English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Recent measurements of the Windows code-signing certificate ecosystem havehighlighted various forms of abuse that allow malware authors to producemalicious code carrying valid digital signatures. However, the undergroundtrade that allows miscreants to acquire such certificates is not wellunderstood. In this paper, we illuminate two aspects of this trade. First, weinvestigate 4 leading vendors of Authenticode certificates, we document howthey conduct business, and we estimate their market share. Second, we collect adata set of recently signed malware and we use it to study the relationshipsamong malware developers, malware families and the certificates. We also useinformation from the black market to fingerprint the certificates traded and toidentify when the are likely used to sign malware in the wild. Using thesemethods, we document a shift in the methods that malware authors employ toobtain valid digital signatures. While prior studies have reported the use ofcode-signing certificates that had been compromised or obtained directly fromlegitimate Certification Authorities, we observe that, in 2017, these methodshave become secondary to purchasing certificates from underground vendors. Wealso find that the need to bypass platform protections such as MicrosoftDefender SmartScreen plays a growing role in driving the demand forAuthenticode certificates. Together, these findings suggest that the trade incertificates issued for abuse represents an emerging segment of the undergroundeconomy.

Issued for Abuse: Measuring the Underground Trade in Code Signing Certificate