8 ms·
The "Universal ADB Driver" for Android devices[1] also installs a root CA, however it instead generates the CA during install, signs the driver, deletes the pri
by ryan-c 9y ago
The "Universal ADB Driver" for Android devices[1] also installs a root CA, however it instead generates the CA during install, signs the driver, deletes the private key, then installs the CA and driver.
1. https://github.com/koush/UniversalAdbDriver https://github.com/koush/UniversalAdbDriver
- hamandcheese 9y agoWhat good is a root CA with no key?
- xgbi 9y agoIt is actually clever: - generate a fake CA and use it to sign your driver on the fly; - add the generated root CA to the trusted list - delete the private key so that nobody else can sign anything with this CA - now windows will happily consider this driver as worthy of trust and install it.
- TylerE 9y agoThat sounds very un-clever (edit: I mean by Microsoft). Why couldn't malware do the exact same thing?
- slededit 9y agoPresumably you need to grant the installer admin privileges for it to work
- weddpros 9y agoJust imagine what the developer thought when his boss said "we don't want to buy an actual certificate, find something that works". And now this developer is learning on HN he should remove that line in his resumé. Or maybe he thought it was a clever idea... Let's call it a learning experience.
- voltagex_ 9y agoIt's a driver associated with some open source Android stuff. Driver signing certificate are $100+/year.
- varenc 9y agoThis seems a better and more secure solution than buying an actual certificate. If they had a single certificate and used that across devices then the private key could be compromised and used to authenticate malware or pull off a man in the middle attack on an HTTPS site since your system now trusts this new CA. By generating the private key locally and throwing it away, you can be relatively confident that no one has the private key to this new root CA. What's silly in the first place is that something not trusted to install unsigned drivers still has the perms to install a new root CA but given that constraint, this is a better solution than what Savitech did.
- ChristianBundy 9y ago> If they had an actual root CA with a private key, that private key could be compromised and used to authenticate malware or pull of a man in the middle attack on an HTTPS site. If they had an actual root CA with a private key, they'd sign it locally (on the company machine). In no scenario would the company's private key be given to a customer (unless we're talking about Adobe).
- varenc 9y agoYes, that's the ideal case... But what do you want to do more? 1) Trust some company to keep a very important private key secure for a long time? (with attackers knowing it's a single high-value target) 2) Or be confident that the private key was used once and destroyed forever? Even if the private key generated on your device could be recovered it would only be good for an attack against you making it a lower priority to attackers.
- dec0dedab0de 9y agoOr be confident that the private key was used once and destroyed forever? Even if the private key generated on your device could be recovered it would only be good for an attack against you making it a lower priority to attackers. Doing it that way completely undermines the reason for having a cert in the first place. You might as well not have one at all.
- tialaramex 9y agoIt absolutely could. The alternative is that Microsoft has complete control over what software can run on any Windows PC. It turns out that people who want this ("Man. I wish I could only run programs chosen by the monopoly supplier") already have an iPad so this basically just creates a backlash. I know what you're thinking "Oh, well there could be an exception for when you need it, you'd just use admin to authorize it or something" and that's exactly what this is.
- deleted 9y ago[deleted]
- fencepost 9y ago> The alternative is that Microsoft has complete control over what software can run on any Windows PC. That would be the relatively little known (and new) Windows 10 S, where only apps from the Windows Store can be installed or run. Designed for security (?) and to compete with Chromebooks. See also Windows RT
- m-p-3 9y agoI can see some scenarios where this would be desirable. Like my grandparents, who basically just wants to browse Facebook, etc. Since they have a Chromebox, I do not have any calls regarding viruses or their computer being slow, etc.
- Spivak 9y agoBut the desirability is proportional to the level of moderation of the store and Microsoft's is complete shit: it's full of not-quite-malware and not-quite-scams.
- ubernostrum 9y agoIt turns out that people who want this ("Man. I wish I could only run programs chosen by the monopoly supplier") Or people don't know/care. Or weighed the comparative downsides of a controlled app platform versus the wild west, and decided the controlled platform is less of a downside for what they want to do. Or lots of options, really.
- toyg 9y agoDriver signing is not really about malware, but rather about Microsoft trying to enforce a bit of quality control on the shit-show that was driver development by noname hardware manufacturers. If a driver is signed I can look up the owner and bash him for his crap quality code. Similarly, any manufacturer caught doing this sort of trick would be blacklisted.
- zeusk 9y agoBecause: a) Adding a root CA to the cert store requires UAC elevation prompt. b) The certificates are more useful in verifying if a given driver was issued by the manufacturer it says it was issued from.
- TylerE 9y agoRebuttal: Users just blindly click ok so UAC doesn't actually do anything useful.
- iancarroll 9y agoA better rebuttal is that UAC is not a security boundary and bypassing it is trivial.
- dingo_bat 9y agoHas that been done? I have been thinking it's pretty secure!
- iancarroll 9y agoYes. UAC was not really designed as a security boundary in the first place. Here are some public exploits for it: https://github.com/hfiref0x/UACME https://github.com/hfiref0x/UACME
- Dylan16807 9y agoIt's pretty bad. Even if you put it on max, disabling automatic elevation, there are still flaws that microsoft doens't bother to fix.
- zeusk 9y agoWell, the same is true of any osx pre high sierra. A malware can disguise as installer utility and it can make modifications to system or install kexts after user okays it (keychain saves the password). Linux makes you type in the password manually every time for elevation but that will just make the average consumer remove or use unsafe passwords for their accounts.
- throwaway613834 9y agoI thought that, unlike apps, drivers needed a Microsoft signature, not just any root CA's signature? Was that not the case?
- adamson 9y agoI don't think that was ever true (at least in the last decade)
- throwaway613834 9y agoWhat about MCVR on this page?http://www.davidegrayson.com/signing/ http://www.davidegrayson.com/signing/
- khedoros1 9y agoI think that it will allow you to install the drivers, but have an extra red pop-up with a warning about unsigned drivers. To get a clean, professional-looking installation, you've got to have a primary signature that chains down to a trusted root CA and also a cross-signature, which is a Microsoft cert used to sign the code's root CA's certificate.
- throwaway613834 9y agoWhat about MCVR on this page? It seems to be more than just for the dialog box? http://www.davidegrayson.com/signing/ http://www.davidegrayson.com/signing/
- khedoros1 9y agoI'm not clear on the difference between a driver and a kernel module in the Windows world. As far as I could tell, we were talking about installing drivers, and the "Signature requirements for it to just work" seem to list just a SHA-2 cert from a trusted root CA for installing drivers, even for Windows 10. Maybe there's something I'm misunderstanding here. I've set up Windows codesigning, but it was according to the specifications of the Windows devs; most of my own work has been in Linux.
- Macuyiko 9y agoIt is! If nefarius and the other ScpToolkit guys are listening (a popular toolkit for Dualshock 3 and 4 controllers on Windows, see https://github.com/nefarius/ScpToolkit https://github.com/nefarius/ScpToolkit): this might also be an appropriate way to make their self-signed drivers work again on the latest Windows 10 update.
- colanderman 9y agoOnly good for verification of what's been signed with it before the key was deleted, which is exactly what's needed.
- vesinisa 9y agoInteresting ... why is such setup needed then?
- user5994461 9y agoIt's not possible to install drivers that are not signed, on Windows.
- vesinisa 9y agoBut it's still possible to install a custom root cert? That's madness.
- thomastjeffery 9y agoYes it is.
- Aloha 9y agoBeing unable to install a custom root cert would break a bunch of shit.
- throwaway613834 9y agoI'm not sure it's correct that custom root certs are allowed for drivers. I asked this in another comment.
- NateyJay 9y agoI think kernel mode drivers have more stringent signing requirements than user mode drivers. A user-installed CA definitely cannot be used to silently install a kernel mode driver.
- throwaway613834 9y agoOh. When you say driver do you mean user-mode? I always assume kernel mode (in every OS). But if so that would make sense!