zlacker

Then why are malware authors exploiting this vulnerability?

>>ec1096+(OP)
Because some corporate environments only allow you to run signed executables. "Defense in depth" :)

>>hulitu+1a
So it’s effective in those environments?

>>ec1096+RT
> So it’s effective in those environments?

No. Those environments will happyly install the malware code because it is signed by Microsoft.

>>hulitu+t12
The original post I was responding to was saying it was already game over regardless of whether hacker had the ability to sign their binary.

Clearly that isn’t true.