5 ms·
At least the binaries are authenticode signed now, so checking they are legit is just a right click away.
by r1ch 10y ago
At least the binaries are authenticode signed now, so checking they are legit is just a right click away.
- anderskaseorg 10y agoHow is that supposed to help? Even if the legitimate binaries are Authenticode-signed now, a malicious non-Authenticode-signed binary substituted by an attacker MITMing the insecure HTTP connection will appear to the downloader to look just like the legitimate non-Authenticode-signed binaries of previous versions that they’ve been downloading for years.
- Godel_unicode 10y agoBecause you can add the signing cert to your AppLocker whitelist, and now it will be checked every time it runs. Then you push that out by GPO, and now everyone has that same whitelist protection. Also, as mentioned other places on the thread, the downloads are over HTTPS. Edit: see the following https://technet.microsoft.com/en-us/library/dd723683(v=ws.10).aspx https://technet.microsoft.com/en-us/library/dd723683(v=ws.10...
- morecoffee 10y agoRight clicking is one click too many. Wouldn't it be better to get the binary securely in the first place?