1

Let's assume we have a system delivering files (such as updating a program) that are digitally signed with a trusted CA. If an attacker somehow manages to install custom certificate as a trusted source on victim's machine, and then man-in-the-middle changes incoming files to other signed with this custom certificate, is there a way to prevent this? For example: can you check against only a pool of trusted-by-developer certificates?

1

Yes, this is called certificate pinning. You would simply verify the signature against a particular public key rather than any trusted public key when doing the verification of the signature.

That said, if the attacker has already compromised the local machine and installed a root certificate, they are unlikely to need to mess with your update mechanism to compromise your software anyway since they are already performing trusted actions on the client.

| improve this answer | |
  • +1 interesting thought. Installing a cert != arbitrary code execution (I don't think). Thought experiment with Frlirefox as an example: can installing a malicious cert into your OS trust store somehow allow me to update the FF binary to add a cert to it's list? – Mike Ounsworth Jul 20 '17 at 13:40
  • Thank you. This is exactly what I needed, and for the love of me could not find any information looking up only "Verify signed file based on single certificate" and similar. – Grzegorz Puławski Jul 20 '17 at 13:41
  • And for the comment about compromised machine, what I had in mind was more of a situation where a user with elevated privileges was convinced by attacker to install certificate, or similar. – Grzegorz Puławski Jul 20 '17 at 13:43
  • @GrzegorzPuławski - true, it isn't completely useless, but at the same time if someone convinced a user to install an untrusted root certificate, they can probably socially engineer them in to installing a RAT too. I wasn't so much saying you shouldn't pin. If you can pin (it never hurts) then you should. I was more highlighting that you shouldn't trust it as a catch all and slack on other protection for your application. – AJ Henderson Jul 20 '17 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.