sign code as someone else,” CTO Mikko Hypponen said.

“It's not that common to find a signed copy of malware. It's even rarer that it's signed with an official key belonging to a government.”

The trojan spread via malicious PDF files that exploited Adobe Reader 8. The malware downloaded components from a server called worldnewsmagazines.org signed by www.esupplychain.com.tw.

Problems facing the PKI trust model have been demonstrated in a string of recent hacks of some of the 600 certificate authorities that are entrusted to sign digital certificates.