A SSLippery Slope: Unraveling the Hidden Dangers of Certificate Misuse
summary
Finds concrete EKU validation failures that let a low‑assurance DV/SSL certificate be used where a code‑signing cert is required, demonstrates a working pipeline: patches SignTool in IDA Pro and edits Mage with dnSpy to skip EKU checks, produces an EXE and ClickOnce deployment signed with an SSL cert that Windows and several cross‑platform libraries accept, shows Mono and authenticode libraries are vulnerable, and exploits a hashing deviation to swap a Microsoft EXE entry point; all reported issues are patched.
AI-written summary · about
chapters (14)
- 0:00Introduction to digital signatures
- 1:20Signature validation processes
- 4:58Common attack vectors
- 8:59Types of certificates and validation
- 12:32The EKU validation problem
- 13:57Bypassing signing tool checks
- 16:56Exploiting dotnet manifest signing
- 17:20Windows trust verification
- 20:23Third-party implementation flaws
- 23:00Signature specification deviation
- 24:55Code execution via signature flaw
- 25:22ClickOnce application vulnerabilities
- 27:16Related research findings
- 29:34Conclusion and Q&A
related talks
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
46mSelf-Signed, Why Not! Exploiting Insecure Certificate Validation In iOS And macOS
53mOpenSSL Deep Dive: The Good, Bad And Not-So-Ugly
13mX.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities in
27mDebugging TLS/SSL
40mDigital Identities - 21 PKI Pitfalls and How Best to Avoid Them
43mTrusting SDKs
51mUnderstanding TLS certificate validation errors