Windows - Revoked Binaries

Question

I find it hard to believe that the majority of Windows system files aren't signed. I don't know whether my disbelief comes from naivety, or because Windows is used within secure environments worldwide and thus one would expect a certain level of care. (Does signing files show care? Probably not.)

But I imagine this lack of signing is the reason why the revocation status of signed runtime binaries aren't checked. Thus, one could have a signed binary which has been specifically revoked for whatever reason, and Windows doesn't care and will let it run. I have tried to enhance this functionality by using AppLocker.

From the website, Microsoft state (http://technet.microsoft.com/en-us/library/ee619725(v=ws.10).aspx):

However, if a certificate was allowed and then revoked, there is a 24-hour period before the revocation takes effect.

Whether this statement refers to "allowing" and then "disallowing" an app using AppLocker certificate rules, or the actual revocation status of the AppLocker binary, I'm not sure but I certainly can't get it working.

This commentary leads me to the question: Shouldn't all vital system files be signed and their CRLs checked before execution (along with specified business app binaries)? Are there software products which will enforce these kind of policies?

Answer 1

How do you validate the signature? If you can compromise the system files, chances are you can also compromise the root public keys being used to validate against and the files would still appear valid. Signed files only helps if the system is otherwise secure, if the system files themselves are corrupt, that is no longer a true statement and all pretense of security goes out the window.

Now if you are just talking about secure, trusted boot and requiring a signed OS kernel and bootloader at the EFI level, that is supported when using BitLocker, but most systems don't bother to fully support this, so it can't be on by default as most hardware and/or consumers can't or won't make use of it.