Weak Authenticode timestamp counter-signature imprint digest algorithm
ID PE179 Level ERROR Category Security
Description
Authenticode timestamp counter-signature imprint digest algorithm is too weak. This may allow an attacker to modify the executable while keeping the signature valid.
Mitigation
- Use stronger hash algorithm when signing the image.
MD5
andSHA1
algorithms are no longer considered safe. UseSHA256
,SHA384
orSHA512
. - When signing the image using
signtool
, pass the/td
option with the strong hash name (e.g./td SHA256
). See thesigntool
description page for more details.
Arguments
This rule has the following output arguments:
-
signature_info
- Readable affected signature name (e.g. "root signature", "timestamp root signature", "nested signature (index 1)") -
hash_algorithm
- Weak hash algorithm used in the signature (e.g.MD5
,SHA1
)
Loading...
Unable to load this documentation page.