I read today about the CCleaner hack and how code was injected into their binary. People were able to download and install the compromised software before the company had noticed.
Isn't this what digital signatures are for? Would signing the binary or providing a checksum have done anything to prevent this?
To add to the confusion, in this Reuters news article a researcher claims they did have a digital signature:
“There is nothing a user could have noticed,” Williams said, noting that the optimization software had a proper digital certificate, which means that other computers automatically trust the program.
How could the OS accept to install a software with an invalid signature? Or can an attacker change the binary and forge the signature?