1

Let's assume we have a system delivering files (such as updating a program) that are digitally signed with a trusted CA. If an attacker somehow manages to install custom certificate as a trusted source on victim's machine, and then man-in-the-middle changes incoming files to other signed with this custom certificate, is there a way to prevent this? For example: can you check against only a pool of trusted-by-developer certificates?

1 Answer 1

1

Yes, this is called certificate pinning. You would simply verify the signature against a particular public key rather than any trusted public key when doing the verification of the signature.

That said, if the attacker has already compromised the local machine and installed a root certificate, they are unlikely to need to mess with your update mechanism to compromise your software anyway since they are already performing trusted actions on the client.

4
  • +1 interesting thought. Installing a cert != arbitrary code execution (I don't think). Thought experiment with Frlirefox as an example: can installing a malicious cert into your OS trust store somehow allow me to update the FF binary to add a cert to it's list? Commented Jul 20, 2017 at 13:40
  • Thank you. This is exactly what I needed, and for the love of me could not find any information looking up only "Verify signed file based on single certificate" and similar. Commented Jul 20, 2017 at 13:41
  • And for the comment about compromised machine, what I had in mind was more of a situation where a user with elevated privileges was convinced by attacker to install certificate, or similar. Commented Jul 20, 2017 at 13:43
  • @GrzegorzPuławski - true, it isn't completely useless, but at the same time if someone convinced a user to install an untrusted root certificate, they can probably socially engineer them in to installing a RAT too. I wasn't so much saying you shouldn't pin. If you can pin (it never hurts) then you should. I was more highlighting that you shouldn't trust it as a catch all and slack on other protection for your application. Commented Jul 20, 2017 at 13:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .