The Fairy Tale of 'What You See Is What You Sign' - Trojan Horse Attacks on Software for Digital Signatures

Software for the creation of digital signatures performs a delicate task. The signatory has to trust the manufacturer of the software that it will work in the intended way. Signing a document electronically will have legal consequences in a growing number of countries, therefore the security of the signing software is an important issue. In the past, Trojan horse programs have shown to be of growing concern for end-user computers. Software for digital signatures must provide protection against Trojan horses attacking the legally relevant signing process. In a survey of commercially-of-the-shelf signature software programs we found severe vulnerabilities that can easily be exploited by an attacker.