Code Signing is the process of putting a signature on executables and patches to prove it is genuine, and to prevent attackers from injecting malicious code into end-user's systems.

learn more… | top users | synonyms

14
votes
7answers
7k views

Deprecation of SHA1 code signing certificates on Windows

I have been keenly following the issues with regards to Microsoft deprecating the use of SHA1 code-signing certificates for Windows executables ...
12
votes
1answer
1k views

Should I sign someone else's code?

I'm working on a product that includes 3rd party drivers for some of the product's hardware. Some of the drivers are not signed, others are only signed with sha1 certificates. Given that getting new, ...
10
votes
1answer
225 views

Did D-Link's certificate revocation really only invalidate 1 day (of a six months long exposure)?

I'm trying to wrap my head around the OCSP revocationTime for D-Link's certificate. I recently answered another question and ended up drafting a timeline. That timeline is basically this: Jul 5 ...
9
votes
2answers
144 views

How do large companies protect their private (code-signing) keys?

Some time ago I read the canonical answer of our ursine overlord concerning CAs and their private (root) keys. More recently I stumbled across the question on the question on how to manage code ...
8
votes
1answer
1k views

Signing a browser extension

I want to make a browser extension available to users. Can I sign my extension so that users can verify it is authentic, without needing to trust the web site where they got the extension from nor ...
8
votes
2answers
317 views

AV detection of signed malware

With the massive Sony leaks (including their private keys/certificate), i was wondering: How do major AVs deal with signed binaries? ie: Does it influence their detecting ability of the signed ...
7
votes
3answers
140 views

Automatic detection of a compromised web server

I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker. Our website, say ...
7
votes
2answers
5k views

How to become Intermediate Certificate Authority?

I work at government organization. We would like to become Intermediate CA so that we can provide SSL certificates to our branch organizations. We must be able to do code signing, green address bar ...
7
votes
2answers
758 views

How do systems protect against a stolen code-signing certificate after the certificate expires?

Imagine this scenario: 1st December 2014 - a certificate is stolen and used to sign malware with 2014-12-01 timestamp. 15th December 2014 - the certificate is revoked. Malware will be prevented from ...
5
votes
1answer
1k views

How is an Authenticode timestamp verified?

For an Authenticode signed file to be verifiable by Windows after the original signing certificate has expired (typically 1-3 years after issue), the file also needs to have a cryptographically signed ...
5
votes
2answers
1k views

Code signing with MD5 on Windows 8

I discovered that a signed installer package that is reported as correctly signed on Windows 7 and earlier, is reported as "corrupt" in IE10 on Windows 8. Further investigation showed that the ...
4
votes
2answers
1k views

Does Authenticode still work offline and with a “fake” certificate

Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a ...
4
votes
6answers
846 views

Is a self signed certificate sufficient to prove the integrity of my executable?

I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe. I would like to know if this ...
4
votes
1answer
61 views

Are Ubuntu updates signed by a central authority?

When updating Ubuntu with the default setup, do updates need to be signed by multiple people, or is it a single person who controls what updates to sign? The reason I'm asking is that if a single ...
4
votes
3answers
439 views

Will it improve security if I place both SHA1 and SHA256 signatures inside codesigned binary on Windows?

My application targets platforms starting with Windows 7 32bit. Many of them aren't up to date (i.e. may be missing many recommended updates from Microsoft). Given the constraints I must use SHA1 ...
4
votes
2answers
248 views

What to do if you ever lose a smart card?

I want to use an OpenPGP smart card for signing releases, but I'm not sure what to do if I ever lose the card or it breaks. My idea is to generate the key using GnuPG on an isolated computer, ...
4
votes
1answer
176 views

Strategies for signing sections of a text file to prevent tampering

I'm looking for suggestions from the community on the best way to approach this problem of securing a text file while still making it fairly shareable: I have a collection of chef recipes in git, ...
4
votes
1answer
73 views

Cross-certification between worlds like X.509 and PGP?

Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert ...
4
votes
2answers
876 views

What is the impact of the Bluebox Android APK integrity vulnerability?

Bluebox have recently disclosed a vulnerability (Android security bug 8219321) in Android, that is getting a lot of coverage in the media. The title of the post is "Uncovering Android Master Key" - ...
4
votes
2answers
83 views

Centralized key management for IOS and Android Code Signing

What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines. I see systems like ...
3
votes
2answers
120 views

Secure Android app development [closed]

I'm beginning with Android App development and I want to make sure that I'm taking the proper security precautions since most apps will handle sensitive data. What security precautions should be ...
3
votes
2answers
106 views

Can the contents of a web page be protected from modification

We are developing an application sending highly sensitive data over the Internet. For this we use client side encryption so that even if an attacker would get access to our servers, the data could ...
3
votes
2answers
187 views

Does a valid code signing certificate mean that an installer has not been tampered with in transit?

Several dominant software vendors distribute updates over HTTP or over HTTPS with bad certificates. In general, it doesn't seem like I can expect to rely on a secure channel to ensure that an ...
3
votes
3answers
755 views

Why a self-signed digital certificate (X.509) cannot be altered?

I'm not experienced in code signing but I was thinking about this: as you know, there are various tools for self-signing digital certificate generation (as makecert from Windows or OpenSSL). Now, It ...
3
votes
1answer
6k views

Java Applet - Need Code Signing Certificate vs SSL Certificate

I'm working on a Java Applet that used to be self-signed. Now that java 7u51 is being used, I am working to get the jar for the Applet signed. I used the certificate/key used for the apache2 ssl ...
3
votes
2answers
107 views

Client side signing of a file(.exe,.dll,.jar..) using CA issued certificate and signtool [closed]

In a current project we have purchased certificate from a trusted CA and have installed in a host, sign tool is also installed in the same host. All the files which we develop(jar,dll,apk,exe etc..,) ...
3
votes
1answer
611 views

Internal code-signing certificate on Windows

I'm looking to improve defense-in-depth on a system, primarily by closing some holes in injected DLLs. Certain applications installed on the system cause helper DLLs (e.g. shell extensions, BHOs, ...
3
votes
1answer
2k views

Why does the tool 'codesign' in OS X 10.11 (El Capitan) report every Python process as “code object is not signed at all”?

If you start any Python process on OS X 10.11 (10.11.0 or 10.11.1) El Capitan, and run the OS built-in tool 'codesign' to verify the process, you will receive an error saying "code object is not ...
3
votes
0answers
64 views

How does a Sign tool work?

My basic understanding about sign tool is: 1.It loads the zipfile(may be exe,jar,ddl,apk..) which has to be signed to its memory(cache memory of the sign tool). 2.It will verify it, and unzip the ...
2
votes
2answers
200 views

Code Signing Confusion

I usually make free windows applications, now I want to digitally sign them. So users can be sure that its from me. But instead of buying the code signing certificate, I thought I may create my own. ...
2
votes
2answers
84 views

Java code signing vs. sandboxing

I'm trying to understand the rationale behind Java Applet development these past few years. Back in the old days, most Applets were unsigned, and the code for these was run in a sandbox where barring ...
2
votes
1answer
153 views

What does verified file in windows mean? And does it guarantee related files?

Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g Microsoft) or in other case, unknown publisher. I know public key encryption can ...
2
votes
1answer
194 views

Is code-signing with a non-ssl timestamp unsafe?

Assuming your code-signing tool is secure (e.g., does not suffer from buffer overflow exploits and the like), is there any reason to be concerned if a time-stamping service is not running over SSL? ...
2
votes
1answer
29 views

Signing a code and application

I want to send my application to different servers/terminals with content integrity and confidentiality. So, I need to some process to sign my code and application before sending it to servers and to ...
2
votes
1answer
99 views

Is there any way to discover why Windows Smartscreen is flagging your download?

Since Windows Smartscreen is now marking downloaded files signed with SHA1 post 1/1/16 as potentially unsafe, we have had to get a new code-signing cert. With it being a new cert, it has no ...
2
votes
1answer
194 views

Managing/Deploying a code signature certificate - Java Applet

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the ...
2
votes
0answers
85 views

Why did Google sign every auxiliary app inside “Google Chrome.app” (OS X version) except for one?

$ codesign -dvv /Applications/Google\ Chrome.app/Contents/Versions\ /46.0.2490.80/Google\ Chrome\ Framework.framework/Resources/app_mode_loader.app/ /Applications/Google Chrome.app/Contents/Versions\ ...
1
vote
2answers
103 views

Reverse Engineering - Countermeasures [closed]

I'm new to information security but I'm learning about reverse engineering. I read here about countermeasures to make reverse engineering hard. Does code signing protect the code from reverse ...
1
vote
1answer
36 views

Why timestamping chain is better than “code signature” chain?

Timestamping is recommended as the way to prolong signature validity after its certificate expiration date. One just need to add new timestamp signature before previous timestamp is expired. But ...
1
vote
1answer
100 views

Why are unsigned Java applications blocked?

Anyone can purchase a code signing certificate. They are cheap and do not involve much validation. Yet Oracle must have determined that disabling execution of unsigned applications increases security. ...
1
vote
1answer
919 views

How to check executable code signing signatures?

How can I see all code signing signatures an executable has? I know that requests for a tool are usually considered as opinion based, but I really can't find one and I don't expect many answers. ...
1
vote
2answers
186 views

How does a code signing vender charge for creating certificate chains?

I have a question about creating digital signatures for pdf files. I want to have a certificate for my company and have children certificates as many as the number of company's employees who can ...
1
vote
1answer
93 views

What Are Good Code Signing Environment Guidelines? [closed]

Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
1
vote
1answer
131 views

Is the enforcement of only allowing signed application to run in a Windows server a safe rule in a prod environment?

There are various security tools that allow an administrator to enforce only signed applications to run in a Windows operating system. is this a realistic general enforcement rule in a production ...
1
vote
1answer
527 views

Migrate a x509 key using KSP (CNG) to CSP (CryptoAPI) in Windows

I have a code signing certificate issued to me by a commercial CA, and the key was generated on my local development machine using the new Cryptography Next Generation storage providers. ...
1
vote
2answers
74 views

Sign contents of entire computer?

If I travel abroad and am concerned that when I land in the foreign country they may try to install a digital keylogger, does this work as a potential solution: If I sign my entire computer's hard ...
1
vote
1answer
254 views

Where can I find a list of checksums for windows files? Why don't MS sign all their executables?

Is there anywhere I can download a list of checksums for microsoft-published OS executable files, preferably grouped by release name? I could do the same by decompressing files on a windows setup CD, ...
1
vote
0answers
51 views

What Key Usage values are required to support Code Signing?

I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
1
vote
1answer
70 views

AuthentiCode Launcher runs everything

Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC ...
1
vote
0answers
48 views

How to Verify the Integrity of the BlackBerry Momentics IDE Download for Linux

I am currently setting up development environments for BB10 apps on Linux workstations. BlackBerry provides their Momentics IDE for free from (https://developer.blackberry.com/native/downloads/). The ...