2

What is the security benefit of signing an executable that is not a driver? How is the signature verified by the windows?

2

When an installer is signed but the content doesn't match the signature, Windows will warn you, as a part of UAC, that the publisher is unknown. It still allows you to choose running it and doesn't specify that the problem is with a mismatching signature.

Windows protected your PC

However, compromising a system doesn't require elevation: we are protecting data, not the system! There's also a lot of standalone executables: Windows allows you to run a tampered executable unless it doesn't require admin privileges. It even happily shows the original signatures in the Properties > Digital Signatures; you have to press Details for verification. You also have to do this to figure out why the UAC gave you this warning.

I'll demonstrate this with the well known PuTTY that has been used standalone long before it even had an installer. Let's modify a harmless string from the putty.exe to avoid breaking it – an attacker would obviously insert malicious code, instead.

Hex edit of putty.exe

Here we see the results, but Windows still runs the executable without any warnings.

Demonstration of running, tampered PuTTY

You can also see the signatures still in their place. For actual verification, you have to go further to the Digital Signature Details to see that it's not valid.

Digital Signature Details

This is the security benefit of signing even standalone executables. Just like publishing a checksum of the file on your download page, it's an extra measurement for those who would like to be sure.

Frankly, the fraction of the users actually checking this manually is small. People also tend to run the installer anyway: their goal is to install the software and they see the warning merely as an obstacle. However, this doesn't mean that you should avoid signing your executables. We just do our part and keep hoping people would learn – and Microsoft would embrace better security practices by emerging an alert even on standalone executables.

  • What is shown when you press signature properties? – Crypt32 Jan 29 at 7:47
  • It is not yet corrected. First statement is not correct. Windows does verify digital signature (it is a part of UAC). If you break the signature for installer, UAC will show a very different dialog. – Crypt32 Jan 29 at 12:06
  • @Crypt32: Edited. Please be welcome to find more problems with my answer. :) – Esa Jokinen Jan 29 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.