The tag has no usage guidance.

learn more… | top users | synonyms

2
votes
1answer
20 views

Signing a code and application

I want to send my application to different servers/terminals with content integrity and confidentiality. So, I need to some process to sign my code and application before sending it to servers and to ...
2
votes
1answer
65 views

Is there any way to discover why Windows Smartscreen is flagging your download?

Since Windows Smartscreen is now marking downloaded files signed with SHA1 post 1/1/16 as potentially unsafe, we have had to get a new code-signing cert. With it being a new cert, it has no ...
3
votes
2answers
101 views

Secure Android app development [closed]

I'm beginning with Android App development and I want to make sure that I'm taking the proper security precautions since most apps will handle sensitive data. What security precautions should be ...
11
votes
7answers
2k views

Deprecation of SHA1 code signing certificates on Windows

I have been keenly following the issues with regards to Microsoft deprecating the use of SHA1 code-signing certificates for Windows executables ...
3
votes
0answers
53 views

How does a Sign tool work?

My basic understanding about sign tool is: 1.It loads the zipfile(may be exe,jar,ddl,apk..) which has to be signed to its memory(cache memory of the sign tool). 2.It will verify it, and unzip the ...
3
votes
2answers
75 views

Client side signing of a file(.exe,.dll,.jar..) using CA issued certificate and signtool [closed]

In a current project we have purchased certificate from a trusted CA and have installed in a host, sign tool is also installed in the same host. All the files which we develop(jar,dll,apk,exe etc..,) ...
3
votes
2answers
103 views

Can the contents of a web page be protected from modification

We are developing an application sending highly sensitive data over the Internet. For this we use client side encryption so that even if an attacker would get access to our servers, the data could ...
0
votes
2answers
54 views

Java code signing vs. sandboxing

I'm trying to understand the rationale behind Java Applet development these past few years. Back in the old days, most Applets were unsigned, and the code for these was run in a sandbox where barring ...
3
votes
1answer
45 views

Centralized key management for IOS and Android Code Signing

What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines. I see systems like ...
1
vote
1answer
80 views

What Are Good Code Signing Environment Guidelines? [closed]

Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
2
votes
0answers
76 views

Why did Google sign every auxiliary app inside “Google Chrome.app” (OS X version) except for one?

$ codesign -dvv /Applications/Google\ Chrome.app/Contents/Versions\ /46.0.2490.80/Google\ Chrome\ Framework.framework/Resources/app_mode_loader.app/ /Applications/Google Chrome.app/Contents/Versions\ ...
2
votes
0answers
330 views

Why does the tool 'codesign' in OS X 10.11 (El Capitan) report every Python process as “code object is not signed at all”?

If you start any Python process on OS X 10.11 (10.11.0 or 10.11.1) El Capitan, and run the OS built-in tool 'codesign' to verify the process, you will receive an error saying "code object is not ...
1
vote
1answer
32 views

AuthentiCode Launcher runs everything

Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC ...
10
votes
1answer
214 views

Did D-Link's certificate revocation really only invalidate 1 day (of a six months long exposure)?

I'm trying to wrap my head around the OCSP revocationTime for D-Link's certificate. I recently answered another question and ended up drafting a timeline. That timeline is basically this: Jul 5 ...
7
votes
3answers
122 views

Automatic detection of a compromised web server

I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker. Our website, say ...
2
votes
1answer
166 views

Managing/Deploying a code signature certificate - Java Applet

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the ...
3
votes
3answers
384 views

Will it improve security if I place both SHA1 and SHA256 signatures inside codesigned binary on Windows?

My application targets platforms starting with Windows 7 32bit. Many of them aren't up to date (i.e. may be missing many recommended updates from Microsoft). Given the constraints I must use SHA1 ...
4
votes
1answer
66 views

Cross-certification between worlds like X.509 and PGP?

Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert ...
1
vote
1answer
112 views

Is the enforcement of only allowing signed application to run in a Windows server a safe rule in a prod environment?

There are various security tools that allow an administrator to enforce only signed applications to run in a Windows operating system. is this a realistic general enforcement rule in a production ...
0
votes
1answer
157 views

Windows Server Update Services (WSUS) - can I pivot to a client machine?

I'm considering setting up WSUS on a Server 2008 machine to push updates to my Windows 7 clients. If I do, I'll be following the hardening guidelines issued by MS (such as enabling SSL). One thing I ...
1
vote
0answers
39 views

How to Verify the Integrity of the BlackBerry Momentics IDE Download for Linux

I am currently setting up development environments for BB10 apps on Linux workstations. BlackBerry provides their Momentics IDE for free from (https://developer.blackberry.com/native/downloads/). The ...
1
vote
1answer
94 views

Why are unsigned Java applications blocked?

Anyone can purchase a code signing certificate. They are cheap and do not involve much validation. Yet Oracle must have determined that disabling execution of unsigned applications increases security. ...
1
vote
1answer
312 views

Migrate a x509 key using KSP (CNG) to CSP (CryptoAPI) in Windows

I have a code signing certificate issued to me by a commercial CA, and the key was generated on my local development machine using the new Cryptography Next Generation storage providers. ...
1
vote
0answers
60 views

Certificate advice for deploying code-signed software as a 3rd party vendor

I am in the process of developing an application for an organization, and am looking for a sanity check on my strategy, especially given the the nature of the SuperFish nonsense that was exposed. The ...
3
votes
2answers
160 views

Does a valid code signing certificate mean that an installer has not been tampered with in transit?

Several dominant software vendors distribute updates over HTTP or over HTTPS with bad certificates. In general, it doesn't seem like I can expect to rely on a secure channel to ensure that an ...
1
vote
0answers
71 views

Sign java jars for security [closed]

We have an enterprise system that utilizes many in house jars, java applications, to run on a centos 7 linux system. How do I go about achieving the following in order of importance: Only signed ...
8
votes
2answers
271 views

AV detection of signed malware

With the massive Sony leaks (including their private keys/certificate), i was wondering: How do major AVs deal with signed binaries? ie: Does it influence their detecting ability of the signed ...
2
votes
2answers
184 views

Code Signing Confusion

I usually make free windows applications, now I want to digitally sign them. So users can be sure that its from me. But instead of buying the code signing certificate, I thought I may create my own. ...
2
votes
1answer
138 views

What does verified file in windows mean? And does it guarantee related files?

Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g Microsoft) or in other case, unknown publisher. I know public key encryption can ...
1
vote
0answers
58 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...
6
votes
1answer
573 views

How do systems protect against a stolen code-signing certificate after the certificate expires?

Imagine this scenario: 1st December 2014 - a certificate is stolen and used to sign malware with 2014-12-01 timestamp. 15th December 2014 - the certificate is revoked. Malware will be prevented from ...
1
vote
2answers
74 views

Sign contents of entire computer?

If I travel abroad and am concerned that when I land in the foreign country they may try to install a digital keylogger, does this work as a potential solution: If I sign my entire computer's hard ...
2
votes
1answer
169 views

Is code-signing with a non-ssl timestamp unsafe?

Assuming your code-signing tool is secure (e.g., does not suffer from buffer overflow exploits and the like), is there any reason to be concerned if a time-stamping service is not running over SSL? ...
6
votes
2answers
4k views

How to become Intermediate Certificate Authority?

I work at government organization. We would like to become Intermediate CA so that we can provide SSL certificates to our branch organizations. We must be able to do code signing, green address bar ...
1
vote
1answer
245 views

Where can I find a list of checksums for windows files? Why don't MS sign all their executables?

Is there anywhere I can download a list of checksums for microsoft-published OS executable files, preferably grouped by release name? I could do the same by decompressing files on a windows setup CD, ...
4
votes
2answers
231 views

What to do if you ever lose a smart card?

I want to use an OpenPGP smart card for signing releases, but I'm not sure what to do if I ever lose the card or it breaks. My idea is to generate the key using GnuPG on an isolated computer, ...
3
votes
1answer
509 views

Internal code-signing certificate on Windows

I'm looking to improve defense-in-depth on a system, primarily by closing some holes in injected DLLs. Certain applications installed on the system cause helper DLLs (e.g. shell extensions, BHOs, ...
1
vote
1answer
677 views

How to check executable code signing signatures?

How can I see all code signing signatures an executable has? I know that requests for a tool are usually considered as opinion based, but I really can't find one and I don't expect many answers. ...
3
votes
1answer
6k views

Java Applet - Need Code Signing Certificate vs SSL Certificate

I'm working on a Java Applet that used to be self-signed. Now that java 7u51 is being used, I am working to get the jar for the Applet signed. I used the certificate/key used for the apache2 ssl ...
5
votes
1answer
1k views

How is an Authenticode timestamp verified?

For an Authenticode signed file to be verifiable by Windows after the original signing certificate has expired (typically 1-3 years after issue), the file also needs to have a cryptographically signed ...
0
votes
1answer
118 views

What protection certificates would be required for an application that consists of setup, loading utility and main application?

Say we have an InnoSetup installer script, a native C++ QT files loading application and a .Net client application that we load/update each time and which is the main application. We load files via ...
3
votes
3answers
711 views

Why a self-signed digital certificate (X.509) cannot be altered?

I'm not experienced in code signing but I was thinking about this: as you know, there are various tools for self-signing digital certificate generation (as makecert from Windows or OpenSSL). Now, It ...
4
votes
2answers
860 views

What is the impact of the Bluebox Android APK integrity vulnerability?

Bluebox have recently disclosed a vulnerability (Android security bug 8219321) in Android, that is getting a lot of coverage in the media. The title of the post is "Uncovering Android Master Key" - ...
7
votes
1answer
930 views

Signing a browser extension

I want to make a browser extension available to users. Can I sign my extension so that users can verify it is authentic, without needing to trust the web site where they got the extension from nor ...
4
votes
2answers
966 views

Does Authenticode still work offline and with a “fake” certificate

Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a ...
1
vote
2answers
181 views

How does a code signing vender charge for creating certificate chains?

I have a question about creating digital signatures for pdf files. I want to have a certificate for my company and have children certificates as many as the number of company's employees who can ...
5
votes
2answers
1k views

Code signing with MD5 on Windows 8

I discovered that a signed installer package that is reported as correctly signed on Windows 7 and earlier, is reported as "corrupt" in IE10 on Windows 8. Further investigation showed that the ...
4
votes
1answer
161 views

Strategies for signing sections of a text file to prevent tampering

I'm looking for suggestions from the community on the best way to approach this problem of securing a text file while still making it fairly shareable: I have a collection of chef recipes in git, ...
4
votes
6answers
805 views

Is a self signed certificate sufficient to prove the integrity of my executable?

I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe. I would like to know if this ...