# How does the Flame malware take advantage of MD5 collision?

It's said that malware Flame used an MD5 collision to get "a counterfeit copy of the certificate".

We know that MD5 is broken on collision attack, but not broken on pre-image attack, thus the only way to get a fake cert is to generate the fake cert when applying for a legitimate cert.

My questions are :

1. Isn't it too dangerous for the virus maker to do this? (We can check who applied for the legitimate cert and catch him.)

2. If he can apply for a legitimate cert, why bother making a couterfeit cert? Why don't use the legitimate cert to sign anything he like?

I think you missed reading a part of that Wikipedia article:

… Flame was signed with a fraudulent certificate purportedly from the Microsoft Enforced Licensing Intermediate PCA certificate authority. The malware authors identified a Microsoft Terminal Server Licensing Service certificate that inadvertently was enabled for code signing and that still used the weak MD5 hashing algorithm, then produced a counterfeit copy of the certificate that they used to sign some components of the malware to make them appear to have originated from Microsoft.

(emphasis mine)

In simpler words this means that the malware author(s) didn’t need to apply for a certificate himself/herself/themselves. Instead, the malware author(s) used a genuine Microsoft certificate he/she/they found and created a fake certificate based on that. That way, it seems as if Microsoft itself has signed some files – which Microsoft (of course) didn’t.

thus the only way to get a fake cert is to generate the fake cert when applying for a legitimate cert.

… is partly correct, but it’s only one side of the coin. The other way to get a fake certificate is to find a legitimate but weak and exploitable certificate from someone else – like one from Microsoft in this case.

1. Isn't it too dangerous for the malware author(s) to do this? (We can check who applied for the legitimate cert and catch him)

No, since the fake certificate was based on a Microsoft certificate the malware author(s) got his/her/their hands on. That way, the fake certificate points to Microsoft (just like the genuine certificate it was based on), not the identity of any malware author(s).

1. If he can apply for a legitimate cert, why bother making a couterfeit cert? Why don't use the legitimate cert to sign anything he like?

Not being Microsoft, the malware author(s) would hardly have had a chance to apply for a legit Microsoft certificate… and a certificate on his/her/their own name(s) would indeed have been pretty useless for his/her/their intended purposes as that would have added his/her/their name(s) to the equation.

Applying for his/her/their own legitimate certificate would have been a pretty stupid move while having the option to impersonate a trusted company like Microsoft. Remember the fact that the malware author(s) had access to a genuine Microsoft certificate with code signing enabled. (see first quote of my answer)

All in all you could say the malware author(s) found "a pot full of gold at the end of some rainbow" (read: a weak and exploitable Microsoft certificate with code signing enabled) and used what he/she/they found to his/her/their fullest malicious advantage.

Microsoft dropped a ball, and the malware author(s) picked it up. It was that simple for them. After Microsoft became aware of the situation, they handled the situation accordingly.

Quoting "Microsoft releases Security Advisory 2718704" dated June 3, 2012:

We are taking several steps to remove this risk:

• First, today we released a Security Advisory outlining steps our customers can take to block software signed by these unauthorized certificates.
• Second, we released an update that automatically takes this step for our customers.
• Third, the Terminal Server Licensing Service no longer issues certificates that allow code to be signed.

These actions will help ensure that any malware components that might have been produced by attackers using this method no longer have the ability to appear as if they were produced by Microsoft.

(emphasis mine)

# But how did they do it?

In the Flame case, the attackers took a legitimate Microsoft certificate using MD5 for its hash and RSA-2048 for its public-key encryption. They then generated a similar-but-different certificate with the same MD5 hash. This means that the RSA-2048 signature from Microsoft’s genuine certificate could be grafted into their forged certificate to make it appear valid.

Obviously, the above quote doesn’t really provide any real details.

In fact, explaining all the details would be a bit too broad to post as an answer here, but if you really want to dive deeper into an analysis of the Flame MD5 case, check the PDF: “Analyzing the MD5 collision in Flame”. Those 40 pages/slides walk you through details with screenshots etc.

Long story short: For Flame, a chosen-prefix collision attack against MD5 has been used. Its malware author(s) used a new variation of a chosen-prefix collision attack to spoof code signing of its components by a Microsoft root certificate that still used the compromised MD5 algorithm.

• Thanks for you reply. Yes I read that emphasized part, but as mentioned, MD5 is broken against collision attack (we can generate $a,b$ satisfying $MD5(a)=MD5(b)$), but isn't broken against (second) pre image attack( Given $a$, it's (nearly) impossible to generate $b$ with $MD5(b)=MD5(a)$), that's why I guess they may applied for a cert as well. If they didn't apply for a cert, that means they launched a successful second pre image attack on MD5, how could that happen? Feb 24, 2017 at 4:36
• @vince.h.c Edited my answer. See "But how did they do it?" Feb 24, 2017 at 4:41
• I have read the 2004 & 2008 paper, all they did is collision attack, not second pre image attack(the 2008 paper has to apply for a legit cert to generate a fake cert). But in order to fake a MS cert, one has to launch a second pre image attack. :( Feb 24, 2017 at 4:50
• @vince.h.c Re the 2008 paper has to apply for a legit cert to generate a fake cert – So? Note that the malware author(s) used a new variation of a chosen-prefix collision attack to spoof code signing of its components by a legit Microsoft root certificate that still used MD5. In other words: a legit cert was accessibile to them (until Microsoft became aware of the issue and took care of their own glitch). No second pre image attack needed! Check that PDF I linked to at the end of my answer… it’ll provide the needed insights to grasp how the legit MS cert was exploited with an MD5 attack. Feb 24, 2017 at 5:32
• Read the 40 page and got it. Is this a better way to explain? Everyone can ask MS CA to issue a Terminal LS cert -> Terminal LS cert cannot be used to sign codes on Vista and Win7 -> The adversary use MD5 collision to generate a cert that's able to sign codes (But he do have to apply for a Terminal LS cert) Feb 24, 2017 at 7:39