Getting signed by abusing path normalization
This technique is based on the author’s presentation Digital Signature? Nah, You Don’t Care About That Actually ;) at the iThome Information Security Conference CYBERSEC 2020 in Taiwan. It is mainly based on Matt’s research and extension of the security flaws of Windows path normalization to achieve digital signature forgery.
As we mentioned earlier, the system functions for verifying the digital signature, WinVerifyTrust, will internally call the three export functions in Crypt32.dll – CryptSIPDllIsMyFileType, CryptSIPGetSignedDataMsg, and CryptSIPVerifyIndirectData – and verify that a file on the path has a valid digital signature.
In the previous section, we attacked CryptSIPGetSignedDataMsg by forging a digital signature on any program, and we attacked CryptSIPVerifyIndirectData by hiding a backdoor in a signed program file from a fingerprint hash calculation process. In this section, we will...
