2

Digital Signature verification process for software installation can be done automatically during execution or manually by user. (I'm considering PKI Method of certification.)

For example, in case of some exe's on Windows OS, if the Digital Signature verification fails, the binary fails to execute because of automated Digital Signature verification. Whereas, some .exe's do not verify signatures automatically, and user can verify the Digital Signature manually. Also, in case of detached signatures such as catalog file or CMS signatures verification can be done by user manually with available commands such as Get-AuthenticodeSignature or OpenSSL respectively.

So, regarding manual vs automated methods I had a discussion with someone, and he told me that manual verification is a flawed process since user may forget to verify the signature. So, automated verification is a necessity.

On the other hand, I think manual verification is better even if user forgot since in automated verification there is more possibility of user being careless and trust the automated process which can be exploited if system or keys are compromised.

Also, I think that both the methods are secure until the Signing Key is secure, and System Integrity is maintained where verification needs to be done.

So, my question is there any added advantage to Automated Digital Signature verification in the case of software installation where user interaction is involved.

Edit: Please consider below scenarios for the same

  1. Systems are not connected to internet so no automated updates.
  2. Installations are done manually or atleast intiated manually by user.

2 Answers 2

2

That “someone” is correct. Automated signature validation helps security far more than manual signature validation.

First consider your counter-argument: you said that an automated process can be exploited if the system or keys are compromised. If the system or keys are compromised, your user will have no more insight to the danger than an automated system. How would your user know if the signing keys were copied? [Hint: they wouldn’t.] Both systems are equally vulnerable to this concern.

Second, if you rely on manual processes only, your system can be compromised because anything can be done when there there are no automated checks.

Automate all the checks you can. Don’t waste your users’ time forcing them to do what the machine can already do better and faster than they can. Never skimp on security by allowing an untrained user to bypass security whenever they feel like it, or if they don’t understand it, or if they’re in a hurry.

100% signed code is hard to achieve and maintain, but is one of the most effective anti-malware tactics you can deploy. It’s far better than whitelisting or file integrity monitoring tools exactly because it’s automated and enforced by the OS.

And if the machine’s security is already compromised, nothing the user can do will save it anyway. The damage has already been done.

EDIT: Code signing cannot be defeated by forging a signature. It’s so effective it’s the basis of securing Apple’s entire iOS system. You may remember a time when “jailbreaking” iPhones used to be common. That pretty much ended once Apple fixed every bug in iOS that enabled it; today, consistent jailbreaking can only be performed by someone with physical access to the phone.

A 100% code signing design has resulted in iPhones becoming the most consistently secure OS in common use by the public today.

6
  • Thanks, I got the point. But what if the keys of some trusted third party stolen whose public certificate are installed in our system is used for signing data and send to our systems? Automated process will consider the verification valid and allow the installation. Whereas in manual verification user can check the logs and alerts generated where certificate information is available and check certificate doesn't belong to our company.
    – saurabh
    May 22, 2021 at 12:12
  • Also, you said that this is the most effective anti-malware tactics. But my understanding is Digital Signature is all about integrity and authenticity and malware can still be deployed even with digitally signed data or my understanding is wrong?
    – saurabh
    May 22, 2021 at 12:19
  • Do you really call DigiCert to see if their certificate has been breached before you browse somewhere? Of course not. At some point you trust someone; that’s why we call them “trusted” third parties. May 22, 2021 at 13:44
  • I can trust the known CA's but what about vendors who get the certificate from these CA's. And we do many third party software installations in our systems.
    – saurabh
    May 22, 2021 at 17:05
  • @saurabh , I’ve added a bit more to my answer regarding strong empirical evidence that code signing makes a system more secure. And if you don’t trust the third parties you need to rely on, manual verification of code signatures is still a useless gesture. May 22, 2021 at 17:24
1

I agree with @John Deters, but it's not always a trusted method that you can rely on.

You can face a fileless malware attack or other malware that uses a process hollowing technique. If you don't know the process tree and the behavior of such a service, you wouldn't catch it, and you will find it signed.

You can find this example when a process launches svchost.exe. If you look at the signature, you will find it signed by Microsoft. It's always better to have detection based on behavior, not only on static indicators.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.