Meet the 'Creatures' FeatureMar 10th, 2020
This series covers the more exotic incidents observed at our client sites and how SMARTMonitoring was able to Detect these creatures.
The beast: certuil
In some cases, programs attempt to load additional root certificates into the store.
By forcing the user to trust all certificates signed by this new root the programmer scan insert themselves between the user and their destination web site.
For example, if a user wants to check their gmail account, the little lock icon will be locked and the website should say that it's from Google. In this case however the certificate showed the intercepted certificate which could be secretly operated by the "Man-in-the-Middle" (MitM)to spy on the users.
How did we catch this beast using CYDEF SMARTMonitor?
Regardless of whether the software was legitimate, CYDEF SMARTMonitor Analysts were immediately concerned by the installation of the certificate and the potential for a MitM attack.
After research and discussions with regional experts, CYDEF was further able to determine that this was likely part of a long-term campaign by the Kazakh government to perform mass surveillance on their citizens
Why AV alone couldn’t help
This particular incident is not malware. It’s a legitimate software introducing a significant cyber risk tothe organizationwhich pushes it out of scope for most AV products.
Need more info? Let's talk