Feeds

Bit9 hacked after it forgot to install ITS OWN security product

Malware signed by stolen crypto certs then flung at big-cheese clients

Choosing a cloud hosting partner with confidence

IT security biz Bit9's private digital certificates were copied by hackers and used to cryptographically sign malware to infect the company's customers.

The software-whitelisting firm's certificates were swiped when its core systems were hacked last week. The intruders then signed malicious code and distributed it to the company's corporate clients.

A number of Bit9's customers were subsequently infected by the malware because the software was - thanks to the purloined certificates - regarded as safe by networks guarded by Bit9's technology.

Bit9 confessed to the breach in a blog post on Friday, blaming the incident of an "operational oversight" and human error that exposed its core systems to attack, rather than any shortcomings with the security services it sells.

Due to an operational oversight within Bit9, we failed to install our own product on a handful of computers within our network. As a result, a malicious third party was able to illegally gain temporary access to one of our digital code-signing certificates that they then used to illegitimately sign malware.

Bit9 said that its subsequent investigation discovered that three of its customers were affected by the illegitimately signed malware. It's continuing to monitor the situation. In the meantime its has revoked the compromised certificate and patched up its previously insecure systems.

Bit9's technology is used by parts of the US government and 30 fortune 100 firms, among others, according to investigative journalist turned security blogger Brian Krebs, who broke news on the Bit9 breach.

Its technology is used to mark known good applications as safe to run, rather than keep track of known bad applications and trying to block them.

It's unclear whether it was Bit9 or its customers who first realised that something was wrong. But it would be ironic indeed if the Bit9-endorsed malware was first picked up by the antivirus scanners Bit9 regularly decries as useless in guarding against the latest generation of advanced, targeted hacking attack.

Bit9 admitted it had been hit by an advanced attack hours after posting a blog post titled "It’s the Same Old Song: Antivirus Can’t Stop Advanced Threats".

"This incident is a classic example of why relying on one technology to protect your network can be so risky," notes security consultant Brian Honan.

Honan says the attack aimed to exploit the confidence its client placed in Bit9 in much the same way that the attack against RSA Security was used in attempts to infiltrate the remote access systems of RSA SecurID two-factor authentication customers two years ago. ®

Beginner's guide to SSL certificates

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.