10 ms·

It is actually clever: - generate a fake CA and use it to sign your driver on the fly; - add the generated root CA to the trusted list - delete the private k

by xgbi 9y ago

It is actually clever: - generate a fake CA and use it to sign your driver on the fly; - add the generated root CA to the trusted list - delete the private key so that nobody else can sign anything with this CA - now windows will happily consider this driver as worthy of trust and install it.

TylerE 9y ago
That sounds very un-clever (edit: I mean by Microsoft). Why couldn't malware do the exact same thing?
- slededit 9y ago
  Presumably you need to grant the installer admin privileges for it to work
- weddpros 9y ago
  Just imagine what the developer thought when his boss said "we don't want to buy an actual certificate, find something that works". And now this developer is learning on HN he should remove that line in his resumé. Or maybe he thought it was a clever idea... Let's call it a learning experience.
  - voltagex_ 9y ago
    It's a driver associated with some open source Android stuff. Driver signing certificate are $100+/year.
  - varenc 9y ago
    This seems a better and more secure solution than buying an actual certificate. If they had a single certificate and used that across devices then the private key could be compromised and used to authenticate malware or pull off a man in the middle attack on an HTTPS site since your system now trusts this new CA. By generating the private key locally and throwing it away, you can be relatively confident that no one has the private key to this new root CA. What's silly in the first place is that something not trusted to install unsigned drivers still has the perms to install a new root CA but given that constraint, this is a better solution than what Savitech did.
    - ChristianBundy 9y ago
      > If they had an actual root CA with a private key, that private key could be compromised and used to authenticate malware or pull of a man in the middle attack on an HTTPS site. If they had an actual root CA with a private key, they'd sign it locally (on the company machine). In no scenario would the company's private key be given to a customer (unless we're talking about Adobe).
      - varenc 9y ago
        Yes, that's the ideal case... But what do you want to do more? 1) Trust some company to keep a very important private key secure for a long time? (with attackers knowing it's a single high-value target) 2) Or be confident that the private key was used once and destroyed forever? Even if the private key generated on your device could be recovered it would only be good for an attack against you making it a lower priority to attackers.
        dec0dedab0de 9y ago
        Or be confident that the private key was used once and destroyed forever? Even if the private key generated on your device could be recovered it would only be good for an attack against you making it a lower priority to attackers. Doing it that way completely undermines the reason for having a cert in the first place. You might as well not have one at all.
        usrusr 9y ago
        The difference is that with the on the fly cert, you blindly trust one piece of code, at one point in time, and when it did not lie to you then you will be safe from it later. A conventional cert owner on the other hand could theoretically turn on you any time (e.g. when ownership multiplies into pwnership) once "automatic trust" for the next binary is established. I'd still prefer the latter, given reasonable standards in terms of key handling, but the one-time trust is not completely without merit. It would certainly be more reasonable though to just allow one-time blind trust without forcing the installer to create a certificate that may or may not be as private as advertised.
  - lultimouomo 9y ago
    I don't think this was done to skim in money, but to let you install a driver that binds only with your mobile USB ID. Alternatively they would need to ship hundreds of different drivers or a single driver that binds to hundreds of different device IDS. Not nice.
- tialaramex 9y ago
  It absolutely could. The alternative is that Microsoft has complete control over what software can run on any Windows PC. It turns out that people who want this ("Man. I wish I could only run programs chosen by the monopoly supplier") already have an iPad so this basically just creates a backlash. I know what you're thinking "Oh, well there could be an exception for when you need it, you'd just use admin to authorize it or something" and that's exactly what this is.
  - deleted 9y ago
    [deleted]
  - fencepost 9y ago
    > The alternative is that Microsoft has complete control over what software can run on any Windows PC. That would be the relatively little known (and new) Windows 10 S, where only apps from the Windows Store can be installed or run. Designed for security (?) and to compete with Chromebooks. See also Windows RT
    - m-p-3 9y ago
      I can see some scenarios where this would be desirable. Like my grandparents, who basically just wants to browse Facebook, etc. Since they have a Chromebox, I do not have any calls regarding viruses or their computer being slow, etc.
      - Spivak 9y ago
        But the desirability is proportional to the level of moderation of the store and Microsoft's is complete shit: it's full of not-quite-malware and not-quite-scams.
  - ubernostrum 9y ago
    It turns out that people who want this ("Man. I wish I could only run programs chosen by the monopoly supplier") Or people don't know/care. Or weighed the comparative downsides of a controlled app platform versus the wild west, and decided the controlled platform is less of a downside for what they want to do. Or lots of options, really.
- toyg 9y ago
  Driver signing is not really about malware, but rather about Microsoft trying to enforce a bit of quality control on the shit-show that was driver development by noname hardware manufacturers. If a driver is signed I can look up the owner and bash him for his crap quality code. Similarly, any manufacturer caught doing this sort of trick would be blacklisted.
- zeusk 9y ago
  Because: a) Adding a root CA to the cert store requires UAC elevation prompt. b) The certificates are more useful in verifying if a given driver was issued by the manufacturer it says it was issued from.
  - TylerE 9y ago
    Rebuttal: Users just blindly click ok so UAC doesn't actually do anything useful.
    - iancarroll 9y ago
      A better rebuttal is that UAC is not a security boundary and bypassing it is trivial.
      - dingo_bat 9y ago
        Has that been done? I have been thinking it's pretty secure!
        iancarroll 9y ago
        Yes. UAC was not really designed as a security boundary in the first place. Here are some public exploits for it: https://github.com/hfiref0x/UACME https://github.com/hfiref0x/UACME
        Dylan16807 9y ago
        It's pretty bad. Even if you put it on max, disabling automatic elevation, there are still flaws that microsoft doens't bother to fix.
    - zeusk 9y ago
      Well, the same is true of any osx pre high sierra. A malware can disguise as installer utility and it can make modifications to system or install kexts after user okays it (keychain saves the password). Linux makes you type in the password manually every time for elevation but that will just make the average consumer remove or use unsafe passwords for their accounts.
throwaway613834 9y ago
I thought that, unlike apps, drivers needed a Microsoft signature, not just any root CA's signature? Was that not the case?
- adamson 9y ago
  I don't think that was ever true (at least in the last decade)
  - throwaway613834 9y ago
    What about MCVR on this page?http://www.davidegrayson.com/signing/ http://www.davidegrayson.com/signing/
- khedoros1 9y ago
  I think that it will allow you to install the drivers, but have an extra red pop-up with a warning about unsigned drivers. To get a clean, professional-looking installation, you've got to have a primary signature that chains down to a trusted root CA and also a cross-signature, which is a Microsoft cert used to sign the code's root CA's certificate.
  - throwaway613834 9y ago
    What about MCVR on this page? It seems to be more than just for the dialog box? http://www.davidegrayson.com/signing/ http://www.davidegrayson.com/signing/
    - khedoros1 9y ago
      I'm not clear on the difference between a driver and a kernel module in the Windows world. As far as I could tell, we were talking about installing drivers, and the "Signature requirements for it to just work" seem to list just a SHA-2 cert from a trusted root CA for installing drivers, even for Windows 10. Maybe there's something I'm misunderstanding here. I've set up Windows codesigning, but it was according to the specifications of the Windows devs; most of my own work has been in Linux.
Macuyiko 9y ago
It is! If nefarius and the other ScpToolkit guys are listening (a popular toolkit for Dualshock 3 and 4 controllers on Windows, see https://github.com/nefarius/ScpToolkit https://github.com/nefarius/ScpToolkit): this might also be an appropriate way to make their self-signed drivers work again on the latest Windows 10 update.

by xgbi 9y ago

TylerE 9y ago

That sounds very un-clever (edit: I mean by Microsoft). Why couldn't malware do the exact same thing?

slededit 9y ago
Presumably you need to grant the installer admin privileges for it to work
weddpros 9y ago
Just imagine what the developer thought when his boss said "we don't want to buy an actual certificate, find something that works". And now this developer is learning on HN he should remove that line in his resumé. Or maybe he thought it was a clever idea... Let's call it a learning experience.
- voltagex_ 9y ago
  It's a driver associated with some open source Android stuff. Driver signing certificate are $100+/year.
- varenc 9y ago
  This seems a better and more secure solution than buying an actual certificate. If they had a single certificate and used that across devices then the private key could be compromised and used to authenticate malware or pull off a man in the middle attack on an HTTPS site since your system now trusts this new CA. By generating the private key locally and throwing it away, you can be relatively confident that no one has the private key to this new root CA. What's silly in the first place is that something not trusted to install unsigned drivers still has the perms to install a new root CA but given that constraint, this is a better solution than what Savitech did.
  - ChristianBundy 9y ago
    > If they had an actual root CA with a private key, that private key could be compromised and used to authenticate malware or pull of a man in the middle attack on an HTTPS site. If they had an actual root CA with a private key, they'd sign it locally (on the company machine). In no scenario would the company's private key be given to a customer (unless we're talking about Adobe).
    - varenc 9y ago
      Yes, that's the ideal case... But what do you want to do more? 1) Trust some company to keep a very important private key secure for a long time? (with attackers knowing it's a single high-value target) 2) Or be confident that the private key was used once and destroyed forever? Even if the private key generated on your device could be recovered it would only be good for an attack against you making it a lower priority to attackers.
      - dec0dedab0de 9y ago
        Or be confident that the private key was used once and destroyed forever? Even if the private key generated on your device could be recovered it would only be good for an attack against you making it a lower priority to attackers. Doing it that way completely undermines the reason for having a cert in the first place. You might as well not have one at all.
        usrusr 9y ago
        The difference is that with the on the fly cert, you blindly trust one piece of code, at one point in time, and when it did not lie to you then you will be safe from it later. A conventional cert owner on the other hand could theoretically turn on you any time (e.g. when ownership multiplies into pwnership) once "automatic trust" for the next binary is established. I'd still prefer the latter, given reasonable standards in terms of key handling, but the one-time trust is not completely without merit. It would certainly be more reasonable though to just allow one-time blind trust without forcing the installer to create a certificate that may or may not be as private as advertised.
- lultimouomo 9y ago
  I don't think this was done to skim in money, but to let you install a driver that binds only with your mobile USB ID. Alternatively they would need to ship hundreds of different drivers or a single driver that binds to hundreds of different device IDS. Not nice.
tialaramex 9y ago
It absolutely could. The alternative is that Microsoft has complete control over what software can run on any Windows PC. It turns out that people who want this ("Man. I wish I could only run programs chosen by the monopoly supplier") already have an iPad so this basically just creates a backlash. I know what you're thinking "Oh, well there could be an exception for when you need it, you'd just use admin to authorize it or something" and that's exactly what this is.
- deleted 9y ago
  [deleted]
- fencepost 9y ago
  > The alternative is that Microsoft has complete control over what software can run on any Windows PC. That would be the relatively little known (and new) Windows 10 S, where only apps from the Windows Store can be installed or run. Designed for security (?) and to compete with Chromebooks. See also Windows RT
  - m-p-3 9y ago
    I can see some scenarios where this would be desirable. Like my grandparents, who basically just wants to browse Facebook, etc. Since they have a Chromebox, I do not have any calls regarding viruses or their computer being slow, etc.
    - Spivak 9y ago
      But the desirability is proportional to the level of moderation of the store and Microsoft's is complete shit: it's full of not-quite-malware and not-quite-scams.
- ubernostrum 9y ago
  It turns out that people who want this ("Man. I wish I could only run programs chosen by the monopoly supplier") Or people don't know/care. Or weighed the comparative downsides of a controlled app platform versus the wild west, and decided the controlled platform is less of a downside for what they want to do. Or lots of options, really.
toyg 9y ago
Driver signing is not really about malware, but rather about Microsoft trying to enforce a bit of quality control on the shit-show that was driver development by noname hardware manufacturers. If a driver is signed I can look up the owner and bash him for his crap quality code. Similarly, any manufacturer caught doing this sort of trick would be blacklisted.
zeusk 9y ago
Because: a) Adding a root CA to the cert store requires UAC elevation prompt. b) The certificates are more useful in verifying if a given driver was issued by the manufacturer it says it was issued from.
- TylerE 9y ago
  Rebuttal: Users just blindly click ok so UAC doesn't actually do anything useful.
  - iancarroll 9y ago
    A better rebuttal is that UAC is not a security boundary and bypassing it is trivial.
    - dingo_bat 9y ago
      Has that been done? I have been thinking it's pretty secure!
      - iancarroll 9y ago
        Yes. UAC was not really designed as a security boundary in the first place. Here are some public exploits for it: https://github.com/hfiref0x/UACME https://github.com/hfiref0x/UACME
      - Dylan16807 9y ago
        It's pretty bad. Even if you put it on max, disabling automatic elevation, there are still flaws that microsoft doens't bother to fix.
  - zeusk 9y ago
    Well, the same is true of any osx pre high sierra. A malware can disguise as installer utility and it can make modifications to system or install kexts after user okays it (keychain saves the password). Linux makes you type in the password manually every time for elevation but that will just make the average consumer remove or use unsafe passwords for their accounts.

throwaway613834 9y ago

I thought that, unlike apps, drivers needed a Microsoft signature, not just any root CA's signature? Was that not the case?

adamson 9y ago
I don't think that was ever true (at least in the last decade)
- throwaway613834 9y ago
  What about MCVR on this page?http://www.davidegrayson.com/signing/ http://www.davidegrayson.com/signing/
khedoros1 9y ago
I think that it will allow you to install the drivers, but have an extra red pop-up with a warning about unsigned drivers. To get a clean, professional-looking installation, you've got to have a primary signature that chains down to a trusted root CA and also a cross-signature, which is a Microsoft cert used to sign the code's root CA's certificate.
- throwaway613834 9y ago
  What about MCVR on this page? It seems to be more than just for the dialog box? http://www.davidegrayson.com/signing/ http://www.davidegrayson.com/signing/
  - khedoros1 9y ago
    I'm not clear on the difference between a driver and a kernel module in the Windows world. As far as I could tell, we were talking about installing drivers, and the "Signature requirements for it to just work" seem to list just a SHA-2 cert from a trusted root CA for installing drivers, even for Windows 10. Maybe there's something I'm misunderstanding here. I've set up Windows codesigning, but it was according to the specifications of the Windows devs; most of my own work has been in Linux.

Macuyiko 9y ago

It is! If nefarius and the other ScpToolkit guys are listening (a popular toolkit for Dualshock 3 and 4 controllers on Windows, see https://github.com/nefarius/ScpToolkit https://github.com/nefarius/ScpToolkit): this might also be an appropriate way to make their self-signed drivers work again on the latest Windows 10 update.