Hackers Are Exploiting a Flaw Microsoft Fixed 9 Years Ago

Topic

New Reply

[unbob]

Surprised this years-old Microsoft Security Bulletin MS13-098 has never been posted on this forum.

https://www.wired.com/story/zloader-microsoft-signature-verification-hack/

https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2013/ms13-098?redirectedfrom=MSDN

https://www.bleepingcomputer.com/news/security/microsoft-code-sign-check-bypassed-to-drop-zloader-malware/

 

 

 

• This topic was modified 3 years, 4 months ago by unbob.
• This topic was modified 3 years, 4 months ago by unbob.

Reply | Quote

Replies

An article over on Check Point Research provides a strict Authenticode verification registry key.

Safety Tips

We recommend that users apply Microsoft’s update for strict Authenticode verification. To do so, paste these lines into Notepad and save the file with .reg extension before running it.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config]

“EnableCertPaddingCheck”=”1”

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config]

“EnableCertPaddingCheck”=”1”

We should also note that after applying the fix, some signatures of legitimate benign installers will show up with an invalid signature. In addition, if mshta.exe is not relevant in your environment, you may disable it and mitigate the execution of scripts that are inserted into such files….

Most of the victims downloaded malicious DLL files are found in the USA according to their findings, see graph on linked page above.

TIP: you may wish to add 134.0.117.16 to your firewall in/outbound block list

Windows - commercial by definition and now function...

1 user thanked author for this post.

unbob

Reply | Quote

These Unicode double quotes presented here do not work. The command line program reg and (hopefully the regedit program proper) rightly rejects these, replace them using the double quotes on your keyboard and this strict Authenticode checking mitigation will be applied as intended.

Reply | Quote