{"vulnerability": "CVE-2013-3900", "sightings": [{"uuid": "38730907-2d70-4a5f-ac12-5ee508ebf1ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "MISP/a8009d56-7dab-4b65-a6ee-3caf2773c960", "content": "", "creation_timestamp": "2022-01-05T12:37:10.000000Z"}, {"uuid": "6709716d-ddc1-48e8-bae7-fac49983dd81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:03.000000Z"}, {"uuid": "d9e282b0-611a-46e8-b1e0-a676918b5761", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971206", "content": "", "creation_timestamp": "2024-12-24T20:25:52.270140Z"}, {"uuid": "7564f731-ab0d-4db7-a399-d9e4bfec7729", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "https://bsky.app/profile/windowsperf.bsky.social/post/3lfolpycy5k26", "content": "", "creation_timestamp": "2025-01-14T06:10:45.545508Z"}, {"uuid": "120df040-d15a-4659-9b46-86ad0d5f683e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:04.000000Z"}, {"uuid": "586ddb6e-d182-438e-a1fb-100697157dfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "MISP/a8009d56-7dab-4b65-a6ee-3caf2773c960", "content": "", "creation_timestamp": "2025-11-10T20:41:14.000000Z"}, {"uuid": "6125c9f7-f5ea-4812-a8a5-82467198258c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=725", "content": "", "creation_timestamp": "2022-01-24T04:00:00.000000Z"}, {"uuid": "3fed8a57-64ff-4ec2-adf5-39637f36f488", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2013-3900", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9222078e-c0d3-4754-ac1e-69946e0d40d9", "content": "", "creation_timestamp": "2026-02-02T12:28:29.170982Z"}, {"uuid": "f1e09bd2-1fd9-4485-b136-65a2282b4339", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "https://t.me/cKure/8191", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Can you trust a file's digital signature? \ud83e\udd14\nA new #Zloader campaign abuses CVE-2013-3900 for defense evasion.\n\n\ud83d\udd25 HTA content appended to a signed Microsoft DLL, without breaking trust\n\ud83d\udd25 MSHTA used to execute the appended script\n\ud83d\udd25 CVE-2013-3900 still unpatched by default https://t.co/5n1AoS6hsl", "creation_timestamp": "2021-11-23T11:27:03.000000Z"}, {"uuid": "acfa926b-7577-403f-b582-c8e499558216", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "Telegram/C3dLOex4qKF8CrF74Ro2jk8I9HmXrLWpS6IVMSsoWA8-ZJQ", "content": "", "creation_timestamp": "2025-08-04T21:00:05.000000Z"}, {"uuid": "abbc1cb7-06a9-40e5-98c7-69c6c15a4cee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "Telegram/rMGPEftinAjzKoR_zE8SBGcQ2vzrHmgR3TCsszmfdrU6i-0", "content": "", "creation_timestamp": "2025-08-18T15:00:06.000000Z"}, {"uuid": "d1b90911-0423-4051-ab2b-f4eefa4ce21b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "https://t.me/ZeroEthical_Course/586", "content": "SignatureGate\n\nCombat version of HellsGate bypassing AV/EDR/EPP by abusing optional fix CVE-2013-3900\n\nhttps://github.com/florylsk/SignatureGate", "creation_timestamp": "2024-06-22T20:47:52.000000Z"}, {"uuid": "c9ba262c-fb05-4793-b597-e2199f43adaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "https://t.me/arpsyndicate/1061", "content": "#ExploitObserverAlert\n\nCVE-2013-3900\n\nDESCRIPTION: Exploit Observer has 17 entries related to CVE-2013-3900. The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate PE file digests during Authenticode signature verification, which allows remote attackers to execute arbitrary code via a crafted PE file, aka \"WinVerifyTrust Signature Validation Vulnerability.\"\n\nFIRST-EPSS: 0.414100000\nNVD-IS: 10.0\nNVD-ES: 4.9", "creation_timestamp": "2023-12-03T23:47:21.000000Z"}, {"uuid": "12f2cf6e-c4dd-4a08-b197-8316ac2b9b84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "Telegram/L244JoNw57CRJMWCPi_ZRxUkTJoBnlOlWfCWqfHHeiICTHY", "content": "", "creation_timestamp": "2025-04-01T05:00:07.000000Z"}, {"uuid": "baf1b076-b85c-4589-8fe1-c8ca1965864e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "Telegram/iKE-ifN8C4jbKlxJZm9dPRBcrWriwuOpiCrJGZ4kRda8BQ8", "content": "", "creation_timestamp": "2025-02-24T04:00:07.000000Z"}, {"uuid": "81c92fde-d71b-4ce9-9ea0-7d82d31fa233", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "https://t.me/WARLOCK_DARK_ARMY_OFFICIALS/2813", "content": "SignatureGate\n\nCombat version of HellsGate bypassing AV/EDR/EPP by abusing optional fix CVE-2013-3900\n\nhttps://github.com/florylsk/SignatureGate", "creation_timestamp": "2023-07-26T10:06:59.000000Z"}, {"uuid": "591722b1-8bbc-488b-8101-8536f48b02e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/3080", "content": "30 Tools \ud83d\udd27 \ud83d\udee0\ud83e\ude9b\ud83d\udd28 - Hackers Factory \n\nBREAD\n\nBREAD (BIOS Reverse Engineering & Advanced Debugging) is an 'injectable' real-mode x86 debugger that can debug arbitrary real-mode code (on real HW) from another PC via serial cable.\n\nhttps://github.com/Theldus/bread\n\n#cybersecurity #infosec #reverse\n\n\u200b\u200bGTScan \u2014 The Nmap Scanner for Telco\n\nGTScan relies on using empty TCAP layers as probes to detect listening subsystem numbers (i.e application port numbers like 80 for http, 443 for https but for telecom nodes) on the respective global titles. With this way will be able to map the network and use the results to conduct targeted direct attacks to the respective nodes.\n\nhttps://github.com/SigPloiter/GTScan\n\n#cybersecurity #infosec #pentesting\n\n\u200b\u200bYAWNING-TITAN\n\nYAWNING-TITAN (YT) is an abstract, graph based cyber-security simulation environment that supports the training of intelligent agents for autonomous cyber operations. YAWNING-TITAN currently only supports defensive autonomous agents who face off against probabilistic red agents.\n\nhttps://github.com/dstl/Yawning-Titan\n\n#cybersecurity #infosec\n\n\u200b\u200bIRCP\n\nA robust information gathering tool for large scale reconnaissance on Internet Relay Chat servers.\n\nhttps://github.com/internet-relay-chat/IRCP\n\n#cybersecurity #infosec #pentesting\n\n\u200b\u200bTinyCheck\n\nTinyCheck allows you to easily capture network communications from a smartphone or any device which can be associated to a Wi-Fi access point in order to quickly analyze them. This can be used to check if any suspect or malicious communication is outgoing from a smartphone, by using heuristics or specific Indicators of Compromise (IoCs).\n\nhttps://github.com/KasperskyLab/TinyCheck\n\n#cybersecurity #infosec\n\n\u200b\u200bDropSpawn\n\nA #CobaltStrike BOF used to spawn additional Beacons via a relatively unknown method of DLL hijacking. Works x86-x86, x64-x64, and x86-x64/vice versa. Use as an alternative to process injection.\n\nhttps://github.com/Octoberfest7/DropSpawn_BOF\n\n#infosec #pentesting #redteam\n\n\u200b\u200bInstagram-Lookup\n\nThis script allows you to search for an Instagram profile using user ID or retrieve a profile's ID by username. It utilizes the Instagram API to retrieve profile information based on the provided input.\n\nhttps://github.com/AyalX/Instagram-Lookup\n\n#OSINT #recon #infosec\n\n\u200b\u200bScreenshotBOFPlus\n\nTake a screenshot without injection for #CobaltStrike. I only made minor optimizations to the existing code, and made it support the ability to get a complete screenshot when global scaling is initiated on Windows.\n\nhttps://github.com/baiyies/ScreenshotBOFPlus\n\n#infosec #pentesting #redteam\n\n\u200b\u200bBytesafe\n\nSecurity platform that protects organizations from open source software supply chain attacks.\n\nhttps://github.com/bitfront-se/bytesafe-ce\n\n#cybersecurity #infosec\n\n\u200b\u200bSignatureGate\n\nWeaponized version of HellsGate, bypassing AV/EDR/EPPs by abusing opt-in-fix CVE-2013-3900. \n\nhttps://github.com/florylsk/SignatureGate\n\n#cybersecurity #infosec #pentesting\n\n\u200b\u200bCVE-2023-33829\n\nSCM Manager XSS\n\nhttps://github.com/CKevens/CVE-2023-33829-POC\n\n#cve #cybersecurity #infosec\n\n\u200b\u200bBypassNeo-reGeorg\n\nAnti-kill version Neo-reGeorg.\n\nhttps://github.com/r00tSe7en/BypassNeo-reGeorg\n\n#infosec #pentesting #redteam\n\n\u200b\u200bUTopia\n\nA tool for automatically generating fuzz drivers from unit tests.\n\nhttps://github.com/Samsung/UTopia\n\n#cybersecurity #infosec\n\n\u200b\u200bShellcode PageSplit\n\nSplitting and executing shellcode across multiple pages.\n\nhttps://github.com/x0reaxeax/PageSplit\n\n#infosec #pentesting #redteam\n\n\u200b\u200bCVE-2023-2283\n\nAuthentication bypass vulnerability in libssh, which, under certain conditions, may enable a remote attacker to gain unauthorized access to another user\u2019s account via ssh login.\n\nhttps://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283\n\n#cybersecurity #infosec\n\n\u200b\u200bIndoXploit-Shell \n\nhttps://github.com/flux10n/IndoXploit-WebShell\n\n#infosec #pentesting #redteam\n\n\u200b\u200b1/2", "creation_timestamp": "2023-06-10T10:53:16.000000Z"}, {"uuid": "dc3278e8-57e9-4dd8-b75d-f983e492b88e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "Telegram/bpcEN8CSWnNrc7wnr8xcrh3wH36_tNQ_R7OcsCOfUW2S3Oo", "content": "", "creation_timestamp": "2023-07-23T09:36:18.000000Z"}, {"uuid": "c0d3a3b3-d809-49fc-af67-b5493548b367", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "Telegram/PVvGcGV94vzZiCnSpnX3C6MSU-TxAfg9O2NH6nthWCKdS74", "content": "", "creation_timestamp": "2023-06-12T21:13:08.000000Z"}, {"uuid": "7b5b0268-f1e9-4a52-b84c-e7dbce1d773d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "exploited", "source": "Telegram/jaepX_8CUKwgSsD1kwHICwK-nWaGG1E2ZhTcJ5p0hQ5uVBUr", "content": "", "creation_timestamp": "2023-07-23T12:47:25.000000Z"}, {"uuid": "6af98910-a63c-4d06-891a-3cc8d36dfb9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/117135939742418630", "content": "Years ago I noticed that Google does certificate abuse similar to CVE-2013-3900 in their Chrome installers. (The fix for this is optional, despite being 13 years old)\nIf you make a thing behaves differently based on unsigned parts of a signed binary, you're abusing the code signing mechanism.\nRich Warren outlines how this can be abused for arbitrary command execution", "creation_timestamp": "2026-08-21T22:49:58.839063Z"}, {"uuid": "bc586867-239d-4122-a38c-4271e7160bcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mtmtuhu77it2", "content": "Years ago I noticed that Google does certificate abuse similar to CVE-2013-3900 in their Chrome installers. (The fix for this is **optional** , despite being 13 years old)\n\nIf you make a thing behaves differently based on **unsigned** parts of a signed [\u2026] \n\n[Original post on infosec.exchange]", "creation_timestamp": "2026-08-21T22:50:12.454983Z"}, {"uuid": "aaf82494-168d-4af8-b90b-63cda15a1850", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/89fcdf66-a0f3-4148-81a7-8aa4d2050a6c", "content": "", "creation_timestamp": "2026-06-19T12:47:42.606226Z"}, {"uuid": "e428fb7e-4ba2-4f62-a171-cd044b2066f7", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/75fab23d-6f12-4c1d-bfec-ef8e00790c90", "content": "", "creation_timestamp": "2026-06-23T14:04:52.949172Z"}, {"uuid": "5857d5ad-a5cb-4bc7-a7e3-b2759da20e19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "Telegram/mXwJqGjsLNp0LFwWbXU4h3vA714Oj6yIG5AFZePUNxHCgwE", "content": "", "creation_timestamp": "2026-08-27T12:00:07.123948Z"}, {"uuid": "544fb3dc-7105-402e-bca2-c43157264012", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "Telegram/JKu8MzOeWEiDh6Wy6ZRFCp9pX-H-YlUWAgYEZsV0JVERmls", "content": "", "creation_timestamp": "2026-07-20T18:00:05.413104Z"}, {"uuid": "bc550e3c-fd4c-421e-a2a1-8d5cf76481bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "Telegram/JKu8MzOeWEiDh6Wy6ZRFCp9pX-H-YlUWAgYEZsV0JVERmls", "content": "", "creation_timestamp": "2026-07-22T00:00:07.846337Z"}, {"uuid": "47bcc874-4427-4fbc-971e-8774370966fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "Telegram/mXwJqGjsLNp0LFwWbXU4h3vA714Oj6yIG5AFZePUNxHCgwE", "content": "", "creation_timestamp": "2026-08-29T00:00:29.131241Z"}, {"uuid": "265f1005-a3b9-47e0-aee5-5cebbd021b3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ", "content": "", "creation_timestamp": "2026-07-29T12:01:27.852937Z"}, {"uuid": "13c084a7-92b4-4b29-91d6-3f78f65535e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "https://t.me/hacking_Attack/96835", "content": "ableCertPaddingCheck\u201d=\u201d1\u201d\n[HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Cryptography\\Wintrust\\Config] \u201cEnableCertPaddingCheck\u201d=\u201d1\u201d\n\n \nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2013-3900/properties-pre-fix.jpg \n<figcaptionMalicious DLL shows as signed pre-fix\u200b\u200b\u200b \n\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2013-3900/after-fix.jpg \n<figcaptionMalicious DLL shows as unsigned after the fix \nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Offensive Security Tool: Nginxpwner\nOnce these Registry keys are enabled, you can see how differently Microsoft validates the signature in the malicious d3dcompiler_47.dll DLL used in the 3CX supply chain attack. However, even if you add the Registry keys to apply the fix, they will be removed once you upgrade to Windows 11, making your device vulnerable again.\nPSA: Upgrading to #Windows11 wipes out security mitigations for CVE-2013-3900, meaning that if you upgrade you must re-apply said mitigations.\n\n\u2014 Matty (@ThePhoenixVents) January 5, 2023\nAs cybercriminals have recently exploited this vulnerability in attacks, such as the 3CX supply chain and a Zloader malware distribution campaign in January, it has become clear that the flaw needs to be fixed, even if it inconveniences developers.\nThe problem is that many people are unaware of this flaw, and they may assume that a malicious file is trustworthy because Windows reports it as being so.\nWill Dormann, a security researcher, warned that \u201cwhen a fix is optional, the masses aren\u2019t going to be protected.\u201d\n\nTo test the optional fix, I enabled it and used my computer as usual throughout the day without encountering any issues that made me regret my decision.Although some installers, such as Google Chrome, may not show as signed due to the fix, the added protection is worth the inconvenience.\n\nBleepingComputer has contacted Microsoft regarding the continued abuse of this vulnerability and the fact that the fix is optional, but no response has been received yet. \nTrending: Attackers Could Exploit Flaw in WiFi Protocol to Hijack TCP Connections Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Store.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-20-300x150.png Microsoft\u2019s Misconfigured Application Allowed for Real-Time Breach Attempts on Bing.comMarch 31, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-19-300x150.png Major Companies Hit in Ongoing 3CX VoIP Supply Chain AttackMarch 30, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-17-300x150.png Attackers Could Exploit Flaw in WiFi Protocol to Hijack TCP ConnectionsMarch 29, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-16-300x150.png MacStealer: The new info-stealing malware targeting Mac usersMarch 28, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.\nThe post 10-Year-Old Windows vulnerability still being exploited in the 3CX attacks first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-01T20:01:00.368413Z"}, {"uuid": "82671a57-2f48-4ac6-a216-1b868d65523a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "https://t.me/hacking_Attack/96834", "content": "Black Hat Ethical Hacking\n10-Year-Old Windows vulnerability still being exploited in the 3CX attacks\n\n10-Year-Old Windows vulnerability still being exploited in the 3CX attacksPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A 10-year-old Windows vulnerability is still being exploited in attacksA 10-year-old Windows vulnerability is still being exploited by cybercriminals to make it appear that executables are legitimately signed, with the fix from Microsoft still \u201copt-in\u201d after all these years. Even worse, the fix is removed after upgrading to Windows 11, leaving devices vulnerable to supply chain attacks.\n\nOn Wednesday night, VoIP communications company 3CX confirmed that it was compromised to distribute trojanized versions of its Windows desktop application in a large-scale supply chain attack. The company urged all users of the Windows desktop application to uninstall it immediately and perform a malware scan.\n\nAccording to 3CX, two DLLs used by the Windows desktop application were replaced with malicious versions that download additional malware to computers, such as an information-stealing trojan. One of the malicious DLLs used in the attack is usually a legitimate DLL signed by Microsoft named d3dcompiler_47.dll. However, the threat actors modified the DLL to include an encrypted malicious payload at the end of the file.\n\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2013-3900/shows-as-signed.jpg Modified DLL seen as having a valid signature\nSource: BleepingComputer\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Signed Windows DLL Exploits CVE-2013-3900 Flaw, Allowing Modifications to Appear AuthenticAs first noted by security researcher Will Dormann, even though the file was modified, Windows still showed it as correctly signed by Microsoft. Code signing an executable, such as a DLL or EXE file, is meant to assure Windows users that the file is authentic and has not been modified to include malicious code. When a signed executable is modified, Windows will display a message stating that the \u201cdigital signature of the object did not verify.\u201d However, even though we know that the d3dcompiler_47.dll DLL was modified, it still showed as signed in Windows.\n\nAfter contacting Dormann about this behavior and sharing the DLL, BleepingComputer was told that the DLL is exploiting the CVE-2013-3900 flaw, a \u201cWinVerifyTrust Signature Validation Vulnerability.\u201d Microsoft first disclosed this vulnerability on December 10th, 2013, and explained that adding content to an EXE\u2019s authenticode signature section (WIN_CERTIFICATE structure) in a signed executable is possible without invalidating the signature.\n\nMicrosoft ultimately decided to make the fix optional, likely because it would invalidate legitimate, signed executables that stored data in the signature block of an executable. \u201cThis change can be enabled on an opt-in basis,\u201d explains Microsoft\u2019s disclosure for the CVE-2013-3900. \u201cWhen enabled, the new behavior for Windows Authenticode signature verification will no longer allow extraneous information in the WIN_CERTIFICATE structure, and Windows will no longer recognize non-compliant binaries as signed.\u201d\n\nIt is now close to ten years later, with the vulnerability known to be exploited by numerous threat actors. Yet, it remains an opt-in fix that can only be enabled by manually editing the Windows Registry. To enable the fix, Windows users on 64-bit systems can make the following Registry changes:\n\nWindows Registry Editor Version 5.00\n[HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Wintrust\\Config]\u201cEn[...]", "creation_timestamp": "2026-09-01T20:01:00.644038Z"}, {"uuid": "7dd95333-9e02-4a95-9c81-b1ba6e76f62b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "Telegram/FxPwD2QYmiA5ZVhY8rKhgPR6q1a7u8sU2ARM9Vm3CjRJJs0", "content": "", "creation_timestamp": "2026-09-02T05:00:04.319927Z"}, {"uuid": "895fd920-36c9-4adb-b493-25846ac36660", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "Telegram/IRTE9BuztUkbbzgFrWUM1pze1uX-gYcshu3x9GLl0PBW0lw", "content": "", "creation_timestamp": "2026-09-02T16:00:04.052583Z"}, {"uuid": "fd0c6d27-0d50-4e34-837a-29f87ef26875", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "Telegram/GvfR5TiIz5AGTLxNK0NHF1rEL-rqaKshudCOKUMqTVI5bvk", "content": "", "creation_timestamp": "2026-09-02T16:00:04.387338Z"}, {"uuid": "888ccaf3-3d06-44d0-871f-0fc83899ccae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "Telegram/GvfR5TiIz5AGTLxNK0NHF1rEL-rqaKshudCOKUMqTVI5bvk", "content": "", "creation_timestamp": "2026-09-03T00:00:42.347329Z"}, {"uuid": "90e2c64c-3107-433f-a837-7dadb24a9965", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "Telegram/IRTE9BuztUkbbzgFrWUM1pze1uX-gYcshu3x9GLl0PBW0lw", "content": "", "creation_timestamp": "2026-09-03T00:00:42.752791Z"}, {"uuid": "1d262a6d-3ead-4467-b44d-1c76d3c3da2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "published-proof-of-concept", "source": "Telegram/FxPwD2QYmiA5ZVhY8rKhgPR6q1a7u8sU2ARM9Vm3CjRJJs0", "content": "", "creation_timestamp": "2026-09-03T00:00:43.952223Z"}, {"uuid": "1e8929ca-0744-404c-b095-b35656955a27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "exploited", "source": "https://t.me/hacking_Attack/96834", "content": "Black Hat Ethical Hacking\n10-Year-Old Windows vulnerability still being exploited in the 3CX attacks\n\n10-Year-Old Windows vulnerability still being exploited in the 3CX attacksPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A 10-year-old Windows vulnerability is still being exploited in attacksA 10-year-old Windows vulnerability is still being exploited by cybercriminals to make it appear that executables are legitimately signed, with the fix from Microsoft still \u201copt-in\u201d after all these years. Even worse, the fix is removed after upgrading to Windows 11, leaving devices vulnerable to supply chain attacks.\n\nOn Wednesday night, VoIP communications company 3CX confirmed that it was compromised to distribute trojanized versions of its Windows desktop application in a large-scale supply chain attack. The company urged all users of the Windows desktop application to uninstall it immediately and perform a malware scan.\n\nAccording to 3CX, two DLLs used by the Windows desktop application were replaced with malicious versions that download additional malware to computers, such as an information-stealing trojan. One of the malicious DLLs used in the attack is usually a legitimate DLL signed by Microsoft named d3dcompiler_47.dll. However, the threat actors modified the DLL to include an encrypted malicious payload at the end of the file.\n\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2013-3900/shows-as-signed.jpg Modified DLL seen as having a valid signature\nSource: BleepingComputer\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Signed Windows DLL Exploits CVE-2013-3900 Flaw, Allowing Modifications to Appear AuthenticAs first noted by security researcher Will Dormann, even though the file was modified, Windows still showed it as correctly signed by Microsoft. Code signing an executable, such as a DLL or EXE file, is meant to assure Windows users that the file is authentic and has not been modified to include malicious code. When a signed executable is modified, Windows will display a message stating that the \u201cdigital signature of the object did not verify.\u201d However, even though we know that the d3dcompiler_47.dll DLL was modified, it still showed as signed in Windows.\n\nAfter contacting Dormann about this behavior and sharing the DLL, BleepingComputer was told that the DLL is exploiting the CVE-2013-3900 flaw, a \u201cWinVerifyTrust Signature Validation Vulnerability.\u201d Microsoft first disclosed this vulnerability on December 10th, 2013, and explained that adding content to an EXE\u2019s authenticode signature section (WIN_CERTIFICATE structure) in a signed executable is possible without invalidating the signature.\n\nMicrosoft ultimately decided to make the fix optional, likely because it would invalidate legitimate, signed executables that stored data in the signature block of an executable. \u201cThis change can be enabled on an opt-in basis,\u201d explains Microsoft\u2019s disclosure for the CVE-2013-3900. \u201cWhen enabled, the new behavior for Windows Authenticode signature verification will no longer allow extraneous information in the WIN_CERTIFICATE structure, and Windows will no longer recognize non-compliant binaries as signed.\u201d\n\nIt is now close to ten years later, with the vulnerability known to be exploited by numerous threat actors. Yet, it remains an opt-in fix that can only be enabled by manually editing the Windows Registry. To enable the fix, Windows users on 64-bit systems can make the following Registry changes:\n\nWindows Registry Editor Version 5.00\n[HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Wintrust\\Config]\u201cEn[...]", "creation_timestamp": "2026-09-04T16:00:04.679195Z"}, {"uuid": "7accded5-4c5f-4b15-be52-f4cd48316c1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "exploited", "source": "https://t.me/hacking_Attack/96835", "content": "ableCertPaddingCheck\u201d=\u201d1\u201d\n[HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Cryptography\\Wintrust\\Config] \u201cEnableCertPaddingCheck\u201d=\u201d1\u201d\n\n \nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2013-3900/properties-pre-fix.jpg \n<figcaptionMalicious DLL shows as signed pre-fix\u200b\u200b\u200b \n\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2013-3900/after-fix.jpg \n<figcaptionMalicious DLL shows as unsigned after the fix \nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Offensive Security Tool: Nginxpwner\nOnce these Registry keys are enabled, you can see how differently Microsoft validates the signature in the malicious d3dcompiler_47.dll DLL used in the 3CX supply chain attack. However, even if you add the Registry keys to apply the fix, they will be removed once you upgrade to Windows 11, making your device vulnerable again.\nPSA: Upgrading to #Windows11 wipes out security mitigations for CVE-2013-3900, meaning that if you upgrade you must re-apply said mitigations.\n\n\u2014 Matty (@ThePhoenixVents) January 5, 2023\nAs cybercriminals have recently exploited this vulnerability in attacks, such as the 3CX supply chain and a Zloader malware distribution campaign in January, it has become clear that the flaw needs to be fixed, even if it inconveniences developers.\nThe problem is that many people are unaware of this flaw, and they may assume that a malicious file is trustworthy because Windows reports it as being so.\nWill Dormann, a security researcher, warned that \u201cwhen a fix is optional, the masses aren\u2019t going to be protected.\u201d\n\nTo test the optional fix, I enabled it and used my computer as usual throughout the day without encountering any issues that made me regret my decision.Although some installers, such as Google Chrome, may not show as signed due to the fix, the added protection is worth the inconvenience.\n\nBleepingComputer has contacted Microsoft regarding the continued abuse of this vulnerability and the fact that the fix is optional, but no response has been received yet. \nTrending: Attackers Could Exploit Flaw in WiFi Protocol to Hijack TCP Connections Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Store.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-20-300x150.png Microsoft\u2019s Misconfigured Application Allowed for Real-Time Breach Attempts on Bing.comMarch 31, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-19-300x150.png Major Companies Hit in Ongoing 3CX VoIP Supply Chain AttackMarch 30, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-17-300x150.png Attackers Could Exploit Flaw in WiFi Protocol to Hijack TCP ConnectionsMarch 29, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-16-300x150.png MacStealer: The new info-stealing malware targeting Mac usersMarch 28, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.\nThe post 10-Year-Old Windows vulnerability still being exploited in the 3CX attacks first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-04T16:00:04.859723Z"}, {"uuid": "8aec9cb7-5b39-4116-9a6d-88ee5981ac9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "https://bsky.app/profile/euvd-bot.bsky.social/post/3mxcjqr6bhw2n", "content": "\ud83d\udea8 EUVD-2013-3832\n\ud83d\udcca 5.5/10\n\ud83c\udfe2 Microsoft\n\n\ud83d\udcdd Why is Microsoft republishing a CVE from 2013?\nWe are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to ...\n\n\ud83d\udd17 https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-3832\n\n#cybersecurity #infosec #cve #euvd", "creation_timestamp": "2026-10-07T18:03:09.283993Z"}]}