Summary

Applications with digital signatures are often trusted by anti-virus products. In this chapter, we learned about Microsoft’s Authenticode specification and how to hijack well-known digital signatures. We have found ways to bypass the digital signature verification process on Windows systems, including attacking CryptSIPGetSignedDataMsg by forging a digital signature in any program, attacking CryptSIPVerifyIndirectData by hiding a backdoor in the signature structure from the fingerprint calculation process, and attacking CryptSIPVerifyIndirectData by Skipping Normalization. We hope that after reading this chapter, readers will have a very different understanding of digital signatures.