Marrakech has been a trading city since it was estab lished by a clan of Berber warriors the Almoravids in the 11th century. The heart of the city where Joann and I are staying is the medina, a densely packed, walled medieval city with over maze-like alleys full of noisy, chaotic souks marketplaces that sell everything from traditional textiles, pottery, and jewelry to food and spices to motorcycle parts.
Like all unregulated marketplaces, the Marrakech medina has its share of fakes and counterfeits. But the one fake that really interested me was counterfeit saffron. According to Wikipedia, saffron is the world's most costly spice by weight. Joann and I wanted to learn a bit about both the real and the fake saffron, so we spoke to a reputable spice merchant in the souk. He showed us both the real and fake product and what he looks for when buying wholesale.
While there are some good fakes that require pretty sophisticated testing , many fakes are easily spotted impostors. These are made by simply dying corn silk with either red food colouring or paprika. The tests to spot them are simple, as this Youtube video shows. This got me wondering: how can it be profitable to make and sell such poor quality fakes? Or much worse: in Middle Ages, those found selling adulterated saffron were executed under the Safranschou code.
Sadly, there must be a large enough cohort of people aka tourists? Later that night I realized that the cybersecurity world has been seeing this same situation playing out in the area of digital signatures for executable files aka code signing.
Some of the malware they investigated had been digitally signed with keys stolen from legitimate companies: Stuxnet being the most famous example of this sort of trickery. In other cases, malware was signed using certificates that had been mistakenly issued to malicious actors impersonating legitimate companies.
