3

I downloaded a setup.msi file from an untrusted website. Virustotal says it's a signed file and valid signature, by the developer company and "GlobalSign Extended Validation CodeSigning CA" 3 times and also 3 times counter signed.


Does it mean, that the file is 100% the original file from the developer company and there is no way to tamper with it in any way, without breaking the file signature?

1
  • In security, never speak in absolutes. While there may not be any way to tamper cryptographically, you are trusting that the involved entities are who they say they are, and are legitimate. Nov 23, 2019 at 3:25

1 Answer 1

1

Does it mean, that the file is 100% the original file from the developer company and there is no way to tamper with it in any way, without breaking the file signature?

That means with practically 100% that the file is signed with the companies key, i.e. the cryptography behind a digital signature itself is fine. But that does not mean that it can be fully trusted.

Since such a key might have been stolen this does not mean that it was actually signed by the company. Also, the company name in the certificate does not necessary is the company you assume it is since it is possible to register the same or similar sounding company somewhere in the world and get a code signing certificate for it. In general you cannot simply assume that the certificate was issued for a legitimate and trustable company just because the issuer is a well known CA - misuse of trusted code signing certificates is actually common. And apart from getting certificates for fake certificates or compromising the original certificates the attacker might also have compromised the companies infrastructure and introduced a backdoor into the code which as part of the shipped program is also included in the code signature.

2
  • To check the authenticity of the company's certificate, I downloaded a different software file which is also signed with the company's certificate and upload it to Virustotal and compared the fingerprint of the two certificates (suspicious setup.msi and trusted file.exe) and they match! :D So, the file should be original and non tampered from the signing developer, right? :/ Nov 23, 2019 at 12:09
  • @user3200534: Again, all what it means is that it was signed with the same key. It might still be that the attacker has compromised the key of this developer or that that the attacker has compromised the infrastructure and embedded a backdoor inside the software before it got signed. Nov 23, 2019 at 13:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .