Should I trust signed GOG games, which are not original?

Question

First I don't want to promote any kind of pirated software here, just don't know where and how to ask this question.

I find out crackers share games released on GOG (which are DRM free), it's interesting that executables are officially signed, so it's perfectly original software, except it's not bought by those who download.

now my question is, how do they manage to do this? are these games 100% free of malware? it should be if it's signed.

what benefit does somebody have to buy a game and then share it? I understand pirated games almost always packed with malware, hence not signed (so cracker has some benefit here) but this is different, no benefit.

are there any security precautions regarding such signed software? and why does somebody let their product be sold on GOG.com without DRM protection in the first place?

Answer 1

GOG is not a pirate or cracking group. Removing DRM is a good thing for anyone owning an original product.

They officially re-sell games and their modifications of the games make the more compatible with latest operating systems. Removing the DRM is not the only thing they do.

I do not like the fact that they add various custom registry entries when installing their games, but it is nothing serious, just new junk reg entries most software today adds (original game installers included).

As for the quality of the products, mostly it is better than the original due to the compatibility fixes they make. Imagine playing MS-DOS era games on Windows 10 and actually having no trouble of any kind.

That does not mean the alterations they sometimes do will be liked by all. For example, I do not liked that for some old MS-DOS games they changed the OSTs from .mids to .mp3s (because of compatibility reasons mentioned above). The music is no longer the original one - and I do not agree with such modifications, even if they are done due to compatibility requirements. These are rare cases, though.

So no, they do NOT contain any malware or anything dangerous. In fact, running their games is safer to your own system compared to the original releases exactly due to the lack of DRMs.

Why the original owners of the games let them do what they do is quite another off-topic long story, but basically it's sufficient to say that it happens because they too do get profit out of this.

Answer 2

A digital signature is as trustworthy as the company signing. Therefore, the fact that an executable is signed means nothing. Anyone can set up a fake company and create a signature for that company. This fake company can then use their own signature to spread malware.

However, GOG is generally seen as trustworthy and so is their signature. This is not a technical conclusion, this is an empirical observation.

Answer 3

I understand pirated games always are packed with malware, hence not signed (so cracker has some benefit here)

Belive it or not the world is not black and white, it is not divided into people who are 100% law abiding on one side and scumbags who will do anything for a buck on the other.

what benefit does somebody have to buy a game and then share it?

Some share it for kudos in their pirate communities, some share it primerally for their friends but don't care if other people download it too.

are these games 100% free of malware? it should be if it's signed.

So we are talking about a game that appears to be signed by gog but was obtained from a pirate site.

There are several questions I would have.

1. Is gog trustworthy? probablly as much as any other legitimate software vendor.
2. Could gog have included malware by mistake? such incidents do happen to legitimate software distributos from time to time (I don't know about gog specifically), and a pirate site may keep an unintentialy infected version around after the original distributer has purged it from their site.
3. Is windows code signing effective for self-extractors? From my brief reading of http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/authenticode_pe.docx it looks like the answer is yes, but i'm no expert on windows code signing.
4. Was the cert used to sign the software really assigned to GOG, or was it obtained from an authority fraudlently? I have no idea how good a job the authorities allowed by MS to issue code signing certs do.

In summary I think a file that is apparently signed by someone like gog is safer than one that is not signed, but the risks aren't nessacerally zero.