Let's Encrypt certs compromised to shield malware

The crooks keep coming on

[tangor]

Let's Encrypt responds It was inevitable. Trend Micro says it has spotted crooks abusing the free Let's Encrypt certificate system to smuggle malware onto computers.

The security biz's fraud bod Joseph Chen noticed the caper on December 21. Folks in Japan visited a website that served up malware over encrypted HTTPS. The site used the Angler Exploit Kit to infect their machines with the software nasty, which is designed to raid their online bank accounts.

The use of encryption shields the malware from network security scanners while in transit, and the certificate helps legitimize the malicious site.

[theregister.co.uk...]

[bill]

Hacked servers have always been the issue for transactions like this. If you loose control of your server or DNS then this sort of attack was available even without free certs. The free certs do make the job a bit easier due to the lower requirements for certificate authentication. The paid SSL cert providers can certainly use this to promote their products.