D-Link, a Taiwanese networking equipment company, accidentally published the code that the company uses to sign its software in the firmware source code.
A Norwegian programmer known as bartvbl recently purchased a surveillance camera (the DCS-5020L) from the company, and while inspecting its firmware source code, he discovered four keys that the company uses to sign the software it develops.
[pullquote] Malware virtually invisible to any kind of anti-virus[/pullquote]After much experimentation with the keys, he managed to create a Windows application, which he signed with one of the four keys.
So the application appeared to come from D Link. The other three keys do not appear to be valid.
The Norwegian developer's discovery was confirmed by security firm Fox-IT to Dutch tech website Tweakers:
“The signing certificate is indeed from a software package, with firmware version 1.00b03, which was released on February 27th of this year.”
Meanwhile, the Taiwanese company has revoked the certificate in question and is starting to distribute new firmware versions that apparently do not contain a code signing key.
It should be noted that if these keys had ended up in the hands of a malicious user, they would have given them the ability to create and distribute malicious software that could pass as an official D-Link.
This would make it virtually invisible to any type of anti-virus.
