Examples of signature steganography
In the previous section, we achieved signature verification spoofing by falsifying the system functions in memory. However, up to this point, the spoofing was only done by patching the function from memory. Now that we understand the details of the hash calculation in the Microsoft white paper, we will try to find flaws in the calculation process and bypass the signature verification perfectly.
As we mentioned earlier, in the final section of the Microsoft white paper, Calculating the PE Image Hash, three items are deliberately avoided in the hashing process: Checksum, which can be altered by implanting a signature message, the Security Directory field, which is used for post-filling, and the structure of the signature message block itself. Since the signature message itself cannot be used as part of a fingerprint hash process, and the signed and valid program is considered safe by the Windows trust system (e.g., anti-virus vendors or the system...
