4 ms·
That's very interesting but I have to disagree with the response. The vuln might be used iirc to bypass signature verification of the PE? It might also possibly
by badrabbit 7y ago
That's very interesting but I have to disagree with the response. The vuln might be used iirc to bypass signature verification of the PE? It might also possibly be used to evade sandbox analysis of malware, AV heuristics and ML based approaches might also be thrown off guard.
But yes, It would have been a lot more interesting if there are cases where the executable is attacker controlled and the exploit would end up running code as the privileged parent process or some other user that has more rights.
- satanspastaroll 7y agoModifying the binary should change it's digital signature, making it invalid in the first place. Running unsigned code is running arbitrary code
- badrabbit 7y agoNo,what I meant was the header containing the signature does not get included in PE sig verification, since sig/certs are part of the header to begin with, or at least large parts of the header are not included. I vaguely remember bypass techniques that depended on this.