0

If need to launch/load binaries from trusted Windows locations like System32 or Windows or Program Files directories, should the binary signature be checked before using it?

Only Admin can copy/install file on trusted locations.

  • One word: TOCTOU – forest Oct 27 '18 at 11:31
1

It depends on your goal, and the sensitivity and other defenses of the system.

If your intention is a defense-in-depth measure, either against an incompetent/compromised/malicious admin or somebody using an exploit on the system, then checking signatures makes sense. It's not a perfect protection, because of course whatever code performs that check could itself end up compromised, or an attacker who is aware (or paranoid) of the risk may bypass the signature check by tampering with code in memory or performing a similar trick. For that matter, sufficiently well-funded malware may even manage to get itself signed by a trusted but fraudulent certificate (it's happened before). Defense-in-depth measures very similar to this have saved companies from attackers before, either catching them red-handed or at least stymying them enough that they couldn't reach the real goods before their intrusion was detected and their access cut off.

On the other hand, if the system is already very well-hardened and has good perimeter security, plus nobody who logs into it as Admin except a few trusted individuals for very rare, specific, and monitored operations... well, if you've got that level of security already you probably care enough to go for the additional defense in depth anyhow, but it's less likely that you'll need it. Alternatively, if the system isn't that sensitive (say, it's some user's home computer, unlikely to be especially targeted and not holding any amazingly valuable secrets), it may simply not be worth the engineering effort to set up and perform those checks. It's also worth testing for a performance hit; verifying a signature (especially on larger files) takes some time, and may prove unacceptable.

0

There is no reason why you should check the digital signatures of binaries, prior to launching them, when they are in a trusted location.

If there is a reason why you really should - like, these have been downloaded externally and the Admin is malicious or account compromised which is why the binary is in the trusted location, then I imagine that would be a reason for checking.

0

Yes, I would recommend you to check digital signature before loading the binaries. Considering following scenario

1.admin won't intentionally add malicious files to trusted location, but what if some malicious files gone inside during windows patching or any other software upgrade. 2.we cannot be 100℅ sure an antivirus program will always block malicious file inclusion to trusted location.

No technology is 100% safe. Checking signature is always safe play.

Cheers!!!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.