2

Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC privileges, and launches the project's EXE file.

Beside the fact that the vendor's program can be cracked without anyone noticing it, I am wondering about following 2 issues:

  1. If someone writes a malicious program, they could use the vendor's launcher to make the victim feel good when they see a blue UAC dialog.

  2. Technically, the vendor didn't sign a malicious code (*), so the vendor isn't "responsible" for the malicious activities, and the CA would probably not revoke the certificate of the vendor.

So, what are the consequences of this Launcher (i.e. is the vendor responsible, and would the CAs revoke his certificate?), and is it true that AuthentiCode can be so easily tricked by using launchers and/or unchecked DLL imports?

(*) the launcher is a rather extreme case; however, nearly every signed executable that runs code from a DLL could be used to execute malicious code (in unsigned/unchecked DLLs). Afaik, the static linking of DLL files do not contain any AuthentiCode check, so that these executables are as evil as the Launcher EXE.

  • Libraries that are linked at compile time get included in the main EXE and are signed by Authenticode. It is only the dynamically linked DLLs that are excluded from the signature. – Neil Smithline Oct 24 '15 at 16:51
  • Can you edit your question to make it more specific than is AuthentiCode broken? What do you mean by broken? Does it allow some specific attack? Etc... – Neil Smithline Oct 24 '15 at 16:52
  • I am sorry if it wasn't clear. I will edit the question. (1) I probably was a bit confused about the terms. I meant static linking of a DLL, using the import tables of the PE image. (2) With "broken" I mean that AuthentiCode doesn't seem to protect the user against code that is injected by DLLs or by launching a new process which is unsigned. It might be even a design fault. – Daniel Marschall Oct 24 '15 at 17:03
1

Windows indeed does not show any security warnings when an elevated process (i.e. one that passed the UAC dialog) launches another process or loads a DLL. This is not a problem with Authenticode, because Authenticode just applies a signature. This could be considered a problem with the trust model in Windows.

Basically, when the user clicks Yes on the UAC dialog, they're saying that they fully trust the executable they're about to run and want to give it full access to their PC. This includes the ability to load any DLL or launch any EXE. If the user thinks the vendor's launcher may launch malicious executables or may be vulnerable to DLL injection attacks, then they should click No on the UAC dialog. The vendor may not have signed malicious code, but they have certainly signed vulnerable code, and they are certainly responsible for that.

If you are the vendor contemplating writing such a launcher, you can make your launcher verify the signature on the executable before launching it. Refusing to launch an executable without a proper signature would offer stronger protection than your suggestion for Windows to show another UAC prompt which the user may mindlessly click Yes to.

Ultimately, a digital signature like applied by Authenticode can only be used to verify the origin of the code. It cannot be used to verify whether the code will do anything malicious.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.