The basic issue malware developers have is that today's operating systems are built to make suspicious software look suspicious. Warnings and security scans or installation blocks may be triggered on unknown files. Users are also more wary of opening unfamiliar programs. To overcome these barriers, attackers will try to trick their victims into thinking that the software is from a legitimate and recognized company.
To grasp the importance of a trusted publisher name, you must first answer the question of 'What Is Code Signing?' A digital certificate and private key are used to bind a software file to a trusted publisher, which is called code signing. The operating system can verify who signed the file when it is opened and whether it has been modified since signing. Criminals want to take advantage of that trust, but do not deserve it.
When software is branded with the name of a recognized company, it is more likely that users will trust it over one that shows a warning for an unknown publisher. Having an identity recognized can help an installer, update, or utility look more professional and trusted.
That said, this doesn't imply that all users thoroughly review the publisher information. Many times, the lack of a strong warning is sufficient to impact behavior. A signed application might seem more secure since it looks like an application from a known organization.
Malware makers know this psychological effect. They are designed to overcome hesitation, so that the user accepts an installation or clicks past a security alert.
Security tools examine many signals when determining whether a file is risky. It can be based on its origin, reputation, behavior, age, and digital signature.
Even if a file is signed, it does not mean that it is safe. But signed software might not be as thoroughly examined by basic controls as unsigned software with no known publisher. This can make malicious code more likely to reach the stage that it can be executed.
Ransomware, spyware, credential stealers and RATs can be signed by attackers. The signature is used to give the file an appearance of legitimacy, even though the true intent of the file is malicious.
More sophisticated security products don't rely on signatures alone. However, a legitimate publisher's name can help malware to overcome early phases of delivery.
Criminals get a trusted publisher name by stealing a legitimate organization's code signing key. The key can be stolen from a developer workstation, build server, cloud account, or insecurely stored location.
When the key is under the attackers' control, they could potentially use it to sign malware in the victim company's name. The malware may at first seem like a legitimate product from the same company to users and some automated systems.
This is especially threatening for the company that is the target of such an attack, especially if the software already in use is popular. Customers may be used to installing its updates, and less likely to be suspicious of a new signed file.
Not always does a developer of malware need to steal an existing key. Some try to get code signing certificates via fake companies, fake identities, or hacked certificate accounts.
Even if it's not a well-known publisher name, it can seem more credible than an unsigned file. Having a professional-looking business name may be sufficient to make the installer appear legitimate.
Certificates can also be considered as 'disposable infrastructure' for criminal groups. They employ one until it is identified or canceled, and then switch to a different identity. This poses a constant headache for certificate authorities, software platforms and security researchers.
One typical delivery method is fake software updates, since people expect real software to update from time to time. Malware can be hidden within a browser update, business utility, security patch, or document tool.
The deception is bolstered by a trusted publisher name. The file may look like it comes from the organization claiming to give the update, making it less obvious that it's fraudulent.
Additionally, the risk is even higher if the attackers are able to breach a legitimate distribution channel. They might be able to compromise a build or update system and sign the malware with the proper key so that users could get malware from a process they would normally trust.
This makes code signing part of the attack, not just a security control.
The pull of a trusted publisher name illustrates the need for careful interpretation of digital signatures. They can verify the identity that approved a file and whether the file has been altered. They cannot assure that there is no malicious code in the software.
Organizations should check signatures, as well as the behavior of the files, where files were distributed, and software reputation. Signing keys must be protected in hardware security modules or managed signing systems; access must be limited and monitored.
Trusted publisher names are important to malware developers because trust equals opportunity. If the identity is recognized, fewer warnings will be issued; it can affect users and make malicious files seem normal. The importance of code signing is undeniable, but it's only as safe as the key management and verification systems used, and if they are not secure, a signature should not be considered proof of safety.