Threat Hunting for No-Key-Theft-Required Attacks in Trusted Binaries (MITRE ATT&CK T1553.002)

In this week’s Tech Talk Tuesday, we are discussing how threat hunting and trust is a really difficult combination, especially when it comes to digital signatures. 

Organizations often place blind trust in digitally signed files. Many assume that signed executables and scripts are inherently safe. However, attackers have discovered ways to subvert binary code signing—without even needing to steal signing keys.

This article explores how cybercriminals exploit weaknesses in Windows’ code signing mechanisms, the real-world threats posed by these attacks, and how security teams can defend against them.

Understanding Code Signing and Its Vulnerabilities

Code signing is a security measure designed to verify the authenticity and integrity of software. Organizations use it to prevent unauthorized modifications and malicious code execution. Traditionally, attackers attempting to bypass code signing would need to steal or forge signing keys.

However, a more insidious approach involves exploiting vulnerabilities in Windows’ code signing mechanisms. This allows attackers to introduce malicious code into a signed file without invalidating its digital signature, making it a stealthy and highly effective attack method.

How Attackers Subvert Code Signing Without Stealing Keys

Cybercriminals use two primary techniques to manipulate signed files:

1. Stealing or Forging Signing Keys

This traditional method involves attackers acquiring valid code-signing materials through supply chain attacks. Notable examples include:

• SolarWinds Attack: Adversaries compromised the development pipeline and signed malicious updates.

• APT Campaigns: Advanced Persistent Threat (APT) groups have stolen numerous certificates over the years.

• Stuxnet: This infamous malware leveraged stolen certificates from Realtek and JMicron to sign its malicious binaries.

2. No-Key-Theft Attacks: Exploiting Code Signing Flaws

Instead of stealing keys, attackers manipulate how Windows processes signed files. A key example is the ZLoader phishing campaign, where malware was embedded in a signed file without invalidating its digital signature.

How Does This Work?

• Windows verifies file signatures using the Subject Interface Package (SIP).

• SIP does not always check every byte of the file, leaving slack space where attackers can inject malicious code.

• As a result, even though the file retains its “valid” signature, it contains unauthorized, executable content.

Why Is This Dangerous?

• This attack works by default on all Windows versions from XP to 10.

• Organizations must manually change registry settings to mitigate this risk, a step that is often overlooked.

Real-World Exploits: The Hidden Threat in Signed Files

1. ZLoader Malware Campaign

• Attackers appended malicious scripts to a signed file.

• Windows still recognized it as a valid executable.

• The malware executed without raising alarms, bypassing traditional security checks.

2. VirusTotal Research on Code Signing Bypasses

• Researchers discovered Visual Basic scripts embedded in signed binaries.

• Despite the modification, Windows and security tools still marked these files as safe.

• VirusTotal developed YARA rules to detect these altered signed files.

3. Microsoft’s CVE-2020-1599 Code Execution Vulnerability

• This vulnerability enabled attackers to insert malicious content into signed files.

• Even after being identified, the flaw remained exploitable on newer Windows versions unless specific registry settings were enabled.

Defending Against Code Signing Exploits

1. Don’t Trust Digital Signatures Alone

• Extract Portable Executable (PE) files and manually inspect them.

• Look for suspicious data in slack space within signed files.

• Use tools like VirusTotal’s YARA rules to flag potential threats.

2. Enable Stricter Certificate Verification

Microsoft provides a registry key setting to enforce stricter code signing checks:

On 64-bit Windows:

Set the following registry key to 1:

HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config\EnableCertPaddingCheck

Reboot the system for changes to take effect.

On 32-bit Windows:

Modify two registry keys instead of one.

Important Note: Enabling this setting may cause compatibility issues with older software that does not conform to modern signing standards. Organizations should test critical applications before applying this setting widely.

3. Implement Robust Threat Hunting Practices

• Regularly scan signed files for anomalies.

• Monitor network traffic for suspicious signed executables being downloaded.

• Train security teams to look beyond the digital signature when analyzing potential threats.

Final Thoughts: Rethinking Trust in Signed Files

The assumption that digitally signed files are always safe is a dangerous misconception. Attackers have developed techniques to embed malware into signed files without stealing keys, exploiting flaws in Windows’ trust architecture.

To stay ahead, organizations must adopt a proactive security mindset:

• Inspect files beyond their digital signatures.
• Enable stricter verification settings where possible.
• Continuously update threat hunting techniques to detect novel attack methods.

By recognizing these trust blind spots, security teams can build stronger defenses against evolving cyber threats

FAQs

1. What is the biggest risk with trusting digitally signed files?
The biggest risk is that attackers can modify signed files without invalidating their signature, allowing malicious content to bypass security measures.

2. How can organizations detect tampered signed files?
Organizations should use YARA rules, manual inspection of PE files, and enable stricter certificate verification settings to detect altered files.

3. Does Microsoft offer a built-in fix for these vulnerabilities?
Microsoft provides registry settings to enforce stricter verification, but they are not enabled by default, requiring manual configuration.

4. Are these attacks limited to Windows?
While this article focuses on Windows-based attacks, similar techniques may be used on other operating systems with weak code-signing verification mechanisms.

5. How often should security teams audit signed files?
Regular audits are essential. Monthly or quarterly reviews of signed files, coupled with real-time monitoring, can help mitigate risks effectively.

By understanding and addressing these vulnerabilities, organizations can significantly improve their cybersecurity posture and mitigate the risks associated with code signing subversion. Stay vigilant and keep your defenses up to date!