4 ms·

But it's still possible to install a custom root cert? That's madness.

by vesinisa 9y ago

thomastjeffery 9y ago
Yes it is.
Aloha 9y ago
Being unable to install a custom root cert would break a bunch of shit.
- throwaway613834 9y ago
  I'm not sure it's correct that custom root certs are allowed for drivers. I asked this in another comment.
  - NateyJay 9y ago
    I think kernel mode drivers have more stringent signing requirements than user mode drivers. A user-installed CA definitely cannot be used to silently install a kernel mode driver.
    - throwaway613834 9y ago
      Oh. When you say driver do you mean user-mode? I always assume kernel mode (in every OS). But if so that would make sense!
      - lultimouomo 9y ago
        You need to install a user mode drive to leverage already existing kernel code with your device. I assume this is what ADB does, using the Microsoft provided WinUSB kernel mode driver and associating it with your mobile phone USB vendor and product ID. There's not a single line of code in such a driver, just some INF descriptors. There might also be different forms of user mode driver, not sure how they work.
        throwaway613834 9y ago
        > You need to install a user mode drive to leverage already existing kernel code with your device. You mean a user-mode application? A user-mode driver is something you write instead of a kernel-mode driver (when it's possible), not on top of it. (?)
        therein 9y ago
        Windows has User-Mode Driver Framework and Kernel-Mode Driver Framework where UMDF exposes only a part of the kernel API. KMDF drivers have to be signed with a CA that's not user installed while UMDF drivers may be.
        throwaway613834 9y ago
        I'm already aware of this and I don't understand how this answers the question in the comment you replied to. Maybe you meant to reply to a different comment?
        NateyJay 9y ago
        Yes, a user-mode driver is something you would write instead of a kernel mode driver, if you can. Kernel-mode code is the most powerful, but also poses the greatest security and stability threat to the computer, so Microsoft locks it down the hardest. If you don't need the extra power, you can write a use-mode driver that uses Microsoft-provided kernel components (Like Winusb.sys) and you don't have to go through the same security procedures.
    - GordonS 9y ago
      Yes, I think they also have to be counter signed by Microsoft.
adamson 9y ago
Yeah but who would try to use commercial hardware as an attack vector?
- deleted 9y ago
  [deleted]
- dbcurtis 9y ago
  You forgot the /sarc tag. Or maybe forgot all the digital picture frames that hosted viruses.
benatkin 9y ago
It should be possible, but be like Chrome Extensions where there's an entirely different flow to install a non-WebStore extension. Though perhaps Chrome's doesn't provide enough warning...
b3lvedere 9y ago
It can have its small benefits to install custom (non-root) certs in Windows 10 to support old hardware, Thanks to the folks at http://leshcatlabs.net/unifl-unified-leshcat-drivers/ http://leshcatlabs.net/unifl-unified-leshcat-drivers/ i can put Windows 10 on old laptops with 'unsupported' old AMD and/or Intel gpu's. When i was modifying my HTPC from Windows 8 to 10 i also experienced that annoying protection. I used the Cmedia BitPerfect drivers on my Windows 8 machine (https://code.google.com/archive/p/cmediadrivers/wikis/Bitperfect.wiki https://code.google.com/archive/p/cmediadrivers/wikis/Bitper...) to have almost perfect DTS throughput, but couldn't use these on Windows 10 because not signed. The Leshcat people kindly provided me with a signed version.

But it's still possible to install a custom root cert? That's madness.

thomastjeffery 9y ago

Yes it is.

Aloha 9y ago

Being unable to install a custom root cert would break a bunch of shit.

throwaway613834 9y ago
I'm not sure it's correct that custom root certs are allowed for drivers. I asked this in another comment.
- NateyJay 9y ago
  I think kernel mode drivers have more stringent signing requirements than user mode drivers. A user-installed CA definitely cannot be used to silently install a kernel mode driver.
  - throwaway613834 9y ago
    Oh. When you say driver do you mean user-mode? I always assume kernel mode (in every OS). But if so that would make sense!
    - lultimouomo 9y ago
      You need to install a user mode drive to leverage already existing kernel code with your device. I assume this is what ADB does, using the Microsoft provided WinUSB kernel mode driver and associating it with your mobile phone USB vendor and product ID. There's not a single line of code in such a driver, just some INF descriptors. There might also be different forms of user mode driver, not sure how they work.
      - throwaway613834 9y ago
        > You need to install a user mode drive to leverage already existing kernel code with your device. You mean a user-mode application? A user-mode driver is something you write instead of a kernel-mode driver (when it's possible), not on top of it. (?)
        therein 9y ago
        Windows has User-Mode Driver Framework and Kernel-Mode Driver Framework where UMDF exposes only a part of the kernel API. KMDF drivers have to be signed with a CA that's not user installed while UMDF drivers may be.
        throwaway613834 9y ago
        I'm already aware of this and I don't understand how this answers the question in the comment you replied to. Maybe you meant to reply to a different comment?
        NateyJay 9y ago
        Yes, a user-mode driver is something you would write instead of a kernel mode driver, if you can. Kernel-mode code is the most powerful, but also poses the greatest security and stability threat to the computer, so Microsoft locks it down the hardest. If you don't need the extra power, you can write a use-mode driver that uses Microsoft-provided kernel components (Like Winusb.sys) and you don't have to go through the same security procedures.
  - GordonS 9y ago
    Yes, I think they also have to be counter signed by Microsoft.

adamson 9y ago

Yeah but who would try to use commercial hardware as an attack vector?

deleted 9y ago
[deleted]
dbcurtis 9y ago
You forgot the /sarc tag. Or maybe forgot all the digital picture frames that hosted viruses.

benatkin 9y ago

It should be possible, but be like Chrome Extensions where there's an entirely different flow to install a non-WebStore extension. Though perhaps Chrome's doesn't provide enough warning...

b3lvedere 9y ago

It can have its small benefits to install custom (non-root) certs in Windows 10 to support old hardware, Thanks to the folks at http://leshcatlabs.net/unifl-unified-leshcat-drivers/ http://leshcatlabs.net/unifl-unified-leshcat-drivers/ i can put Windows 10 on old laptops with 'unsupported' old AMD and/or Intel gpu's. When i was modifying my HTPC from Windows 8 to 10 i also experienced that annoying protection. I used the Cmedia BitPerfect drivers on my Windows 8 machine (https://code.google.com/archive/p/cmediadrivers/wikis/Bitperfect.wiki https://code.google.com/archive/p/cmediadrivers/wikis/Bitper...) to have almost perfect DTS throughput, but couldn't use these on Windows 10 because not signed. The Leshcat people kindly provided me with a signed version.