I'll need to use an hardware token, specifically the SafeNet eToken 5110 that comes with DigiCert's EV certificates, for code-signing on Windows.

I know that they issue a prompt to manually enter the token's password at each signing attempt (or at each session, if you enable the single logon option).

I wonder:

How safe are those prompts from keylogging or other password interception techniques?

And thus how much would I increase security by really filling those prompts manually vs. automating them with methods such as those listed here ?

I know that by automating the process I would increase the attack surface, by the fact that the password will probably be stored on disk and for sure on various additional memory locations, but I have a feeling that these software password prompts are nonetheless mostly "security theater", and that there are easy ways to intercept the password (and thus have it later entered programmatically by a malicious program) even if manually typed .

Here I assume that the computer where the token will be used will be an up-to-date Windows 10 system reasonably hardened, so for sure at least not running under an administrative account. It certainly won't be fully isolated though (one way or another I'll have to pass the files to be signed to the system).

I realized that this environment description might be too vague, if that's the problem for the time being we can assume instead a fresh Windows 10 installation, running under a limited account, with decent passwords for that and the administrator's account, connected to the internet through a lan and let's say even joined to a domain.
The rest of the lan is not to be considered really safe.
Let's just add that Windows' privacy options have been all set to deny, just to take out the possibility that Windows sends out the password to its servers to "improve typing", which wouldn't surprise me too much.
I'm not concerned about physical attacks here.

I found the eToken 5110's FIPS 140 security policy. I gave it a quick look but I didn't get too much from it, it doesn't seem to be concerned with the part of the password entry from its typing to when it gets sent to the device.

I think (but not 100% sure) that it is a USB CCID device and that it uses the Microsoft Class Drivers for USB CCID Smart Cards, and that this entails that the password entry is handled mostly by the operating system, rather than by code from the vendor (but again not 100% sure).

  • 1
    "How safe is x?" is not a very realistic type of question to ask. An answer could be "It is ninety two-er and three fifths more secure than insecure!". Makes about as much sense as the question. You have laid out several points on the process of entering the code for the certificate and how it can be done in a variety of ways. I would focus on those specific potential points of exploitation and ask about them specifically. – 0xSheepdog May 16 '17 at 18:50
  • @0xSheepdog Have you read the entire question? The title was already long enough so I've not put every single detail in it, but the question is (as said above) How safe are those prompts from keylogging or other password interception techniques? I'm not a native english speaker but I think it's pretty obvious that I'm asking what are the risks of having the password intercepted (by a rogue program - if there was that doubt I'm not particularly concerned about physical attacks). I wasn't asking for a numeric grade, of course. – gbr May 17 '17 at 11:43
  • @0xSheepdog Of course you need to know the environment to answer that question, as I said assume a Windows 10 reasonably hardened; it's not very specific, I know; if that was the problem I edited the question to assume a pretty much default new Windows installation for the time being, as right now I don't know what specific actions will be put in place and I'm relying in part on the outcome of this question to decide them (see the edit). – gbr May 17 '17 at 11:44
  • @0xSheepdog "Makes about as much sense as the question" Much more than your comment, to my eyes | "You have laid out several points on the process of entering the code for the certificate and how it can be done in a variety of ways" I have no idea what the fuck you're talking about. Yes I said fuck, sorry but I had very different expectations for this question; I took a considerable amount of time to write and research it and I expected to find a very different situation on this page after 15 hours. – gbr May 17 '17 at 11:44

If a key logger is infecting your machine, any text you type, including the private key you enter to the SafeNet prompt will be stolen as you type it in. You better use an automated entrance of the private key like in this article I wrote. The idea is to use an API call to connect to the hardware token and to sign an .exe with it but instead of using the user interface provided by SafeNet.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.