Digital Certificates contain some or all of the following information (not all of these attributes have to be specified):

• Program Name: Name of the software.
• Publisher Link: Link to the software developer / company.
• More Info Link: Additional link to a specified area.
• Signer Serial Number: Contains the serial number of the signer (in Hex-Code).
• Signer Issuer Name: Name of the signer who certificated the software.
• Signer Subject Name: Name of the company which created the software.
• Timestamp Serial Number: Timestamp when the serial number was created (in Hex-Code).
• Timestamp Issuer Name: Company name of the signer with the specific timestamp of certification.
• Timestamp Subject Name: Company name of the signer with an additional timestamp.
• Date: Date when the software was created.

This is what a certificate looks like in a debugger view:

Below you can see the same certificate as before but in the general MS Windows overview:

Things are changing though: Since malware authors have found ways to steal or fake digital certificates, one can never be really sure if a file with a valid certificate is legit or not.

Suspicion: How can I find out if a digital certificate is trustworthy?

• First of all, the certificate should be valid and not expired. Anything else could be seen as suspicious, although not reliably so, for example an old tool might indeed have an expired but actually valid certificate.
• Another very easy way would be to compare if the software which was e.g. downloaded has the same name as declared in its signature. If that’s not the case, it is possible that the certificate was stolen or faked.
• It is also always good to see if the certificate contains a countersignature. In some cases, it could be a sign for malware if this information is missing.
• An additional quick web search often brings more information about the reputation and trust-level of a certificate issuer or their software.

Also, it is necessary to know if a signature is still valid or expired. This might bring additional value to the classification, although when working with adware, one often encounters valid signatures.

The other way around: Classifying files based on digital certificates

On the other hand, adware vendors also use certificates to make sure their files are theirs. We, as an Antivirus company, can use this to our advantage. It enables us to classify files being suspicious of Adware or other possibly unwanted applications in a very simple manner.

If it is known that a certain adware type is always certified by the same certificate issuer, we can classify this issuer as potentially adware-related. Any new unknown file that is also signed by this issuer, now also is considered to be potentially adware-related. This works for all other prefixes as well, like APPL, PUA etc.

Obviously, this way of classification is not highly secure, but it gives us the opportunity to quickly find and easily filter certain amounts of files for further analysis and creating detections.

Let’s take a look at an example:
This is a valid certificate of a known adware vendor of the PUA/InstallCore family. Starting here, we can gather that most of the files which have “Digital Digest Pty Ltd” as the certificate issuer are part of the same adware family. A simple google search confirms it and verifies the fact that said issuer is at least suspicious to a certain amount.

Several departments within the Avira Protection Lab (e.g. the engine team and protection QA) act as additional sources for suspicious certificate names. Anyone who processes a lot of files and sees any similarities in the certificates is providing the virus lab with the information needed to make a classification. This cross-department communication has proven very useful in the past and has led to many synergy effects.

Back on topic, the same vendor could use different names for the signatures, as shown here:

Click image for full size

Conclusion

Certificates are very powerful as an analysis instrument. They cannot and will not replace conventional detection creation though; being simple ASCII-Text based makes them not 100% reliable. But as a quick and easy addition they serve their purpose well.

The post Digital Certificates – How helpful are they? appeared first on Avira Blog.

Wi-Fi security

Using Wi-Fi to connect to the Internet is certainly handy.

However, it’s very important to make sure that the connection is secure.

Here are a few reminders to prevent someone to crack your connection and penetrate your network:

• use WPA2 (WEP can be broken in a few seconds)
• use a long password (to make attacks harder)
• don’t use a standard SSID (to prevent pre-attacks)

So to be secure, each of your guest would have to enter a long password on his smartphone, tablet, which can be seen as inconvenient …

WPS

To make it easier, Wi-Fi Protected Setup (WPS) was introduced.

There are two different ways to connect to a WPS-enabled router:

• push a special button on the router
• enter a PIN that is written on the back:

So what could go wrong ?
The PIN is not visible from outside, and the button is not reachable. Everything seems fine.

Weaknesses

the PIN is not so strong

First, it looks like the PIN is 8 characters, but it’s actually made of two independent parts, that are checked one after the other: so you just have to find the first one, then the second one. It’s making attacks much faster.

the PIN is not always random

Most implementations don’t respect strictly the standard: to prevent the WPS PIN to be easily guessed, it should be entirely random. However, to simplify manufacturing, it’s often derived from the MAC, which is available to anyone nearby. Many of this derivation algorithm have been identified, so an attacker just needs to come within connection range to your router, get its MAC, use a script to get the WPS PIN, and that’s it!

Randomness is hard

Another important part of the WPS protocol is the communicating devices have to exchange random numbers. Sadly, producing correct random numbers is not trivial, especially on cheap devices.

If the router internally behaves like a dice where all faces are not different, or a dice that can’t give the same number twice in a row, then this can be abused:

1. by knowing how the random numbers are generated
2. grab the initial random numbers exchanged during the communication
3. determine the next numbers to be generated
4. generate the next internal values and connect to the Wi-Fi, even if the WPS PIN is unknown!

This attack is very strong, as it requires no brute force at all: just connect on the first try.

Luckily, it depends on the router model.
Sadly, many routers from different brands use internally the same vulnerable system.

Conclusion

Wi-Fi Protected Setup is a security risk – disable it now (it if you can) !

For more details, check Dominique Bongard‘s presentation.

The post Wi-Fi Protected Setup is a security risk appeared first on Avira Blog.