Bit9 is the latest victim in a series of high-profile security vendors that have been hit by targeted attacks that compromised their security technology, prompting calls for vendors to unite and share their attack information in order to better detect and protect against these attacks that ultimately affect their customers and the overall security infrastructure as well.
The whitelisting security vendor’s CEO Patrick Morley late Friday announced via a blog post that the company had suffered a breach that exposed one of its digital code-signing certificates to the attackers who then used it to sign malware, affecting three of its customers. Morley says an “operational oversight” led to the breach, with a handful of computers on its network running without the company’s own product. “We simply did not follow the best practices we recommend to our customers by making certain our product was on all physical and virtual machines within Bit9,” Morley said. “There is no indication that this was the result of an issue with our product. Our investigation also shows that our product was not compromised,” and the company revoked the compromised certificate and issued a new one, he said.
Bit9 plans to issue a patch to automatically detect and stop execution of any malware that uses the phony certificate, and is monitoring its Software Reputation Service for hashes from that malware. The breach follows that of RSA two years ago and certificate authorities such as DigiNotar and Comodo, as well as the Flame cyberespionage malware’s attack on weak encryption used in Microsoft’s Terminal Services that led to the creation of rogue digital certificates posing as Microsoft-signed ones.
[ Join us at Interop Las Vegas for access to 125+ IT sessions and 300+ exhibiting companies. Register today! ]
Security vendors–like defense contractors, the financial services industry, and now, the media—are in the bull’s eye of targeted attack campaigns as well. That of course should come as no surprise, since their technology if compromised can then in turn be used to help hack into their customers’ networks. So like other vertical industries, security vendors need to band together and fight back by sharing attack information they get from their experiences, security experts say, even if it means potentially giving up a little competitive edge by sharing that attack information.