• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Malware   »   Spyware Hides Behind Stolen Opera Digital Certificate

Spyware Hides Behind Stolen Opera Digital Certificate

  • Posted on:June 27, 2013 at 6:18 pm
  • Posted in:Malware
  • Author:
    Alvin Bacani (Research Engineer)
0

Opera recently disclosed that attackers compromised their network and stole at least one expired Opera code signing certificate. The attackers then used this certificate to sign their malware, which tricked the target system and (even) security software into thinking that the file was legitimate.

We obtained a sample of the said malware (which is detected as TSPY_FAREIT.ACU) that bears the outdated Opera certificate (see screenshot below). Similar to what Opera reported, the sample we acquired poses as an Opera update.

Once executed, TSPY_FAREIT.ACU steals crucial information from certain FTP clients or file managers including usernames, passwords, and server names.

Opera-fake-certificate-1
Figure 1. Screenshot of stolen old Opera digital certificate

Aside from FTP clients, TSPY_FAREIT.ACU gathers more information from Internet browsers (which include Mozilla Firefox, Google Chrome, and interestingly Opera), usually those stored on these browsers. These data are typically login credentials for as social networking, banking, and e-commerce websites etc. Using these information, the people behind the malware can get hold of your various online accounts or even initiate unauthorized transactions. They can also profit from these stolen data by selling these to the underground market.

Opera estimates that several thousand of Windows users are affected as a result of their installed Opera software automatically installing the said malware bearing the outdated certificate. To address this issue, the software vendor promised to release a new version of their browser.

This abuse of digital certificate to keep malware under the radar is not a new trick and has been proven effective in the past. A good example is the notorious FLAME attack that uses components bearing Microsoft-issued certificates. The screen-locking malware Police Ransomware was also previously found using fake digital certificates, in an attempt to elude digital certificate checks.

Opera is also not the first software vendor to release an advisory warning its users of malware bearing their digital certificates. Last year Adobe issued an advisory informing users of malicious utilities carrying legitimated Adobe certificates.

Trend Micro detects and deletes the said spyware bearing the said certificate. You may visit Opera’s site to know more about their advisory.

With additional insights from Threat Researcher Alvin John Nieto.

Learn how to protect Enterprises, Small Businesses, and Home Users from ransomware:
ENTERPRISE »
SMALL BUSINESS»
HOME»
Tags: detectionhackMalwareOperastolen certificatetrend micro

Featured Stories

  • systemd Vulnerability Leads to Denial of Service on Linux
  • qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware
  • Mitigating CVE-2017-5689, an Intel Management Engine Vulnerability
  • A Closer Look at North Korea’s Internet
  • From Cybercrime to Cyberpropaganda

Security Predictions for 2018

  • Attackers are banking on network vulnerabilities and inherent weaknesses to facilitate massive malware attacks, IoT hacks, and operational disruptions. The ever-shifting threats and increasingly expanding attack surface will challenge users and enterprises to catch up with their security.
    Read our security predictions for 2018.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Recent Posts

  • Monero-Mining RETADUP Worm Goes Polymorphic, Gets an AutoHotKey Variant
  • XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing
  • XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails
  • Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner
  • Not Only Botnets: Hacking Group in Brazil Targets IoT Devices With Malware

Popular Posts

  • New MacOS Backdoor Linked to OceanLotus Found
  • Monero-Mining HiddenMiner Android Malware Can Potentially Cause Device Failure
  • ChessMaster Adds Updated Tools to Its Arsenal
  • Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner
  • Cryptocurrency Web Miner Script Injected into AOL Advertising Platform

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.