This is a well known issue - Most organizations do not have a mechanism to monitor the certificates used (and they don't audit/protect their SSH keys - that's a subject for another time)
SNIPPET from the Article:-
Digitally signed malware is on it’s way to triple-digit growth, and by the end of 2014, it won’t be surprising to find almost all mobile malware attacks using digital certificates
Consequently, mobile certificates will continue to be a perfect target for cyber-criminals and pose a huge risk to organizations
Most organizations cannot detect or respond to anomalous certificates that authenticate systems and users on mobile devices, applications, and networks. Exploiting digital certificates is, therefore, the perfect attack.
Many organizations invest significant resources into detecting and remediating mobile malware but ignore the more dangerous and underlying threat of weak and unsecured mobile certificates.
The links below has more information:
https://blog.cloudsecurityalliance.org/2014/03/11/the-evolution-of-mobile-malware-digitally-signed-malware-creates-an-illusion-of-trust/
No comments:
Post a Comment