Digital Signature verification Automate vs Manual

Question

Digital Signature verification process for software installation can be done automatically during execution or manually by user. (I'm considering PKI Method of certification.)

For example, in case of some exe's on Windows OS, if the Digital Signature verification fails, the binary fails to execute because of automated Digital Signature verification. Whereas, some .exe's do not verify signatures automatically, and user can verify the Digital Signature manually. Also, in case of detached signatures such as catalog file or CMS signatures verification can be done by user manually with available commands such as Get-AuthenticodeSignature or OpenSSL respectively.

So, regarding manual vs automated methods I had a discussion with someone, and he told me that manual verification is a flawed process since user may forget to verify the signature. So, automated verification is a necessity.

On the other hand, I think manual verification is better even if user forgot since in automated verification there is more possibility of user being careless and trust the automated process which can be exploited if system or keys are compromised.

Also, I think that both the methods are secure until the Signing Key is secure, and System Integrity is maintained where verification needs to be done.

So, my question is there any added advantage to Automated Digital Signature verification in the case of software installation where user interaction is involved.

Edit: Please consider below scenarios for the same

1. Systems are not connected to internet so no automated updates.
2. Installations are done manually or atleast intiated manually by user.

Answer 1

That “someone” is correct. Automated signature validation helps security far more than manual signature validation.

First consider your counter-argument: you said that an automated process can be exploited if the system or keys are compromised. If the system or keys are compromised, your user will have no more insight to the danger than an automated system. How would your user know if the signing keys were copied? [Hint: they wouldn’t.] Both systems are equally vulnerable to this concern.

Second, if you rely on manual processes only, your system can be compromised because anything can be done when there there are no automated checks.

Automate all the checks you can. Don’t waste your users’ time forcing them to do what the machine can already do better and faster than they can. Never skimp on security by allowing an untrained user to bypass security whenever they feel like it, or if they don’t understand it, or if they’re in a hurry.

100% signed code is hard to achieve and maintain, but is one of the most effective anti-malware tactics you can deploy. It’s far better than whitelisting or file integrity monitoring tools exactly because it’s automated and enforced by the OS.

And if the machine’s security is already compromised, nothing the user can do will save it anyway. The damage has already been done.

EDIT: Code signing cannot be defeated by forging a signature. It’s so effective it’s the basis of securing Apple’s entire iOS system. You may remember a time when “jailbreaking” iPhones used to be common. That pretty much ended once Apple fixed every bug in iOS that enabled it; today, consistent jailbreaking can only be performed by someone with physical access to the phone.

A 100% code signing design has resulted in iPhones becoming the most consistently secure OS in common use by the public today.

Answer 2

I agree with @John Deters, but it's not always a trusted method that you can rely on.

You can face a fileless malware attack or other malware that uses a process hollowing technique. If you don't know the process tree and the behavior of such a service, you wouldn't catch it, and you will find it signed.

You can find this example when a process launches svchost.exe. If you look at the signature, you will find it signed by Microsoft. It's always better to have detection based on behavior, not only on static indicators.