[A response and details from Bit9 have been posted.]
Bit9, a company that provides software and network security services to the U.S. government and at least 30 Fortune 100 firms, has suffered an electronic compromise that cuts to the core of its business: helping clients distinguish known "safe" files from computer viruses and other malicious software.
Waltham, Massachusetts-based Bit9 is a leading provider of "application whitelisting" services, a security technology that turns the traditional approach to fighting malware on its head. Antivirus software, for example, seeks to identify and quarantine files that are known bad or strongly suspected of being malicious. In contrast, Bit9 specializes in helping companies develop custom lists of software that they want to allow employees to run, and to treat all other applications as potentially unknown and dangerous.
But earlier today, Bit9 told a source for KrebsOnSecurity that their corporate networks had been breached by a cyberattack. According to the source, Bit9 said they'd received reports that some customers had discovered malware inside of their own Bit9-protected networks, malware that was digitally signed by Bit9's own encryption keys.
That last bit is extremely important, because Bit9 is a default trusted publisher in their software, which runs on customer PCs and networks as an "agent" that tries to intercept and block applications that are not on the approved whitelist. The upshot of the intrusion is that with a whitelist policy applied to a machine, that machine will blindly trust and run anything signed by Bit9.
[...]