Original URL: https://www.theregister.com/2012/09/27/adobe_cert_revoked/
Adobe scrambles to revoke stolen cert
Malware signed as Adobe software
Posted in Security, 27th September 2012 22:51 GMT
Adobe has revealed an attack that compromised some of its software development servers, resulting in its code signing certificate being used to disguise malware as Adobe software.
The attackers compromised a build server, Adobe says in this statement, which had “access to the Adobe code signing infrastructure”. The build server had been put into service even though “the details of the machine’s configuration were not to Adobe corporate standards”.
The company is now revoking the certificates, which had been used to sign at least pwdump7 v7.1, which extracts password hashes from Windows; libeay32.dll, which works in conjunction with pwdump; and myGeeksmail.dll, which it describes as a malicious ISAPI filter.
Adobe says it has set up an interim signing service for all components signed with the impacted key since July 10, 2012. New certificates will be issued on October 4, the company says.
On this page, Adobe provides information for users of its software to determine whether they need to take any action.
The breach “only affects the Adobe software signed with the impacted certificate that runs on the Windows platform and three Adobe AIR applications that run on both Windows and Macintosh”, the statement says. ®