Questions tagged [code-signing]
Code Signing is the process of putting a signature on executables and patches to prove it is genuine, and to prevent attackers from injecting malicious code into end-user's systems.
0
votes
2answers
157 views
How to verify a private key has not been compromised?
I have a machine with a process that signs code for users running 24/7 (encrypting the key is not possible), which will be protected as well as possible. Is there a way to set things up such that I ...
0
votes
0answers
32 views
Secure way to sign virtualbox module for secure boot
I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official ...
3
votes
0answers
30 views
how to verify turbotax software
I bought turbotax software from amazon (downloaded mac version). Therefore, I know it is safe to use. However, if one wants to verify the software has not been tampered with how do we do that ?. Mac ...
1
vote
1answer
51 views
Code-Signing: Why is the CA process different from web site certificates?
I recently went to renew a code signing certificate. In preparation I went through our usual process (as for web server certificates) of creating a key pair and a CSR with OpenSSL. When I then went ...
0
votes
1answer
55 views
Software Signing Standards
Is there a software signing certificates standard, officially or by popularity?
As I understand the SSL/TLS/https certificates rules are specified by the RFCs. Mixed use of servers and clients from ...
0
votes
1answer
73 views
Are all fields of the PE certificate directory hashed during authenticode signing?
In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
0
votes
2answers
121 views
Deploy verifiable webapp source code
Recently there have been quite some discussions about the security approach of ProtonMail. Since it do crypto stuff at client-side, loading the javascript code in the user's browser, as far as i know, ...
1
vote
0answers
65 views
Working with Security Metadata in APK file
According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK ...
1
vote
2answers
80 views
What happens when the timestamper's certificate expires?
What happens when the timestampers certificate expires?
If the code is now untrusted, can it be re-stamped without re-signing?
If not, what good does this timestamp do me if my cert is valid until the ...
2
votes
1answer
102 views
How can I verify signed commits made by other people?
As identified in this related question, github signs commits made from their application with their GPG key 4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to ...
2
votes
1answer
69 views
Alert when unsigned code is run?
I know Windows 10 has a lockdown option, to forbid running unsigned code. But in my organization, I'd get shot if I tried to do that. So I'd like the next best thing: a remote alert whenever unsigned ...
0
votes
1answer
137 views
why is it necessary to have both code signing and time stamping certificates?
I have read about the option to create certificates for signing codes and time stamping. why do we need both of them?
I understand that it helps me when I need to increase the validity of my code, ...
4
votes
0answers
374 views
Where to put a code signing server with EV code signing certificate and plugged-in HSM
Microsoft recently started enforcing apps to be signed by EV code-signing certificates instead of just regular certificates. These usually come on an external device such as USB smart card or a HSM, ...
1
vote
1answer
45 views
Verifying resident program “integrity” before every run
I am aware that operating systems verify authenticity & integrity of a program file while installing a program to a system.
My question is, do popular OS's provide a way to verify (and warn the ...
3
votes
1answer
250 views
Symantec rooted certificates trust and Oracle Java trust store, is Oracle planing to remove trust as well?
We are using Symantec CA rooted certs to sign JARs. Since Google and Mozilla have indicated that they are not trusting Symantec CA, should I be concerned that Oracle will remove trust from Symantec CA ...
1
vote
1answer
68 views
Verification of Python(x,y) installer
I'm an Aerospace Engineer just starting out in my field, I'm planning to start using Python, but I've run into a bit of a conundrum. I downloaded Python(x,y)-2.7.10.0.exe Windows installer from here (...
4
votes
1answer
245 views
Certificate and key abuse
I made a mistake several years ago by uploading OpenSSL certificate key (.pem and .pk8) into a blog post. The key was used to sign Android apk using SignApk.jar tool. Someone took it and used the key ...
1
vote
1answer
234 views
USBlyzer - Safe Or Not?
I need to use a USB analyzer. I've been looking at a couple of different options. This one came up. As far as I can tell, it's not open source, but seems to be quite popular. Seeing that the data ...
23
votes
2answers
3k views
Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?
This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab
What is going on here?
1
vote
0answers
49 views
Resigned Windows app showing warning when downloaded
We have an Windows desktop application signed using a GoDaddy certificate. The certificate expired recently so, for the latest upgrade of the software, we went through the steps of renewing the ...
2
votes
1answer
136 views
How to make my homemade program not come up with security warnings?
I am an amateur developer and trying to make a exe file for windows that can be downloaded from the internet, or sent to my colleagues via email, but whenever it's opened it comes up with two warnings ...
4
votes
1answer
88 views
Is it reasonable to have the software hold something that the user can't tamper with?
I want to create a piece of software that will hold some information, the program works offline and I want to make sure that information can't be tampered with.
The program can create or alter it's ...
2
votes
1answer
410 views
Can I use the same ssl cert to protect my web site and sign my app?
I'm considering buying an SSL cert from my web host provider (smarterasp.net)
They list the cert as :
SSL-S Comodo SSL Certificate - Single Domain or Subdomain
Do you know if I can use that ...
1
vote
0answers
25 views
Restricting allowed app signers
Android requires apps to be signed and since Nougat the signature acctualy guards all the parts of the APK file.
However it seems that anyone can sign their app, and verifing the signature would ...
1
vote
1answer
172 views
Is signing safe from brute force attacks?
I am using itsdangerous to sign a string using a secret key. It says that the signing mechanism is HMAC and SHA1 and that it is an implementation of the Django signing module.
Assuming I use one ...
-1
votes
1answer
481 views
Expired Digital Certificate for an EXE
An EXE file that I downloaded from the official website has an expired digital certificate signature (1999 to 2015) That is it has been expired for two years. Is it still safe to run the EXE? There is ...
1
vote
1answer
308 views
Authenticode Certificate to avoid A/V
If I sign an executable with an authenticode certificate will any A/V stop flagging it as a virus?
0
votes
1answer
117 views
Dual Code Signing: Should SHA-1 signature have a SHA-1 or SHA-2 timestamp?
I am signing executables for our software both with a SHA-1 and a SHA-256 signature. In addition I timestamp both of these signatures.
Here I am wondering: I can timestamp the SHA-1 signature with a ...
1
vote
0answers
726 views
How safe are the password prompts of the SafeNet eToken 5110 or similar cryptographic hardware tokens?
I'll need to use an hardware token, specifically the SafeNet eToken 5110 that comes with DigiCert's EV certificates, for code-signing on Windows.
I know that they issue a prompt to manually enter the ...
5
votes
1answer
743 views
Possible to sign an imported key with a subkey using gpg?
In the interest of safeguarding my master key I store it offline. I have a gpg subkey with indicator SEA that I keep available on my system. When I download software I verify it using the provided asc ...
1
vote
1answer
113 views
Certificate owner information
Let's check this executable...
This digital signature is OK.
Ok fine.
Name: Cocoa Nuts Unicorns Ltd
Uhm that does not tell me anything.
So, I have a valid signature and a valid certificate. ...
5
votes
1answer
249 views
Server side code signing
I'm currently implementing a couple of security improvements to a crypto currency trading website that handles all data client-side and uses a static file approach.
One of the things I've been asked ...
1
vote
1answer
645 views
Using a HSM device for code signature generation
I currently generate code signatures for my open source package by using openssl.
The way I do it is :
Generate RSA private-public key pair (E.g. openssl genrsa)
During packaging , I create a ...
3
votes
3answers
606 views
Can I use a code signing certificate as a TLS certificate?
For example, I develop a software which is used by some customers. They sign the software using their code signing certificates. The software has a client and a server part which are connected to each ...
13
votes
2answers
7k views
Smart-Screen filter still complains, despite I signed the executable, why?
First and foremost, this is my very first experience with Code Signing.
I bought Standard Code Signing from Certum for 3 years.
I intend to publish applications in Czech republic mostly.
But to the ...
1
vote
1answer
712 views
Runtime checksum of Mach-O differs from executable checksum
In our iOS application we are trying to make an anti-tamper check.
What we would like to apply is a common procedure used in anti-tapering techniques. We are trying to get the __text section of a Mach-...
5
votes
2answers
1k views
Does linux support signed binaries?
I am looking for something similar to what iOS supports. Does it exist in linux?
With a secure boot (based in hardware chain of trust), doesn't it make sense to have signed binaries for security? ...
0
votes
2answers
489 views
Will digital signature prevent tempering, or at least harden the cracking, of my Windows applications?
I intend to buy my first digital signature intended for signing EXE files. In particular Certum Standard Code Signing caught my eye.
It is SHA-2 based with up to 4096 RSA.
Is it worth my money if I ...
2
votes
2answers
2k views
Can android application be repacked with original developer's signature?
I am researching on Android application repackaging. I know the original developer self-signs the APK. Is it possible for a hacker to fake the signature and make it appear as the original signature ...
1
vote
1answer
242 views
Why should I sign git commits/tags? Should I sign both commits and tags?
Easy question, but no one has asked it here as far as I see: Why should I sign git commits?
To give some more things to answer there is also this question: Why should I sign git tags (releases)?
And ...
8
votes
1answer
722 views
Why does Microsoft use a digital signature catalog instead of a signature in the executable?
I own a code signing certificate, so I can add digital signatures on files that contain executable code.
Microsoft seems to use a "new" way and provides most digital signatures not in the file itself ...
1
vote
1answer
1k views
Can renew expired Microsoft CA Code Signing cert?
I have a Code Signing cert signed by an internal Windows CA. The person who monitored our certs left our company and this cert recently expired. I am hitting the CA website and I'm in the renew area,...
0
votes
1answer
69 views
Potential consequences of signing software that's not mine
I want to teach my son to not click unsigned software. Unfortunately there some software that's highly useful (e.g. Search Everything, but it could be any other software) that's not digitally signed.
...
4
votes
3answers
2k views
Why is a .jar signature still valid if a file has been added to the jar?
I was reading the man page for the jarsigner tool that ships with the JDK. This line surprised me:
A verification is still considered successful if none of the files that were in the JAR file when ...
4
votes
1answer
538 views
Signtool validation fails when signing and validating are done in different machines
I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed ...
1
vote
0answers
39 views
Has “Unit Test Bundles” on iOS or Mac been an attack vector?
In the current beta version of XCode, for the first time, you are required to sign your "Unit Test Bundle".
Current beta version being 8.0.
I was wondering if this is a bug that they will fix, or ...
0
votes
1answer
1k views
How to share EV Code Signing Certificate with USB token with other developers?
I got the Extended Validation Code Signing Certificate from Global Sign
https://www.globalsign.com/en/code-signing-certificate/
They sent over a USB Token which I installed the certificate to ... or ...
3
votes
1answer
488 views
Application Whitelisting Approaches/Options on non-Enterprise Windows PCs
For a while now I've been kicking around the idea of implementing application whitelisting on a few sets of machines (owned by 2-3 different consulting clients) I administer that seem suitable for it. ...
1
vote
1answer
87 views
Do android apps have signatures like Window executables?
Windows has a pretty good signature system. I was wondering if Android has a signature system for APKs.
If this would be the case, are they self signed? Are the play store apps signed by Google in ...
3
votes
1answer
4k views
SHA-256 Timestamp not recognized in windows 7 when dual signed
I wanted to dual sign my exe so that the XP and Vista users can use the software. But when i dual sign the exe with SHA1 and SHA256 timestamps, In windows7 only 1 timestamp is shown.
To dual sign I ...
