zlacker

If malware makes it onto your machine, it's already game over. The certificate allows the attacker to load an arbitrary driver, but the attacker doesn't need that to steal all your data.

relevant xkcd: https://xkcd.com/1200/

>>gruez+(OP)
Then why are malware authors exploiting this vulnerability?

>>ec1096+9f
Because some corporate environments only allow you to run signed executables. "Defense in depth" :)

>>hulitu+ap
So it’s effective in those environments?

>>ec1096+091
> So it’s effective in those environments?

No. Those environments will happyly install the malware code because it is signed by Microsoft.

>>hulitu+Cg2
The original post I was responding to was saying it was already game over regardless of whether hacker had the ability to sign their binary.

Clearly that isn’t true.