Re: [saag] Fwd: [widgets] New WD of Widgets 1.0: Digital Signatures spec published on March 31

Peter Gutmann <pgut001@cs.auckland.ac.nz> Mon, 06 April 2009 15:08 UTC

From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: benl@google.com, pgut001@cs.auckland.ac.nz
In-Reply-To: <1b587cab0904060714h4deb48b2of69d0252988be2f5@mail.gmail.com>
Message-Id: <E1LqqPy-0004YB-AP@wintermute01.cs.auckland.ac.nz>
Sender: pgut001 <pgut001@cs.auckland.ac.nz>
Date: Tue, 07 Apr 2009 03:07:22 +1200
Cc: art.barstow@nokia.com, Frederick.Hirsch@nokia.com, saag@ietf.org
Subject: Re: [saag] Fwd: [widgets] New WD of Widgets 1.0: Digital Signatures spec published on March 31
Precedence: list

Ben Laurie <benl@google.com> writes:
>On Mon, Apr 6, 2009 at 2:47 PM, Peter Gutmann <pgut001@cs.auckland.ac.nz> wrote:
>> Ben Laurie <benl@google.com> writes:
>>>I find it pretty annoying that signing widgets is described as a "trust and
>>>quality assurance mechanism".
>>
>> It's a valid comment though. =A0A large-scale study (from Microsoft's malware
>> research group) has shown that the majority of CA-certified signed malware is
>> in the "severe" or "high-risk" category. =A0So seeing a signature on malware
>> provides a high level of trust that this is the high-quality stuff you're
>> seeing and not some cheap knockoff.
>
>Awesome! Link?

http://blogs.technet.com/mmpc/archive/2008/11/06/malware-and-signed-code.aspx
(this was what motivated my "Asking the drunk whether he's drunk" post on the
cryptography list a few months back).

As a general comment, signed malware has been out there for some years now,
but this is the first large-scale (I mean seriously large-scale) study of it.
1.78M signed non-malicious files, 173K signed malware files, so one in ten
signed files on a PC is genuine CA-certified signed malware (and that's a
lower bound based on what's detectable by the MMPC scan, any decently-infected
machine will have scanning disabled or subverted so it won't register).  From
the report:

  Of signed detected files, severity of the threats tended to be high or severe,
  with low and moderate threats comprising a much smaller number of files:

  Severe  50819
  High    73677
  Moderate 42308
  Low     1099

So there you go, signing definitely does provide a "trust and quality
assurance mechanism".  If it's a CA-certified signed rootkit or worm, you know
you've been infected by the good stuff.

Peter.

[saag] Fwd: [widgets] New WD of Widgets 1.0: Digi… Thomas Roessler
Re: [saag] Fwd: [widgets] New WD of Widgets 1.0: … Ben Laurie
Re: [saag] Fwd: [widgets] New WD of Widgets 1.0: … Peter Gutmann
Re: [saag] Fwd: [widgets] New WD of Widgets 1.0: … Ben Laurie
Re: [saag] Fwd: [widgets] New WD of Widgets 1.0: … Peter Gutmann