Typhoon-like gang slinging TLS certificate 'signed' by LAPD (www.theregister.com)
from PhilipTheBucket@ponder.cat to cybersecurity@sh.itjust.works on 24 Jun 00:58
https://ponder.cat/post/3454638

#cybersecurity

threaded - newest

treadful@lemmy.zip on 24 Jun 02:25 collapse

Upon execution, ShortLeash generates a self-signed, TLS certificate that presents as if signed by the City of Los Angeles Police Department (LAPD). That name suggests those behind the campaign are attempting to spoof the police department to appear legitimate. It also gave the ORB network its name: LapDogs.

So it’s a self-signed cert with LAPD in the metadata.

The purpose of the malware itself is not known - it’s encrypted, and Security Scorecard said it requires further analysis.

But who knows, maybe there’s a reason it uses that other than obfuscation or a joke. Though anything doing authentication via a self-signed cert’s metadata is completely broken anyway.