Last Updated on 22/11/2021 by Anamika
Generally, when someone’s system gets hacked or there are some data breaches, the user gets an intimation or gets to know about it by the way of some way, but the researchers have disclosed a new technique that has been adopted by the hackers through which the victim cannot detect the attack on his system.
According to the reports of The Hacker News, “Attackers created malformed code signatures that are treated as valid by Windows but are not able to be decoded or checked by OpenSSL code — which is used in a number of security scanning products,” Google Threat Analysis Group’s Neel Mehta said in a write-up published on Thursday.
The target audience is basically the residents of the U.S. who are into gaming a lot and can download any software which serves their purpose. The attacking software is said to be OpenSUpdator which is used to download anonymous programs which compromise the security of the device.
The artifacts are signed with an invalid leaf X.509 certificate that was edited so that the ‘parameters’ element of the SignatureAlgorithm field contains an EndofContent (EOC) marker instead of a NULL tag. Although such encodings are rejected as invalid by products that use OpenSSL to obtain signature information, checks on Windows systems would allow the file to run without security warnings. (The Hacker News)
The Code signatures of windows make sure that the integrity of the signed executable and the information about the signer is genuine and unique. Attackers who are able to get the information by avoiding detection can infect more systems and attack at a very large number.
