2

When a software company sends me 1 file and asks me to install it then I check the signature and it is valid under the Cert (issued by Thwate CA). So is installing that file sent by that company safe? I mean:

  1. Is there any chance a malicious superuser can alter that file?
  2. If I don't know that company, should I install it? When signing the file, does CA check that file or they just signed it and didn't care whether the file is harmful for receiver or not? Sorry for gramma mistakes, I am not English speaker.
  • If you don’t know the vendor and the purpose of the software you cannot trust it. CAs won’t know and cannot guarantee for the content of signed packages. And typical authentication procedures and key handling can also introduce serious doubt into the identity of the organization. Only use it as a negative filter, not as the only source for acceptance decisions. – eckes Dec 5 '18 at 15:32
3

What usually happens is that the CA creates a certificate for a company, and that company signs the software. The CA validates whether the company is who it says it is, but doesn't check the software at all.

So a corporation called ACME can get a certificate for ACME from Thawte CA. They can then sign any software with that. If you receive such signed software all you know is that ACME signed it. It says nothing about the software. Thawte didn't check the software, they only checked whether they gave an ACME certificate for ACME.

If you don't know the company, the fact that it is signed doesn't offer any security. It only offers security if you know and trust the company. For example, if software is signed by Microsoft I generally trust it not to be malicious. If it is signed by ACME I still don't know.

1

In addition to Sjoerd's answer, you are also trusting the certificate authority (in this case, Thawte) to have done its work.

What if the certificate was issued by a Chinese, Brazilian, Russian, Dutch, Nigerian, Indian (etc.) CA?
Ultimately, you (also) rely on the credibility you give all institutions in the certificate chain.

0

There's two layers of trust here.

  1. Thwate CA has verified the Software company, and given them a Private Key. Do you trust Thwate CA to do this? Well seeing as how they're on the Windows root store, that would be reasonable.

  2. Now If you trust Thwate CA to verify Software Company -- do you trust the Software Company. Are they competent enough to have not lost their keys to malicious parties? Also do you trust them in general to make safe software.

Some software makers don't go through signing their software -- instead they publish a hash of their instalers online. In my opinion, signing of the software with a cert that is trusted by the OS root store is a better option than publishing an hash on a website, but it depends on what you're protecting against.

I'd ask more basic questions rather than signed software -- who gave you the software? Did you receive it via email or download? Do you know the person who sent it to you? Did the AV pick it up? You can submit it to VirusTotal if you're really short on trust, etc etc.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.