3 ms·
Malware now using Nvidia's stolen code signing certificates
- spansoa 5y agoHow much do these certs cost, without having to resort to stolen ones?
- bravetraveler 5y agoI have very little experience in this area, but for one-off items it's probably a few hundred USD To become a signing authority is probably quite a bit higher
- FastEatSlow 5y agoBased on the certificate authorities linked to by Microsoft [1], around $400 to $700 a year, depending on the type of certificate. Extended validation certificates grant the software a better reputation with antivirus products, but I don't know if there is actual validation involved, or if it's just buying a rank. [1] https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate https://docs.microsoft.com/en-us/windows-hardware/drivers/da...
- castillar76 5y agoAt least with the CAs we've worked with, the EV certs are required to either be issued in a CA-provided hardware token or you have to demonstrate positively that you have the key in an Hardware Security Module. That's the piece of validation that's really meaningful to me at the EV layer for code signing, and I think it's most of the reason that those are afforded better reputation as well.
- assttoasstmgr 5y agoWhy were these not stored in smart cards? JFC Code signing certs should only be issued as hardware certs. That should be part of the certificate policy and Microsoft should enforce it.