Zeus Malware Used Pilfered Digital Certificate

Researchers at Trend Micro have found that a widespread piece of malware used a digital certificate from a competing security company’s product in an attempt to look legitimate.

The malware is Zeus, a bot that is used to steal all kinds of data from computers and has proved to be a tricky application for security companies to detect.

The version of Zeus detected by Trend Micro had a digital certificate belonging to Kaspersky’s Zbot product, which is designed to remove Zeus. The certificate — which is verified during a software installation to ensure a program is what it purports to be — was expired, however.

Also, the malware’s hash value, a unique numerical identifier based on the source code for applications, was incorrect, as it was derived on the Kaspersky tool, according to a blog post written by Trend Micro.

Stealing digital certificates is a frequently used technique by malware writers. Two versions of the Stuxnet malware — designed to steal data from Siemens industrial machines — also used digital certificates from other software companies. Once it was discovered, the certificates were revoked.

“Certificates, unfortunately, can be copied by any cybercriminal with intent from any company,” Trend wrote. “The antivirus company mentioned in this instance could not have prevented this incident from taking place, and it is likely that we will continue to see more such incidents in the future.”

Trend said it informed Kaspersky of the certificate issue. The problem again shows the lengths to which Zeus creators go to keep the malware undetectable. Experts at the security company Trusteer said security software suites are often only able to detected about 10 percent of the active Zeus variants circulating.

Send news tips and comments to jeremy_kirk@idg.com