Author: Prabhat Kumar Tomar

Reading Time : 5 minutes

In early 2021, it was reported that a ransomware group had stolen code signing certificates from NVIDIA, a leading graphics processing unit (GPU) manufacturer. Code signing certificates play a vital role in ensuring the legitimacy and reliability of software, and their theft can result in significant repercussions for both individuals and companies. In this article, we will explore what code-signing certificates are, how they are used, the risks associated with their theft, and what steps you can take to protect yourself.

“NVIDIA Code Signing Certificates Theft: A Wake-up Call for Robust Security Measures.”

The theft of code signing certificates from NVIDIA is a significant security breach that highlights the vulnerability of digital certificates and the importance of securing them. NVIDIA is a leading GPU manufacturer with a global customer base that relies on its software and products for various applications. With the theft of its code signing certificates, there is a risk that attackers could use them to distribute malware that appears to be from NVIDIA, which could have severe consequences for individuals and organizations. This incident underscores the need for robust security measures and the importance of implementing best practices to protect against cyber threats.

What are Code Signing Certificates?

Code signing certificates are digital certificates issued by trusted third-party certificate authorities (CAs) used to sign software. When a code signing certificate is used to sign software, it provides assurance that the software has not been tampered with or modified since it was signed and came from a trusted source.

Code signing certificates usually include the name of the software publisher, a timestamp, and a unique serial number. During the installation of software that has been signed with a code signing certificate, the user’s computer conducts an authenticity check by verifying the certificate’s digital signature against the certificate authority’s public key.

The Risks of Stolen Code Signing Certificates

The theft of code signing certificates can have serious consequences. With a stolen certificate, an attacker can sign their malware and make it appear legitimate. This can deceive both users and security software, allowing the attacker to obtain confidential data or take control of a victim’s system.

In the case of NVIDIA, the REvil ransomware group stole three code-signing certificates that were used to sign drivers for NVIDIA’s GPUs. While there is no evidence that the certificates have been misused yet, the theft could allow attackers to sign and distribute malware that appears to be from NVIDIA. This could have serious consequences for individuals and organizations that rely on NVIDIA’s Software.

How to Protect Yourself from Code Signing Certificate Theft

To protect yourself from the theft of code signing certificates, there are several steps you can take:

1. Keep Software Up to Date

   It is a necessary step in protecting yourself from attacks. It is imperative to ensure that the latest versions of the software, which have been signed with code signing certificates and contain the latest security patches, are being utilized.

2. Verify Certificate Authenticity

   When you are installing software, make sure to verify the authenticity of the code signing certificate. This can be done by checking the publisher’s name, the timestamp, and the unique serial number against the certificate authority’s public key. If any of these do not match, This might imply that the certificate has been tampered with or is invalid.

3. Use Multi-Factor Authentication

   Multi-factor authentication adds an extra security layer to your accounts by requiring more than one authentication method. It will make it difficult for attackers to gain access to your accounts even if they have stolen your code signing certificate.

4. Protect Your Private Keys

   Code signing certificates are only effective if the private key used to sign the software is kept secure. Make sure to protect your private keys with strong passwords, and consider storing them in a secure hardware device such as a smart card or USB token.

5. Monitor for Suspicious Activity

   Regularly monitor your systems for suspicious activity, such as unexpected software installations or network traffic. This can help to identify potential attacks early and allow you to take action to mitigate the damage.

Conclusion

By proactively protecting yourself from the theft of code signing certificates, you can help mitigate the risks and keep your systems and data secure. While staying ahead of cyber threats can be challenging, taking these steps can significantly reduce your risk and give you peace of mind. As technology continues to advance, it’s essential to stay informed and adapt your security practices accordingly. Remember to stay vigilant and stay up to date with the latest security best practices to protect yourself from the ever-evolving threat of cyber-attacks.

FIPS (Federal Information Processing Standard) 140-2 is a set of standards established by the National Institute of Standards and Technology (NIST) for security requirements in cryptographic modules used in government systems. Cryptographic modules are computer hardware or software that protect data through encryption or other cryptographic methods. The purpose of the FIPS 140-2 standard is to provide a level of assurance that these cryptographic modules are secure and will protect sensitive information from unauthorized access or tampering.

FIPS 140-2 security levels

The standard defines four security levels, each representing an increased security level. The levels range from minimal protection to the highest level of security available. They are intended to provide organizations with a way to choose a cryptographic module that meets their specific security requirements. The four security levels are as follows

1. Level 1

   This level provides basic protection and is used for applications where cost is a primary consideration. The security requirements at this level are minimal and are designed to prevent the most basic attacks.

2. Level 2

   This level provides increased security compared to Level 1 and is used for applications where security is more important than cost. This level includes additional security requirements such as key generation, storage, and operational security.

3. Level 3

   This level offers the highest level of security available under the FIPS 140-2 standard and is used for applications that require the highest level of security. At this level, cryptographic modules must provide multiple layers of security and must be tested against a comprehensive set of attacks.

4. Level 4

   This level provides the ultimate level of security and is used for applications that require the protection of classified information. Cryptographic modules at this level must meet stringent security requirements and be tested against various sophisticated attacks.

Security Levels Comparison based on

Physical Security

1. Level 1

   Basic physical security mechanisms, such as tamper-evident packaging, are in place.

2. Level 2

   Intermediate physical security mechanisms, such as tamper-evident packaging and secure power and reset controls, are in place.

3. Level 3

   High physical security mechanisms, such as tamper-evident packaging, secure power and reset controls, and physical protection against tampering and unauthorized access, are in place.

4. Level 4

   The highest level of physical security, with physical protection against tampering and unauthorized access and a secure environment for the module.

Cryptographic Key Management

1. Level 1

   Limited key management, with the keys generated and used within the module.

2. Level 2

   Improved key management, with the keys generated, stored, and used within the module, and the ability to securely update keys.

3. Level 3

   Robust key management, with secure key generation, storage, and use, and the ability to securely update keys.

4. Level 4

   The highest level of key management, with secure key generation, storage, use, and the ability to securely update keys, and a secure environment for the module.

Approved Algorithms

1. Level 1, 2, and 3

   AES, DES/3DES, RC2, RC4, SHA-1/224/256/384/512, DSA, ECDSA algorithms are approved for use at each level.

2. Level 4

   AES, DES/3DES, RC2, RC4, SHA-1/224/256/384/512, DSA, ECDSA algorithms are approved for use at this level.

It’s important to note that the specific security requirements for each level and the algorithms approved for use at each level may be subject to change as technology and security needs evolve.

FIPS 140-2 Security Levels Key Features

Cryptographic algorithms

Cryptographic algorithms play a crucial role in protecting sensitive information and are an important consideration when choosing a cryptographic module. FIPS 140-2 requires that all cryptographic algorithms used in cryptographic modules be approved by NIST and strong enough to provide the required level of security. In addition, the standard requires that cryptographic algorithms be implemented correctly in the cryptographic module to ensure the desired level of security is achieved.

Key management

Key management is a vital component of any cryptographic system, and FIPS 140-2 requires that all cryptographic modules implement secure key management processes. The standard specifies key generation, storage, and transmission requirements to ensure that cryptographic keys are protected from unauthorized access or tampering. This includes requirements for secure key storage, secure key transmission, and the use of secure key escrow processes.

Physical security

Physical security is a vital aspect of protecting cryptographic modules, and the FIPS 140-2 standard specifies requirements for the physical security of cryptographic modules. This includes requirements for the environment in which the cryptographic module must operate, such as temperature, humidity, and electromagnetic interference, and for physical protection from tampering or theft.

Operational security

Operational security refers to the security of the cryptographic module during normal operation, and the FIPS 140-2 standard specifies requirements for operational security. This includes requirements for user authentication, access control, audit logging, and protecting the cryptographic module against unauthorized access, tampering, or modification.

Testing and certification

To ensure compliance with the FIPS 140-2 standard, cryptographic modules must undergo extensive testing by an accredited third-party laboratory. The laboratory must be accredited by NIST and must follow the procedures specified in the standard. Once the cryptographic module has been tested and certified as compliant with the standard, it can be used in government systems that use cryptographic modules that meet the FIPS 140-2 security requirements.

Conclusion

In conclusion, using FIPS 140-2 cryptographic modules assures organizations that their cryptographic systems meet rigorous security requirements and are suitable for protecting sensitive information. By requiring strict security requirements for key management, physical security, operational security, and testing and certification, the FIPS 140-2 standard guarantees that their cryptographic systems are secure, and that sensitive information is protected against unauthorized access or tampering.

The standard provides a clear framework for evaluating cryptographic modules and helps organizations to choose a cryptographic module that meets their specific security needs.

It is important for organizations to be aware of the security requirements specified by the FIPS 140-2 standard and to choose cryptographic modules that meet the standard’s requirements. This will ensure that their cryptographic systems are secure and provide the required level of protection for sensitive information. 

Quantum computers analyze enormous data sets and execute complex computations significantly faster than traditional computers. Google constructed a quantum computer in 2019 that could calculate in 3 minutes and 20 seconds. Still, regular supercomputers would have taken 10,000 years to solve the identical calculation, proving quantum edge or quantum supremacy.

While quantum computing is still in its early stages, upheavals in various areas, including cybersecurity, may occur much sooner than you think. The impact of quantum computing on cybersecurity is tremendous and game-changing.

Quantum computing shows significant promise in various fields, including weather forecasting, artificial intelligence, medical research, etc. However, it poses a substantial threat to cybersecurity, necessitating a shift in how we secure our data.

While quantum computers cannot currently break most of our present types of encryptions, we must immediately keep ahead of the risk and develop quantum-proof solutions. It will be too late if we wait till those powerful quantum computers begin breaking our encryption.

An additional reason to act now

Regardless of when commercially available quantum computers will emerge, the potential of malicious actors harvesting data is another reason to quantum-proof data now. They are already grabbing data and storing it until they can obtain a quantum computer to decipher it.

The data will have already been compromised at that point. The only way to maintain information security, particularly information that must be kept indefinitely, is to protect it today via quantum-safe key transmission.

Quantum Threat to Cybersecurity

Quantum computers will be capable of solving issues that traditional computers are incapable of solving. This involves deciphering the algorithms underlying the encryption keys that safeguard our data and the Internet’s infrastructure.

The encryption used nowadays is largely built on mathematical calculations that would take far too long to decipher on today’s machines. Scientists have been working on constructing quantum computers that can factor progressively bigger numbers since then. Consider two large integers and multiply them together to simplify this. It’s simple to calculate the product, but it’s considerably more difficult to start with a huge number and divide it into its two prime numbers. However, a quantum computer can readily factor those numbers and break the code.

Peter Shor created a quantum method (aptly titled Shor’s algorithm) that can factor in big numbers far faster than a traditional computer.

Today’s RSA encryption is extensively used for transferring critical data over the Internet and is based on 2048-bit numbers. Experts believe that breaking that encryption would require a quantum computer with up to 70 million qubits. The largest quantum computer available today is IBM’s 53-qubit quantum computer, so it may be long before that encryption to be broken.

As the speed of quantum research continues to accelerate, such a computer cannot be developed within the next 3-5 years.

For example, Google and Sweden’s KTH Royal Institute of Technology discovered “a more efficient technique for quantum computers to do the code-breaking calculations, decreasing required resources by orders of magnitude” earlier this year. Their research, featured in the MIT Technology Review, proved that a 20 million-qubit computer could break a 2048-bit number in about 8 hours. However, given the rapid speed of quantum research, such a computer cannot be developed within 3-5 years. That means that continued advances like this will keep pushing the timescale forward.

It’s worth mentioning that perishable sensitive data isn’t the major concern when it comes to the quantum encryption issue. The more serious concern is the susceptibility of information that must remain secret indefinitely, such as banking data, privacy data, national security-level data, etc. Those are the secrets that need to be protected by quantum-proof encryption right now.

Adapting Cybersecurity to Respond to the Threat

Researchers have been working hard to produce “quantum-safe” encryption in recent years. There are many unanswered problems in quantum computing, and scientists are working hard to find answers.

However, one thing is certain about the influence of quantum computing on cybersecurity: it will represent a danger to cybersecurity and current types of encryptions. To mitigate that threat, we must change how we secure our data and begin doing it now.

We must handle the quantum threat the same way we approach other security vulnerabilities: by adopting a defense-in-depth strategy that includes many layers of quantum-safe protection. Security-conscious enterprises recognize the need for crypto agility.

They are looking for crypto-diverse solutions, such as those provided by Encryption Consulting LLC, quantum-safe their encryption now and quantum-ready for tomorrow’s challenges.

In February, TikTok agreed to pay $92 million to resolve a class-action privacy lawsuit.

The plaintiffs claim TikTok obtained biometric data illegally, mined user information from unpublished draughts, and improperly shared data with third firms such as Google and Facebook.

What Happened Next?

TikTok has agreed to resolve a class-action lawsuit over the collection and use of personal data from TikTok users. This agreement was reached because of 21 lawsuits, a few of which were filed on behalf of minors, and it affects about 89 million TikTok users.

TikTok rejected all the charges made in the complaints but agreed to a $92 million settlement for affected users. “While we disagree with the statements, rather than engaging in prolonged litigation, we’d like to focus our efforts on creating a safe and pleasant experience for the TikTok community,” TikTok said in February after reaching a deal.

So, what aspects of personal information and data privacy did TikTok violate? We can’t be sure because the lawsuit was settled out of court. However, based on the charges and TikTok’s settlement, we can detect possible and likely privacy violations.

The Personal Data Problem

The plaintiffs claim TikTok obtained biometric data illegally, mined user information from unpublished draughts, and inappropriately shared data with third-party firms such as Google and Facebook.

TikTok is accused of using face recognition to obtain a competitive edge over other social media apps. According to the lawsuit, facial recognition was utilized to assess personal information like as age, gender, and race in order to recommend content.

The Illinois Biometric Information Privacy Act granted Illinois residents the opportunity to sue TikTok for utilizing their biometric information without their permission.

The suit claimed that the app mined information from drafted and unposted films and that the user’s personal data was being improperly provided to third parties.

TikTok apparently made improvements as part of the deal to avoid the lawsuit going to trial. They will erase some data; however, whether this data is unpublished draughts or biometrics is unknown.

TikTok has also stated that it will no longer gather biometric data, track user location, harvest information from user-created content, or store US citizens’ data outside the US. All of this, however, may be rectified if its privacy policies are openly published.

The Settlement

Although a $92 million settlement may appear considerable, if applied to all impacted consumers, those in the nationwide subclass would receive a compensation of $0.96 due to attorney fees.

On the other hand, Illinois residents will earn more (up to $5.75 if every eligible person files a claim). Even if only 20% of users claim a portion of the settlement, customers nationwide may only earn $4.79.

An app notice notified Eligible users of the TikTok Data Privacy Notice of Settlement. These specifics can still be seen on the TikTok data privacy settlement website.

Even though TikTok has not agreed to any privacy violations, this settlement has resulted in TikTok entering into new agreements to protect users’ personal data and biometric data.

Many individuals are concerned about TikTok’s suspected use of personal data because they were previously ignorant of the app’s privacy concerns. While the social media behemoth was able to resolve these allegations out of court, the case demonstrates customers’ growing awareness of privacy concerns.