STIX in Action: DigSig Metadata Sharing to Complement CRLs
The case has been made for explicitly sharing DigSig Metadata for Windows Portable Executables within the scope of Threat Intelligence. Two years on, digitally signed malware is still very much a thorn in our side, and one potential solution continues to abide in a more robust sharing of DigSig Metadata for such malware.
This time, however, our focus must shift to providing an end-to-end proposal, technical, legal and administrative, for collaborative sharing of DigSig Metadata. We had covered the “Why?” back in 2024, but we barely touched upon the “How?”. We must also extend our discussion beyond Windows PE to other types of signed executable binaries, such as Android APK and Mach-O for Mac.
In this talk we shall propose how DigSig Metadata for blocklisting signed malware can be accommodated within STIX 2.1. We shall also delve into the legal and administrative aspects to be considered in the distribution framework for such data sharing, seeking effective ways to complement the traditional Certificate Revocation Lists.
Our overall intent is to be able to improve trust in the Digital Signing ecosystem, thus helping it to become more pervasive in promoting overall ecosystem security. We shall include some real-world scenarios which demonstrate the efficacy of the said proposal.
Samir Mody – K7 Computing
Samir Mody graduated from the University of Oxford in 2000 with a First-Class Masters degree in Chemical Engineering, Economics and Management. He spent over 9 years at Sophos UK, the final 3 as Threat Operations Manager of SophosLabs. Since August 2010 he has been running K7 Labs in Chennai, India. Samir has actively contributed to the IEEE Taggant System project and other industry collaborations such as AMTSO and CTA. He has co-authored and/or presented papers and participated in panel discussions at various international security conferences (EICAR, VB, AVAR). Samirs interests include reading (philosophy, politics, history, literature, and economics), sport and classical music.