3 ms·

What's the actual technical thing that happened here? Did they manage to trick Thawte into issuing real SSL certificates for Kaspersky's internet domains?

• liberal_098 9y ago
  > Did they manage to trick Thawte into issuing real SSL certificates for Kaspersky's internet domains? Most probably something really simple with the goal to trigger some resonance in media when nobody will ask about SSL certificates and then forget about it.
• willstrafach 9y ago
  > Did they manage to trick Thawte into issuing real SSL certificates for Kaspersky's internet domains? No, that would be huge news. They just created an invalid self-signed certificate with a Kaspersky domain in the CN. This would allow their implant traffic to hide better, as in a program like Wireshark it would just look like a server downloading some anti-virus updates instead of sticking out as a C2 beacon. Check out the source bundle - Same can be done to create self-signed certificates for stealth in other scenarios which may require a different domain name (For example, if the target uses another program such as Chrome which periodically contacts a server to fetch automatic updates, it would use the domain of that server). There is no significance of Thawte, other than being the CA which Kaspersky uses. This is to be expected, as the self-signed certificates are naturally going to need to look like the originals, only differing in keys of course.