The Broken Shield: Measuring Revocation Effectiveness in the
Windows Code-Signing PKI

D 2018

The Broken Shield: Measuring Revocation Effectiveness in the Windows Code-Signing PKI

KIM, Doowon, Bum Jun KWON, Kristián KOZÁK, Christopher GATES, Tudor DUMITRAȘ et. al.

Základní údaje

Originální název

The Broken Shield: Measuring Revocation Effectiveness in the Windows Code-Signing PKI

Autoři

KIM, Doowon, Bum Jun KWON, Kristián KOZÁK (203 Česká republika, domácí), Christopher GATES a Tudor DUMITRAȘ

Vydání

Baltimore, MD, 27th USENIX Security Symposium (USENIX Security 18), od s. 851-868, 18 s. 2018

Nakladatel

USENIX Association

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10201 Computer sciences, information science, bioinformatics

Stát vydavatele

Spojené státy

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

elektronická verze "online"

Odkazy

URL

Kód RIV

RIV/00216224:14330/18:00103415

Organizační jednotka

Fakulta informatiky

ISBN

978-1-931971-46-1

UT WoS

000485139900050

Klíčová slova anglicky

code signing; revocation

Štítky

core_A, firank_1

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 24. 4. 2020 16:11, Mgr. Michal Petr

Anotace

V originále

Recent measurement studies have highlighted security threats against the code-signing public key infrastructure (PKI), such as certificates that had been compromised or issued directly to the malware authors. The primary mechanism for mitigating these threats is to revoke the abusive certificates. However, the distributed yet closed nature of the code signing PKI makes it difficult to evaluate the effectiveness of revocations in this ecosystem. In consequence, the magnitude of signed malware threat is not fully understood. In this paper, we collect seven datasets, including the largest corpus of code-signing certificates, and we combine them to analyze the revocation process from end to end. Effective revocations rely on three roles: (1) discovering the abusive certificates, (2) revoking the certificates effectively, and (3) disseminating the revocation information for clients. We assess the challenge for discovering compromised certificates and the subsequent revocation delays. We show that erroneously setting revocation dates causes signed malware to remain valid even after the certificate has been revoked. We also report failures in disseminating the revocations, leading clients to continue trusting the revoked certificates.

Citovat

KIM, Doowon, Bum Jun KWON, Kristián KOZÁK, Christopher GATES a Tudor DUMITRAȘ. The Broken Shield: Measuring Revocation Effectiveness in the Windows Code-Signing PKI. Online. In 27th USENIX Security Symposium (USENIX Security 18). Baltimore, MD: USENIX Association, 2018, s. 851-868. ISBN 978-1-931971-46-1.

@inproceedings{1427677,
   author = {Kim, Doowon and Kwon, Bum Jun and Kozák, Kristián and Gates, Christopher and Dumitraș, Tudor},
   address = {Baltimore, MD},
   booktitle = {27th USENIX Security Symposium (USENIX Security 18)},
   keywords = {code signing; revocation},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {Baltimore, MD},
   isbn = {978-1-931971-46-1},
   pages = {851-868},
   publisher = {USENIX Association},
   title = {The Broken Shield: Measuring Revocation Effectiveness in the Windows Code-Signing PKI},
   url = {https://www.usenix.org/conference/usenixsecurity18/presentation/kim},
   year = {2018}
}

TY  - JOUR
ID  - 1427677
AU  - Kim, Doowon - Kwon, Bum Jun - Kozák, Kristián - Gates, Christopher - Dumitraș, Tudor
PY  - 2018
TI  - The Broken Shield: Measuring Revocation Effectiveness in the Windows Code-Signing PKI
PB  - USENIX Association
CY  - Baltimore, MD
SN  - 9781931971461
KW  - code signing
KW  - revocation
UR  - https://www.usenix.org/conference/usenixsecurity18/presentation/kim
N2  - Recent measurement studies have highlighted security threats against the code-signing public key infrastructure (PKI), such as certificates that had been compromised or issued directly to the malware authors. The primary mechanism for mitigating these threats is to revoke the abusive certificates. However, the distributed yet closed nature of the code signing PKI makes it difficult to evaluate the effectiveness of revocations in this ecosystem. In consequence, the magnitude of signed malware threat is not fully understood. In this paper, we collect seven datasets, including the largest corpus of code-signing certificates, and we combine them to analyze the revocation process from end to end. Effective revocations rely on three roles: (1) discovering the abusive certificates, (2) revoking the certificates effectively, and (3) disseminating the revocation information for clients. We assess the challenge for discovering compromised certificates and the subsequent revocation delays. We show that erroneously setting revocation dates causes signed malware to remain valid even after the certificate has been revoked. We also report failures in disseminating the revocations, leading clients to continue trusting the revoked certificates.
ER  -

KIM, Doowon, Bum Jun KWON, Kristián KOZÁK, Christopher GATES a Tudor DUMITRAȘ. The Broken Shield: Measuring Revocation Effectiveness in the Windows Code-Signing PKI. Online. In \textit{27th USENIX Security Symposium (USENIX Security 18)}. Baltimore, MD: USENIX Association, 2018, s.~851-868. ISBN~978-1-931971-46-1.

Podrobný výpis o publikaci