Signed Malware = Expensive “Oops” for HP
Summary: HP is revoking a digital certificate on Oct. 21, 2014 after discovering it had been used in May 2010 to sign a trojan that was found on a server outside its network. HP traced the signing to a malware infection on a developer's computer, where the trojan renamed itself to mimic a testing file name and was inadvertently included in a signed software package; HP says the package never shipped to customers and that no private certificates were stolen.
Key Takeaway: The certificate was used to sign a large share of HP software, including hardware and software drivers, so revoking it forces HP to re-sign code already in use - and even Microsoft does not know how systems with built-in recovery partitions will behave when restored after revocation.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026