Questions tagged [code-signing]
Code Signing is the process of putting a signature on executables and patches to prove it is genuine, and to prevent attackers from injecting malicious code into end-user's systems.
26
questions
32
votes
2
answers
24k
views
Smart-Screen filter still complains, despite I signed the executable, why?
First and foremost, this is my very first experience with Code Signing.
I bought Standard Code Signing from Certum for 3 years.
I intend to publish applications in Czech republic mostly.
But to the ...
- 1,624
20
votes
4
answers
8k
views
Transferring Microsoft SmartScreen reputation to renewed certificate
I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning:
Windows Defender SmartScreen prevented an unrecognized app from starting
The ...
- 493
23
votes
9
answers
29k
views
Deprecation of SHA1 code signing certificates on Windows
EDIT (7/7/2016) - see addition at the end of post
I have been keenly following the issues with regards to Microsoft deprecating the use of SHA1 code-signing certificates for Windows executables (http:...
- 331
7
votes
1
answer
1k
views
How can a .exe be modified and still keep a valid digital signature?
When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true.
...
- 91
0
votes
1
answer
464
views
If a file is digitally signed, is posting a hash very useful for security purposes?
In this question I asked about how to handle situations when SHA-256 hashes are not available for a file downloaded from the internet that contains executable code. Another community member ...
49
votes
2
answers
12k
views
Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?
This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab
What is going on here?
- 1,658
15
votes
2
answers
2k
views
How do large companies protect their private (code-signing) keys?
Some time ago I read the canonical answer of our ursine overlord concerning CAs and their private (root) keys.
More recently I stumbled across the question on the question on how to manage code ...
- 9,580
11
votes
1
answer
2k
views
Should I sign someone else's code?
I'm working on a product that includes 3rd party drivers for some of the product's hardware. Some of the drivers are not signed, others are only signed with sha1 certificates.
Given that getting new, ...
- 213
11
votes
1
answer
399
views
Did D-Link's certificate revocation really only invalidate 1 day (of a six months long exposure)?
I'm trying to wrap my head around the OCSP revocationTime for D-Link's certificate.
I recently answered another question and ended up drafting a timeline.
That timeline is basically this:
Jul 5 00:00:...
- 17.9k
11
votes
2
answers
906
views
Centralized key management for IOS and Android Code Signing
What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines.
I see systems like ...
- 111
11
votes
1
answer
4k
views
Has the leaked D-Link Windows signing key been revoked?
Recently news broke as to D-Link mistakenly publishing a private code-signing key as part of an open source framework:
The D-Link key was leaked in late February, and expired on September 3, it ...
10
votes
2
answers
6k
views
Does linux support signed binaries?
I am looking for something similar to what iOS supports. Does it exist in linux?
With a secure boot (based in hardware chain of trust), doesn't it make sense to have signed binaries for security? ...
- 893
10
votes
2
answers
3k
views
How do systems protect against a stolen code-signing certificate after the certificate expires?
Imagine this scenario:
1st December 2014 - a certificate is stolen and used to sign malware with 2014-12-01 timestamp.
15th December 2014 - the certificate is revoked. Malware will be prevented from ...
- 103
7
votes
1
answer
3k
views
gpg key size of 4096 and "the future is ECC"
My boss wants to sign our binary. I need to tell him how he can create the signing key.
Most if not all sites I have seen about signing binaries say "use gpg".
OK, so gpg per default has 2048. Their ...
- 447
6
votes
1
answer
12k
views
How to check executable code signing signatures?
How can I see all code signing signatures an executable has?
I know that requests for a tool are usually considered as opinion based, but I really can't find one and I don't expect many answers.
...
- 3,376
5
votes
1
answer
3k
views
Does Authenticode still work offline and with a "fake" certificate
Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a ...
- 153
5
votes
1
answer
945
views
What Are Good Code Signing Environment Guidelines? [closed]
Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
- 1,241
5
votes
2
answers
2k
views
Code signing with MD5 on Windows 8
I discovered that a signed installer package that is reported as correctly signed on Windows 7 and earlier, is reported as "corrupt" in IE10 on Windows 8.
Further investigation showed that the ...
- 397
4
votes
1
answer
313
views
How to validate client side safety in a Zero Knowlegde model
What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
- 1,348
4
votes
1
answer
588
views
Cross-certification between worlds like X.509 and PGP?
Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert ...
- 371
3
votes
3
answers
1k
views
Can I use a code signing certificate as a TLS certificate?
For example, I develop a software which is used by some customers. They sign the software using their code signing certificates. The software has a client and a server part which are connected to each ...
- 143
3
votes
1
answer
3k
views
Is there any way to discover why Windows Smartscreen is flagging your download?
Since Windows Smartscreen is now marking downloaded files signed with SHA1 post 1/1/16 as potentially unsafe, we have had to get a new code-signing cert. With it being a new cert, it has no '...
- 31
3
votes
1
answer
646
views
Application Whitelisting Approaches/Options on non-Enterprise Windows PCs
For a while now I've been kicking around the idea of implementing application whitelisting on a few sets of machines (owned by 2-3 different consulting clients) I administer that seem suitable for it. ...
- 2,715
2
votes
1
answer
475
views
Alert when unsigned code is run?
I know Windows 10 has a lockdown option, to forbid running unsigned code. But in my organization, I'd get shot if I tried to do that. So I'd like the next best thing: a remote alert whenever unsigned ...
- 127
2
votes
1
answer
1k
views
Can I use the same ssl cert to protect my web site and sign my app?
I'm considering buying an SSL cert from my web host provider (smarterasp.net)
They list the cert as :
SSL-S Comodo SSL Certificate - Single Domain or Subdomain
Do you know if I can use that ...
- 123
1
vote
1
answer
2k
views
How to update certificates/CRL on Windows 7 systems that are without support contracts?
A quality answer to this question mentions:
"System is regularly updated with latest patch specifically certificate/CRL from trusted source such as Microsoft."
How does one update ...