Issued for Abuse: Measuring the Underground Trade in Code Signing Certificate
Kristi\'an Koz\'ak, Bum Jun Kwon, Doowon Kim, Tudor Dumitra\c{s}

TL;DR
This paper investigates the underground trade of code signing certificates used for malicious purposes, analyzing vendor practices, market dynamics, and the relationship between certificates and malware in the wild.
Contribution
It provides a comprehensive analysis of the underground market for code signing certificates and how malware authors acquire and utilize these certificates, highlighting a shift towards underground vendors.
Findings
Underground vendors now dominate the acquisition of malicious code signing certificates.
Malware authors increasingly buy certificates from underground markets rather than compromised legitimate ones.
Demand for certificates is driven by the need to bypass security protections like Microsoft Defender SmartScreen.
Abstract
Recent measurements of the Windows code-signing certificate ecosystem have highlighted various forms of abuse that allow malware authors to produce malicious code carrying valid digital signatures. However, the underground trade that allows miscreants to acquire such certificates is not well understood. In this paper, we illuminate two aspects of this trade. First, we investigate 4 leading vendors of Authenticode certificates, we document how they conduct business, and we estimate their market share. Second, we collect a data set of recently signed malware and we use it to study the relationships among malware developers, malware families and the certificates. We also use information from the black market to fingerprint the certificates traded and to identify when the are likely used to sign malware in the wild. Using these methods, we document a shift in the methods that malware…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Spam and Phishing Detection · Cybercrime and Law Enforcement Studies
