Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1039872" data-attributes="member: 32260">The sources presented in this thread show that Authenticode signature validation is not perfect (by design), so it can pose a security risk:<ol>
<li data-xf-list-type="ol">It was exploited in the past and probably still can be exploited in the future. The exploit could run the malicious code embedded in the signed executable.</li>
<li data-xf-list-type="ol">In some cases, it can be abused to make a trojan downloader.</li>
<li data-xf-list-type="ol">In some cases, it can be abused to download the malware.</li>
<li data-xf-list-type="ol">It can be easily abused to hide the malicious code.</li>
</ol>The potential security risk can be high (especially via point 1), but such attacks are very rare.The scenarios via points 2-3 are probably uncommon, because I did not see such attacks for several years.The scenario from point 4 was well explained by [USER=86910]@struppigel[/USER], but it makes sense only in the targeted attacks.For home users, the real security risk of abusing Authenticode signature validation is rather low, compared to the risk of malware legally signed by the attacker, malware with a stolen certificate, or DLL hijacking via a vulnerable digitally signed program.</blockquote>

[QUOTE="Andy Ful, post: 1039872, member: 32260"] The sources presented in this thread show that Authenticode signature validation is not perfect (by design), so it can pose a security risk: [LIST=1] [*]It was exploited in the past and probably still can be exploited in the future. The exploit could run the malicious code embedded in the signed executable. [*]In some cases, it can be abused to make a trojan downloader. [*]In some cases, it can be abused to download the malware. [*]It can be easily abused to hide the malicious code. [/LIST] The potential security risk can be high (especially via point 1), but such attacks are very rare. The scenarios via points 2-3 are probably uncommon, because I did not see such attacks for several years. The scenario from point 4 was well explained by [USER=86910]@struppigel[/USER], but it makes sense only in the targeted attacks. For home users, the real security risk of abusing Authenticode signature validation is rather low, compared to the risk of malware legally signed by the attacker, malware with a stolen certificate, or DLL hijacking via a vulnerable digitally signed program. [/QUOTE]

Verification