Old Microsoft ‘opt-in’ fix exploited in 3CX attack

Topic

New Reply

March 31st 2023

Ref: bleepingcomputer

Interesting article by Lawrence Abrams that caught my eye..

A 10-year-old Windows vulnerability is still being exploited in attacks to make it appear that executables are legitimately signed, with the fix from Microsoft still “opt-in” after all these years. Even worse, the fix is removed after upgrading to Windows 11…..

A registry fix has been supplied within the article:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config]
“EnableCertPaddingCheck”=”1”

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config]
“EnableCertPaddingCheck”=”1”

The author follows on to share his feedback..

I enabled the optional fix, used the computer as usual throughout the day, and did not run into any issues that made me regret my decision.

While this may cause an issue with some installers, like Google Chrome, not showing as signed, the added protection is worth the inconvenience.

Will Dormann reveals troubling authenticode findings over on twitter

Both Windows 10 and 11 are affected but no mention of whether earlier and subsequent Windows Server editions will be affected? (I’d imagine so..)

Windows - commercial by definition and now function...

3 users thanked author for this post.

TJ, windbg, Alex5723

Reply | Quote

Replies

I read the article on Bleepingcomputer and saw that user ‘cakruege’ commented that the fix does not work (properly) https://www.bleepingcomputer.com/news/microsoft/10-year-old-windows-bug-with-opt-in-fix-exploited-in-3cx-attack/#cid26696.
For proof he provides a link to https://github.com/mtrojnar/osslsigncode but I don’t know how to interpret all that.
Anyone care to look into this and translate it to layman’s wording?

 

And I’m curious why nobody reacted to this topic yet?

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Some further information:
https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

Thanks, but that’s a bit too technical for me.

Maybe I should rephrase my question:

Is the registry fix effective [enough] to ward off malicious executables, or is formentioned user ‘cakruege’ right in saying it is not?

 

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote