Pages

Sunday, January 28, 2018

How can Windows digital signature check be defeated?

Recently, it was determined by a SpecterOps researcher, Matt Graeber, that there is a way to bypass a Windows digital signature check by editing two specific registry keys. This is an important discovery because Windows uses digital signature protection to validate the authenticity of binary files as a security measure.

Digital signature protection is used by Windows and others to determine if a file was tampered with during the time in which it was sent to the receiving party. Being able to validate the integrity of a received file and that it's actually from the party that signed it is important since digital signatures work on trust -- when a system can work around this feature, it opens up doors to malicious activity.

It's also important to state that digital signatures don't secure the file, but give it a level of trust based off of the private key it was signed with; therefore, if that specific key was stolen or used maliciously, then the system would approve the digital signature check.

Many Windows security features and security products rely on the trust and guarantees that a digital signature check brings with it. In the case of the CCleaner malware last month, it spread due to having been signed by a legitimate certificate, which led to the code being trusted by the OS. In his research report, Graeber wrote, "Subverting the trust architecture of Windows, in many cases, is also likely to subvert the efficacy of security products."

The attack is focused on two registry keys that enable you to impersonate files with any other valid signature when adjusted. However, this isn't done via injection of code into the system, but with the registry key modification, meaning the attacker can do this remotely if they have access to the registry. This also means that they must be admins on the system, which isn't incredibly hard to escalate if they aren't don't have permission.

Locking down the administrator rights to limit changes to these keys and implementing monitoring to determine if they were changed would be a way of reviewing if the registry keys were modified, even though this would require the logs of all the systems. It's also possible that a group policy could be made to limit access to these files in greater detail, but these are all reactive methods to this problem.

The issue once again comes down to trust, as this is one area that's put in place to protect you from impersonation. It also happens to be the most likely thing to be used for malicious purposes, especially malware, that would bypass the internal mechanisms to slip past application whitelisting, such as Microsoft's Windows Defender Device Guard.

There needs to be more procedures around digital signature protection to protect against malicious files entering your endpoint.
There needs to be more procedures around digital signature protection to protect against malicious files entering your endpoint, such as reputation services, sandboxes and next-generation malware protection that doesn't rely on signatures.

Is a digital signature check needed? Yes, but it's a layer in the protection against malware, and abusing the trust of these signatures enables them to be bypassed. In the end, we simply need to add more layers to our defense.

My article at: http://searchsecurity.techtarget.com/answer/How-can-Windows-digital-signature-check-be-defeated

79 comments:

  1. Several communities possess singles groups which set about enjoyable breast implants aventura things to do mutually, and this also can be is a good choice courting approach. Situations for instance riding a bike, bowling, curling, video hours, dance in addition to humor golf equipment will be arranged from the singles group, also it enables the evenly-distributed number of people to obtain a great in addition to informal night. With focus applied the actual task per se as an alternative to building a intimate relationship, it will require a great deal of pressure off the singles and sites take place a lot more obviously around such a location. stiply.nl elektronische handtekening

    ReplyDelete
  2. Great thanks for sharing about digital signature. This post will be helpful for the readers who are searching for this type of information. Keep it up.
    Also check out :
    AWS Training in chennai | AWS Training center in velachery

    ReplyDelete
  3. For Windows 8 clients the choice to move up to Windows 8.1 ought to be generally simple given the numerous focal points recorded underneath. HTTP Ultimate Guide

    ReplyDelete
  4. AWS Training in Bangalore - Live Online & Classroom
    myTectra Amazon Web Services (AWS) certification training helps you to gain real time hands on experience on AWS. myTectra offers AWS training in Bangalore using classroom and AWS Online Training globally. AWS Training at myTectra delivered by the experienced professional who has atleast 4 years of relavent AWS experince and overall 8-15 years of IT experience. myTectra Offers AWS Training since 2013 and retained the positions of Top AWS Training Company in Bangalore and India.


    IOT Training in Bangalore - Live Online & Classroom
    IOT Training course observes iot as the platform for networking of different devices on the internet and their inter related communication. Reading data through the sensors and processing it with applications sitting in the cloud and thereafter passing the processed data to generate different kind of output is the motive of the complete curricula. Students are made to understand the type of input devices and communications among the devices in a wireless media.

    ReplyDelete
  5. Security company Nottinghamshire can provide highly trained and local security guards in Nottinghamshire that are professional security guards in Nottinghamshire

    ReplyDelete
  6. You need to make a connection with your audience, and the best way to do that is by effectively using social media promotion. check this website

    ReplyDelete
  7. I really loved reading your blog. It was very well authored and easy to understand. Unlike other blogs I have read which are really not that good.Thanks alot!
    Mason Soiza

    ReplyDelete
  8. Check Digit Signature Many people pay attention. For those who want to read this must be read on this page at all.


    คาสิโนออนไลน์

    ReplyDelete


  9. Get the most advanced AWS Course by Professional expert. Just attend a FREE Demo session.
    For further details call us @ 9884412301 | 9600112302
    AWS training in chennai | AWS training in velachery

    ReplyDelete



  10. Get the most advanced Python Course by Professional expert. Just attend a FREE Demo session.
    For further details call us @ 9884412301 | 9600112302
    Python training in chennai | Python training in velachery

    ReplyDelete
  11. Attend The Data Science Training in Bangalore From ExcelR. Practical Data Science Training in Bangalore Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Data Science Courses in Bangalore.
    ExcelR business analytics courses

    ReplyDelete
  12. Attend The Data Analytics Course From ExcelR. Practical Data Analytics Course Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Data Analytics Course.
    ExcelR Data Analytics Course

    ReplyDelete
  13. I just got to this amazing site not long ago. I was actually captured with the piece of resources you have got here. Big thumbs up for making such wonderful blog page!
    ExcelR data analytics courses

    ReplyDelete
  14. You’ve got some interesting points in this article. I would have never considered any of these if I didn’t come across this. Thanks!. 2020 Services

    ReplyDelete
  15. You actually make it look so easy with your performance but I find this matter to be actually something which I think I would never comprehend. It seems too complicated and extremely broad for me. I'm looking forward for your next post, I’ll try to get the hang of it!
    ExcelR artificial intelligence courses
    Machine learning courses in bangalore

    ReplyDelete
  16. Replacements also provide you with better operation, since the new components will slide up and down with ease. You can easily clean the new products, usually by tilting in both the top and bottom frames to enable you to clean the glass. Replacements often provide greater security than older panes, because new security features typically enable locking to keep criminals out of your home. window installation dallas

    ReplyDelete
  17. Thanks for giving me the time to share such nice information. Thanks for sharing.
    Data Science Course
    Data Science Course in Marathahalli

    ReplyDelete
  18. Gauge plugs are cylindrical bars manufactured specifically to obtain a correct size of the barrel within the hole. These plugs are frequently used in a number of different industries to obtain an accurate calibration, either in imperial or metric sizes, often as accurate as 2 microns. Gauge plugs are often bought in a set of progressively larger sizes although the specific size can be bought individually.durometer

    ReplyDelete
  19. I truly welcome this superb post that you have accommodated us. I guarantee this would be valuable for the vast majority of the general population. Digital Seva

    ReplyDelete
  20. After reading your article I was amazed. I know that you explain it very well. And I hope that other readers will also experience how I feel after reading your article. boot error

    ReplyDelete
  21. This is my first time visit here. From the tons of comments ExcelR Machine Learning Courses on your articles.I guess I am not only one having all the enjoyment right here!

    ReplyDelete
  22. Took me time to read all the comments, but I really enjoyed the article. It proved to be Very helpful to me and I am sure to all the commenters here! It’s always nice when you can not only be informed, but also entertained! Windows

    ReplyDelete
  23. I just thought it may be an idea to post incase anyone else was having problems researching but I am a little unsure if I am allowed to put names and addresses on here. check it out

    ReplyDelete
  24. Wow! Such an amazing and helpful post this is. I really really love it. It's so good and so awesome. I am just amazed. I hope that you continue to do your work like this in the future also.
    data science training in guwahati

    ReplyDelete
  25. Be predictable in your online investment: It's anything but a one-time exertion. smm panel

    ReplyDelete
  26. Wanted posting. Loads of excellent writing here. I wish I saw it found the site sooner. Congrats! converting websites

    ReplyDelete
  27. I gotta favorite this website it seems invaluable extremely helpful top web design companies

    ReplyDelete
  28. I curious more interest in some of them hope you will give more information on this topics in your next articles.
    360digitmg data science courses

    ReplyDelete
  29. Listed here you'll learn it is important, them offers the link in an helpful webpage: grossiste fleurs

    ReplyDelete
  30. Regardless of whether your youngster's class utilizes an intuitive Smartboard, PCs, or another gadget, here are three different ways to ensure that technology is utilized viably. cloudways review

    ReplyDelete
  31. Be certain that the entirety of your endeavors lead clients back to your site where they can completely draw in with your business, items and benefits, and pick the channels through which they get in touch with you. comptia a classroom training uk

    ReplyDelete
  32. Nice blog and absolutely outstanding. You can do something much better but i still say this perfect.Keep trying for the best. Digital marketing services

    ReplyDelete
  33. Website design enhancement works best when the demonstrated strategies for getting rankings are applied related to most recent patterns that are driving traffic. social media marketing

    ReplyDelete
  34. This is my first time visit here. From the tons of comments ExcelR Machine Learning Courses on your articles.I guess I am not only one having all the enjoyment right here!

    ReplyDelete
  35. E Solution Mate is a leading web design Adelaide agency. We provide custom websites, eCommerce websites, WordPress websites with all sorts of hosting and support plans. We make sure that your brand is visible and eye-catchy, we have experience in creating perfect landing pages that are 90% convertible. Contact us now!

    ReplyDelete
  36. It’s hard to find responsible SEO services, and it’s hard to find an SEO company or local SEO services in Pakistan. Seo services in Pakistan

    ReplyDelete
  37. Waooow!!! Magnificent blogs, this is what I wanted to search. Thanks buddy
    user experience design agency

    ReplyDelete
  38. Writing with style and getting good compliments on the article is quite hard, to be honest.But you've done it so calmly and with so cool feeling and you've nailed the job. This article is possessed with style and I am giving good compliment. Best! best seo company in pakistan hyderabad

    ReplyDelete
  39. An unbelievable blog. This blog will indisputably be definitely recommended to my friends as well.
    http://www.youtube.com/watch?v=gtEYCdE0qZ8

    ReplyDelete
  40. Ezikweb is an entrepreneurial service provider with expertise in SEO, Web designing, Graphic designing, Web Development, Content Writing. Ezikweb best digital marketing company works directly with numerous experts around the world.Best SEO Company in Pakistan

    ReplyDelete
  41. Just saying thank you won’t just be sufficient, for the amazing clarity in your article. I will directly get your RSS to stay informed of any updates. Pleasant work and much success in your business efforts. digital marketing company hongkong

    ReplyDelete
  42.  How to Create a Digital Marketing Strategy · Build your buyer personas. · Identify your goals and the digital marketing tools you'll need What is Kartra

    ReplyDelete
  43. Website design enhancement works best when the demonstrated strategies for getting rankings are applied related to most recent patterns that are driving traffic.
    how changes are handled

    ReplyDelete
  44. I'm glad to see the great detail here!. 1on1

    ReplyDelete
  45. i am glad to find your outstanding displaying off of writing the country. Now you create it smooth for me to recognise and put in force the concept. thank you for the usher in. Larby Amirouche

    ReplyDelete
  46. The "cost per click" (abbreviated to CPC) is determined by the quality and relevancy of the advert to the search term being used and the relevancy of the page on your website that the potential customer land on. Best Digital Marketing Blog India

    ReplyDelete
  47. The move to advanced media is being driven by showcasing offices, entrepreneurs and purchasers the same. CBT Web Scraper and Email Extractor Software

    ReplyDelete
  48. Once you have a percentage of the online currency, you may now utilize it to buy anything that acknowledges it. Now and again, Bitcoin is the main type of installment, and you will need to procure it to successfully complete an online transaction. bitcoin mixer

    ReplyDelete
  49. Thanks for the blog loaded with so many information. Stopping by your blog helped me to get what I was looking for. niche relevant blog comments

    ReplyDelete
  50. Amazing post, thanks for sharing this article. I am truly motivated by you for blog post. we also provide Online Reputation Marketing Services. for more information visit on our website.

    ReplyDelete
  51. Thanks for sharing this awesome article keep sharing. Learn More

    ReplyDelete
  52. Thank you for your informative article, I have been doing research on this subject, and for three days I keep entering sites that are supposed to have what I am searching for, only to be discouraged with the lack of what I needed. create a dropshipping website

    ReplyDelete
  53. We are Fire & Ice. Offering bespoke wedding photography. Learn More

    ReplyDelete
  54. Exercise isn't just about oxygen consuming limit and muscle size. Certainly, exercise can improve your physical wellbeing and your build, trim your waistline, improve your sexual coexistence, and even add a very long time to your life.

    Learn More

    ReplyDelete
  55. Yet, having some inviting counsel available to you,
    at whatever point and any place you need it, makes it simpler and more fun
    Learn More

    ReplyDelete
  56. Nikmati permainan menarik dan juga bonus terbaik hanya di situs judi terpercaya DUETQQ hubungi +855966638079 untuk informasi dan pendaftaran lebih lanjut!

    ReplyDelete
  57. I found your this post while searching for some related information on blog search...Its a good post..keep posting and update the information. digital marketing agency wigan

    ReplyDelete
  58. That is very interesting; you are a very skilled blogger. I have shared your website in my social networks! A very nice guide. I will definitely follow these tips. Thank you for sharing such detailed article.
    electronic signature software

    ReplyDelete
  59. We always make sure that we are delivering quality and best class SEO services that will benefit you surely and take you to the levels of success. Digital marketing agency in Karachi

    ReplyDelete
  60. This is a wonderful article, Given so much info in it, These type of articles keeps the users interest in the website, and keep on sharing more ... good luck. PVC ramen

    ReplyDelete
  61. Great post. Articles that have meaningful information is more enjoyable, at least for me. get one of the best service for Online Reputation Marketing Services then visit on our website.

    ReplyDelete
  62. The writer is enthusiastic about purchasing wooden furniture on the web and his exploration about best wooden furniture has brought about the arrangement of this article. thc loyalty program

    ReplyDelete
  63. They permit their customers to customize bundles or highlights relying upon their necessities.SEO Services

    ReplyDelete
  64. I thought haven’t read such distinctive material anywhere else on-line.
    https://ministryoffreedomreview.org/

    ReplyDelete