2 ms·
Am I missing something or wouldn't the author(s) of Qakbot be able to avoid this attack by cryptographically signing commands and having clients check them?
by jszymborski 3y ago
Am I missing something or wouldn't the author(s) of Qakbot be able to avoid this attack by cryptographically signing commands and having clients check them?
- paxys 3y agoIt doesn't matter. If you gain access to their servers you can sign the commands yourself.
- rcxdude 3y agoDepends on where the key is. Command and control servers don't need to have the keys for the commands they are relaying.
- datadeft 3y agoI am pretty sure that is not their top priority.
- chilmers 3y agoFrom https://www.secureworks.com/blog/law-enforcement-takes-down-qakbot https://www.secureworks.com/blog/law-enforcement-takes-down-... "To interact with infected hosts, the replacement servers required a certificate that can sign messages. It appears that the certificates were obtained and used for good intentions."