3 ms·

On Windows this will require stripping a digital signature off the target exe file. Microsoft did a good job conditioning people into not running stuff that is

On Windows this will require stripping a digital signature off the target exe file. Microsoft did a good job conditioning people into not running stuff that is not signed, so BDF'd binaries are really no good for online distribution. Thought I guess this may work with users who run all and everything they download from the Internet.

onli 12y ago
> Microsoft did a good job conditioning people into not running stuff that is not signed Maybe this changed with Windows 8, but till Windows 7, Microsoft did a good job conditioning people to completely ignore the signature. Or at least the status of the signature, whether it is trusted or not. Is there a further escalation if there is no signature at all I'm not aware of? If not, there was a great article describing how much work was needed to get the small green checkmark by getting a signature as trusted, and how this did not have any benefit at all (because of styling and design of the dialogue, and UAC asking anyway for confirmation). Of course I don't find that now, but I'm pretty sure it was on HN some time ago, maybe you saw it (probably before Windows 8).
- pilif 12y ago
  Windows 8 is much more persistent in warning you when running unsigned binaries. And IE under Windows 8 flat-out refuses to let you run unsigned binaries. Getting binaries signed isn't that hard either.
_nullandnull_ 12y ago
If you are interested about this subject I'd recommend the following links and slides http://recon.cx/2012/schedule/events/246.en.html http://recon.cx/2012/schedule/events/246.en.html
- huhtenberg 12y ago
  It's a good read, but this was patched over 2 years ago.
midnite_runr 12y ago
Author here, I strip digital signature by default. Plus not everyone signs their windows binaries. Only Microsoft really. Plus I put BDF + mitmproxy together to patch binaries via MITM: https://github.com/secretsquirrel/BDFProxy https://github.com/secretsquirrel/BDFProxy
- huhtenberg 12y ago
  > Plus not everyone signs their windows binaries. Only Microsoft really. Hahaha... no, not really. Pretty much every commercial app is signed, even if it's a freeware. Otherwise you get promptly hell-banned by MS's own SmartFilter and flagged as suspicious by every antivirus.
  - midnite_runr 12y ago
    Hahaha, yea. OK, Apps coming from the Windows App Store are signed (same thing with apple). But I've been doing this research for a while and most windows application are NOT signed (even non-appstore commmercial software). AVs included, oh and sourceforge (they use NSIS, not certificates), that's freeware right? And AVs don't flag if you aren't signed, only if you have a bad signature, maybe (McAfee doesn't care). Plus I think you are meaning SmartScreen Filter, not SmartFilter; this doesn't stop malicious software, it only stops software that does have a bad signature, and warns when it's not commonly downloaded software (https://twitter.com/midnite_runr/status/451738775300087808/photo/1 https://twitter.com/midnite_runr/status/451738775300087808/p...), so even if it was signed like the picture IE says "I don't know George, wtf". When Jimmy McKittenButts want's his catScreenSaver.exe he's going to get it, SmartSceen Filter be damned. The _only_ thing that stops this is whitelisting (Applocker) and a smart user. Here's a sample from BDF, patched with a reverse shell and still works normally: https://www.virustotal.com/en/file/a31ed901abcacd61a09a84157887fc4a189d3fe3e3573c24e776bac8d5bb8a0f/analysis/1401385796/ https://www.virustotal.com/en/file/a31ed901abcacd61a09a84157... Edit: more sarcasm
    - deleted 12y ago
      [deleted]

onli 12y ago

> Microsoft did a good job conditioning people into not running stuff that is not signed Maybe this changed with Windows 8, but till Windows 7, Microsoft did a good job conditioning people to completely ignore the signature. Or at least the status of the signature, whether it is trusted or not. Is there a further escalation if there is no signature at all I'm not aware of? If not, there was a great article describing how much work was needed to get the small green checkmark by getting a signature as trusted, and how this did not have any benefit at all (because of styling and design of the dialogue, and UAC asking anyway for confirmation). Of course I don't find that now, but I'm pretty sure it was on HN some time ago, maybe you saw it (probably before Windows 8).

pilif 12y ago
Windows 8 is much more persistent in warning you when running unsigned binaries. And IE under Windows 8 flat-out refuses to let you run unsigned binaries. Getting binaries signed isn't that hard either.

_nullandnull_ 12y ago

If you are interested about this subject I'd recommend the following links and slides http://recon.cx/2012/schedule/events/246.en.html http://recon.cx/2012/schedule/events/246.en.html

huhtenberg 12y ago
It's a good read, but this was patched over 2 years ago.

midnite_runr 12y ago

Author here, I strip digital signature by default. Plus not everyone signs their windows binaries. Only Microsoft really. Plus I put BDF + mitmproxy together to patch binaries via MITM: https://github.com/secretsquirrel/BDFProxy https://github.com/secretsquirrel/BDFProxy

huhtenberg 12y ago
> Plus not everyone signs their windows binaries. Only Microsoft really. Hahaha... no, not really. Pretty much every commercial app is signed, even if it's a freeware. Otherwise you get promptly hell-banned by MS's own SmartFilter and flagged as suspicious by every antivirus.
- midnite_runr 12y ago
  Hahaha, yea. OK, Apps coming from the Windows App Store are signed (same thing with apple). But I've been doing this research for a while and most windows application are NOT signed (even non-appstore commmercial software). AVs included, oh and sourceforge (they use NSIS, not certificates), that's freeware right? And AVs don't flag if you aren't signed, only if you have a bad signature, maybe (McAfee doesn't care). Plus I think you are meaning SmartScreen Filter, not SmartFilter; this doesn't stop malicious software, it only stops software that does have a bad signature, and warns when it's not commonly downloaded software (https://twitter.com/midnite_runr/status/451738775300087808/photo/1 https://twitter.com/midnite_runr/status/451738775300087808/p...), so even if it was signed like the picture IE says "I don't know George, wtf". When Jimmy McKittenButts want's his catScreenSaver.exe he's going to get it, SmartSceen Filter be damned. The _only_ thing that stops this is whitelisting (Applocker) and a smart user. Here's a sample from BDF, patched with a reverse shell and still works normally: https://www.virustotal.com/en/file/a31ed901abcacd61a09a84157887fc4a189d3fe3e3573c24e776bac8d5bb8a0f/analysis/1401385796/ https://www.virustotal.com/en/file/a31ed901abcacd61a09a84157... Edit: more sarcasm
  - deleted 12y ago
    [deleted]