Digital code signing certificates are more valuable on the dark web than many other illegally traded goods, like credit card numbers, fake passports or handguns. Researchers from Venafi said these certificates routinely cost up to $1,200 on the black market. By comparison, US passports cost about $850, handguns $600 and credit cards just a few bucks.
Digital code signing certificates verify the legitimacy of software downloads. With them, criminals can make malware appear to be desirable applications. “We’ve known for a number of years that cybercriminals actively seek code signing certificates to distribute malware through computers,” said Peter Warren, chairman of the Cyber Security Research Institute (CSRI). “The proof that there is now a significant criminal market for certificates throws our whole authentication system for the internet into doubt and points to an urgent need for the deployment of technology systems to counter the misuse of digital certificates.”
