Digital Signature – Authenticode Verification

For Windows users, it is common practice to install anti-virus software, update systems regularly, choose the source of downloads carefully, and double-check that applications are digitally signed by reputable technology companies. However, are these security practices really enough to keep hackers at bay? This chapter may give readers a very different perspective. In this chapter, we will learn about Windows Authenticode specification, reverse-engineering the signature verification function, WinVerifyTrust, and how to hijack well-known digital signatures.

This chapter is based on the public presentation Subverting Trust in Windows given by Matt Graeber, a security researcher at Specter Ops, at the TROOPERS18 conference in 2018. It introduced how to manage trusted certificate authorities (trust providers), the calculation process for signing certificates, the corresponding authentication API, and malicious exploits in the Windows...