9 ms·

This is not how Windows code signing is supposed to work. Normally you'd get a countersignature from a timestamp server so that the verification process can pro

by r1ch 9y ago

This is not how Windows code signing is supposed to work. Normally you'd get a countersignature from a timestamp server so that the verification process can prove that the certificate was valid at the time of signing. It would appear that Oculus signed their binaries without using a timestamp server, so without a way to verify when signing happened they become invalid as soon as the cert expires.

lopmotr 9y ago
Something like that. Certificates aren't supposed to stop working just because they've expired! That would destroy all abandoned or poorly maintained software within a couple of years. This problem is deeper than forgetting to update it. It should never have caused a failure in the first place. Just the fact that the device apparently can't function at all without the internet is a problem too.
- technofiend 9y ago
  >Just the fact that the device apparently can't function at all without the internet is a problem too. Isn't Oculus owned by Facebook? Of course it has internet-based mandatory data collection, er uh excuse me, license something something.
  - cheeko1234 9y ago
    FYI, the Oculus does work without internet.
    - plussed_reader 9y ago
      So does Steam, but the metrics filter back to the mothership eventually.
      - josefx 9y ago
        Currently trying to work with the HTC Vive on Linux. Which means I need SteamVR installed, which you only get from Steam. Steam of course nukes a perfectly fine installation with updates the moment you start it, so you need a Linux with just the right versions of packages used by steam. Maybe I should have just given up the day Oculus dropped Linux support.
- makmanalp 9y ago
  For the ignorant among us, what would expiration do then?
  - bdhess 9y ago
    Prevent signatures made after the expiration date from being accepted.
  - IncRnd 9y ago
    It's not an expiration on the signed executable but an expiration on the ability of the certificate to sign an executable.
    - josteink 9y ago
      This is the exact right answer. And for this to work at all, the signature needs a timestamp so that the OS can know that the certificate was valid at the time of signing. But for some reason (signtool.exe, etc) makes it really hard to get this done properly. This is especially true in a CI-setting, where this is one of those areas where signing and timestamping essentially makes a reliably and deterministic process (compiling code) into a unreliable and non-deterministic process, because builds can now fail randomly based on the state of a online timestamping service. Getting this done properly is a lot more work than you at first would think. I can see why lots of developers shy away from learning about this, even more so implementing it, when they can spend their time delivering value... And new builds which won't expire for another 2 years.
      - ryanlol 9y ago
        >This is especially true in a CI-setting, where this is one of those areas where signing and timestamping essentially makes a reliably and deterministic process (compiling code) into a unreliable and non-deterministic process, because builds can now fail randomly based on the state of a online timestamping service. Why are you signing your drivers during development? If not, how is the "unreliability" of timestamping services an issue? You probably can't push your stuff to prod without timestamps anyway.
- KMag 9y ago
  Well, either it shouldn't have stopped working, or it never should have worked in the first place. It's arguable that no signed software should run without the code signature being timestamped/signed by a trusted timestamp server. Otherwise, simple developer laziness causes 99% of software to stop running a couple years after being published. On the other hand, maybe this is really a lazy feature. It's probably a good idea for the system to disallow both incoming and outgoing network traffic to any program written in a non-memory-safe language that hasn't been signed in the past couple of years. The lazy version of this feature is just not to run any program not signed in the past couple of years. Edit: Requiring a timestamped signature on the signature also makes it pretty easy to add auditing functionality to the timestamp server whereby the publisher can detect unauthorized signatures due to their private key being leaked/stolen by criminals or governments. If the timestamp server's logs show a signature by your key that you don't recognize, then something has gone wrong. On the attacker's side, they need to either steal the timestamp server's private key or publish their malicious signatures for scrutiny.
  - Piskvorrr 9y ago
    Wonderful, let's just autokill all abandoned software out of laziness. I can think of multiple programs that I use which haven't been updated in years, sometimes because there is nobody to develop them (project was cancelled/company ceased to exist/sole developer got fed up and quit/whatever). What are my options? Get a crappier but new alternative, or nothing - just because someone thinks "old == bad" (Meanwhile, new and drool-proof programs tend to exhibit the same bugs of old, despite having been sprinkled with magic memory-safe dust and blessed by current signature)
    - nikanj 9y ago
      My browser refuses to connect to a large number of websites, because they're still following the SSL best practices from last week. Apparently this is the reality we've decided to live in.
      - djpr 9y ago
        Firefox and Chrome give me that warning page, but I just click on "Advanced" and it will let me continue to the website. At least for me, it's just a huge warning to be careful but I still have ultimate control.
- Ajedi32 9y ago
  > Certificates aren't supposed to stop working just because they've expired! Except TLS certs. That's the whole point of those certs having an expiration date in the first place.
  - paulddraper 9y ago
    And of course, those are meant to operate in this crazy interconnected madness.
  - wtallis 9y ago
    TLS certificate expiration tells your browser to stop downloading new pages from that site. It doesn't tell your browser to close the page that's already been rendered and is still on-screen.
    - wolco 9y ago
      But you are making new requests to the Oculus api and that part is failing. You wouldn't expect the ajax requests to continue to work just because you left your browser open for years.
      - wtallis 9y ago
        > But you are making new requests to the Oculus api and that part is failing. Cloud-based APIs aren't the only thing that's broken. Locally-installed code is being prevented from running.
      - zaarn 9y ago
        It's more like you had your browser tab open, the certificate expired and now the page is completely and totally unresponsive and the browser has killed all javascript running on it. It also won't let you refresh the page or close it since the certificate is expired.
- eksemplar 9y ago
  > Certificates aren't supposed to stop working just because they've expired! That’s exactly how they are supposed to work. In the public sector we rely heavily on certificates for inter sector communication for instance, if certificates kept working despite being invalid it would put security at risk. You’re supposed to build your software with an enterprise certificate store in mind though, meaning you can auto renew and distribute certicates when needed. I really don’t see the point of adding a certificate to your television though, even if it is a tv that you wear on your head.
  - JohnTHaller 9y ago
    Code signing certificates are different from website certificates. When you use a code signing certificate - when doing it right, anyway - you also loop in a timestamp server. That way, you're signing it with your currently valid certificate and a third party is proving it was signed at a time the certificate is valid. This is so that when your code signing certificate expires in a few months, the binary you signed while the certificate was valid can still be used. Without timestamp servers, you couldn't now go back and install an older version of Firefox, for instance, because the certificate it was signed with last year is now expired.
    - nikanj 9y ago
      I guess they see that as a feature. Maybe the old version of Firefox wasn't as anal with DRM as the current version is.
    - Angostura 9y ago
      What makes you think this was a code-signing certificate? The fact that the error involves the inability to reach a server suggests strongly that it was a TLS cert or somesuch
      - JohnTHaller 9y ago
        The parent of the comment I replied to was talking about a timestamp server. I was explaining what that meant and why it was using it. I don't know what the actual issue is with the Oculus' handling of certificates and whether it was a code signing certificate or not.
- pc86 9y ago
  > That would destroy all abandoned or poorly maintained software within a couple of years. Some might call this a feature.
Someone1234 9y ago
If anyone is interested in this topic this article goes into more detail: https://msdn.microsoft.com/en-us/library/windows/desktop/bb931395%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396 https://msdn.microsoft.com/en-us/library/windows/desktop/bb9...
- iffycan 9y ago
  Is there a macOS equivalent?
  - pudquick 9y ago
    Look at --timestamp in codesign here: https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/codesign.1.html https://developer.apple.com/legacy/library/documentation/Dar... By default, this is currently enabled, as noted here: https://stackoverflow.com/questions/11712322/error-the-timestamp-service-is-not-available-when-using-codesign-on-mac-os-x https://stackoverflow.com/questions/11712322/error-the-times... You have to go out of your way when signing an app on macOS to disable timestamping in current OS versions.
jasonlotito 9y ago
Apparently this was changed in a recent update (1.22 to 1.23 iirc). In 1.22, it would have been fine.
midnitewarrior 9y ago
Can you just change the clock on your PC to get it to work again?
- r1ch 9y ago
  Yes, several users are already doing this as a workaround.
- Piskvorrr 9y ago
  This has unrelated but equally nasty side effects, though.
51Cards 9y ago
According to one thing I read (which I will admit was third party comments) there was a countersignature present up until version 1.22 and then in 1.23 it disappeared. I am not familiar with Oculus' binaries though so I don't know how far back that would be.
zzbzq 9y ago
I don't see enough info in the article to conclude what happened. But I have a hypothesis. I bet they use certificate pinning. Process A launches process B and checks against a pinned certificate. This is even more secure than just using the windows code signing stuff. Problem is, when their cert expired, they were supposed to renew the same cert. Instead, somebody got a new one and signed the build of process B. The device automatically downloads process B, but then the certificate pin check fails when it tries to launch it. All the security guides that tell you to do certificate pinning need flashing neon signs explaining this problem. You can't pin certs if you intend to ever change certs.
dockd 9y ago
The Windows signature tool, signtool.exe, makes the timestamp an optional parameter. There are no warnings if you don't supply it. I'd suggest this is a poor design--do most signatures not want the timestamp by default?
- braderhart 9y ago
  No problems on Linux... problem solved and it is open source and auditable.

by r1ch 9y ago

lopmotr 9y ago

Something like that. Certificates aren't supposed to stop working just because they've expired! That would destroy all abandoned or poorly maintained software within a couple of years. This problem is deeper than forgetting to update it. It should never have caused a failure in the first place. Just the fact that the device apparently can't function at all without the internet is a problem too.

technofiend 9y ago
>Just the fact that the device apparently can't function at all without the internet is a problem too. Isn't Oculus owned by Facebook? Of course it has internet-based mandatory data collection, er uh excuse me, license something something.
- cheeko1234 9y ago
  FYI, the Oculus does work without internet.
  - plussed_reader 9y ago
    So does Steam, but the metrics filter back to the mothership eventually.
    - josefx 9y ago
      Currently trying to work with the HTC Vive on Linux. Which means I need SteamVR installed, which you only get from Steam. Steam of course nukes a perfectly fine installation with updates the moment you start it, so you need a Linux with just the right versions of packages used by steam. Maybe I should have just given up the day Oculus dropped Linux support.
makmanalp 9y ago
For the ignorant among us, what would expiration do then?
- bdhess 9y ago
  Prevent signatures made after the expiration date from being accepted.
- IncRnd 9y ago
  It's not an expiration on the signed executable but an expiration on the ability of the certificate to sign an executable.
  - josteink 9y ago
    This is the exact right answer. And for this to work at all, the signature needs a timestamp so that the OS can know that the certificate was valid at the time of signing. But for some reason (signtool.exe, etc) makes it really hard to get this done properly. This is especially true in a CI-setting, where this is one of those areas where signing and timestamping essentially makes a reliably and deterministic process (compiling code) into a unreliable and non-deterministic process, because builds can now fail randomly based on the state of a online timestamping service. Getting this done properly is a lot more work than you at first would think. I can see why lots of developers shy away from learning about this, even more so implementing it, when they can spend their time delivering value... And new builds which won't expire for another 2 years.
    - ryanlol 9y ago
      >This is especially true in a CI-setting, where this is one of those areas where signing and timestamping essentially makes a reliably and deterministic process (compiling code) into a unreliable and non-deterministic process, because builds can now fail randomly based on the state of a online timestamping service. Why are you signing your drivers during development? If not, how is the "unreliability" of timestamping services an issue? You probably can't push your stuff to prod without timestamps anyway.
KMag 9y ago
Well, either it shouldn't have stopped working, or it never should have worked in the first place. It's arguable that no signed software should run without the code signature being timestamped/signed by a trusted timestamp server. Otherwise, simple developer laziness causes 99% of software to stop running a couple years after being published. On the other hand, maybe this is really a lazy feature. It's probably a good idea for the system to disallow both incoming and outgoing network traffic to any program written in a non-memory-safe language that hasn't been signed in the past couple of years. The lazy version of this feature is just not to run any program not signed in the past couple of years. Edit: Requiring a timestamped signature on the signature also makes it pretty easy to add auditing functionality to the timestamp server whereby the publisher can detect unauthorized signatures due to their private key being leaked/stolen by criminals or governments. If the timestamp server's logs show a signature by your key that you don't recognize, then something has gone wrong. On the attacker's side, they need to either steal the timestamp server's private key or publish their malicious signatures for scrutiny.
- Piskvorrr 9y ago
  Wonderful, let's just autokill all abandoned software out of laziness. I can think of multiple programs that I use which haven't been updated in years, sometimes because there is nobody to develop them (project was cancelled/company ceased to exist/sole developer got fed up and quit/whatever). What are my options? Get a crappier but new alternative, or nothing - just because someone thinks "old == bad" (Meanwhile, new and drool-proof programs tend to exhibit the same bugs of old, despite having been sprinkled with magic memory-safe dust and blessed by current signature)
  - nikanj 9y ago
    My browser refuses to connect to a large number of websites, because they're still following the SSL best practices from last week. Apparently this is the reality we've decided to live in.
    - djpr 9y ago
      Firefox and Chrome give me that warning page, but I just click on "Advanced" and it will let me continue to the website. At least for me, it's just a huge warning to be careful but I still have ultimate control.
Ajedi32 9y ago
> Certificates aren't supposed to stop working just because they've expired! Except TLS certs. That's the whole point of those certs having an expiration date in the first place.
- paulddraper 9y ago
  And of course, those are meant to operate in this crazy interconnected madness.
- wtallis 9y ago
  TLS certificate expiration tells your browser to stop downloading new pages from that site. It doesn't tell your browser to close the page that's already been rendered and is still on-screen.
  - wolco 9y ago
    But you are making new requests to the Oculus api and that part is failing. You wouldn't expect the ajax requests to continue to work just because you left your browser open for years.
    - wtallis 9y ago
      > But you are making new requests to the Oculus api and that part is failing. Cloud-based APIs aren't the only thing that's broken. Locally-installed code is being prevented from running.
    - zaarn 9y ago
      It's more like you had your browser tab open, the certificate expired and now the page is completely and totally unresponsive and the browser has killed all javascript running on it. It also won't let you refresh the page or close it since the certificate is expired.
eksemplar 9y ago
> Certificates aren't supposed to stop working just because they've expired! That’s exactly how they are supposed to work. In the public sector we rely heavily on certificates for inter sector communication for instance, if certificates kept working despite being invalid it would put security at risk. You’re supposed to build your software with an enterprise certificate store in mind though, meaning you can auto renew and distribute certicates when needed. I really don’t see the point of adding a certificate to your television though, even if it is a tv that you wear on your head.
- JohnTHaller 9y ago
  Code signing certificates are different from website certificates. When you use a code signing certificate - when doing it right, anyway - you also loop in a timestamp server. That way, you're signing it with your currently valid certificate and a third party is proving it was signed at a time the certificate is valid. This is so that when your code signing certificate expires in a few months, the binary you signed while the certificate was valid can still be used. Without timestamp servers, you couldn't now go back and install an older version of Firefox, for instance, because the certificate it was signed with last year is now expired.
  - nikanj 9y ago
    I guess they see that as a feature. Maybe the old version of Firefox wasn't as anal with DRM as the current version is.
  - Angostura 9y ago
    What makes you think this was a code-signing certificate? The fact that the error involves the inability to reach a server suggests strongly that it was a TLS cert or somesuch
    - JohnTHaller 9y ago
      The parent of the comment I replied to was talking about a timestamp server. I was explaining what that meant and why it was using it. I don't know what the actual issue is with the Oculus' handling of certificates and whether it was a code signing certificate or not.
pc86 9y ago
> That would destroy all abandoned or poorly maintained software within a couple of years. Some might call this a feature.

Someone1234 9y ago

If anyone is interested in this topic this article goes into more detail: https://msdn.microsoft.com/en-us/library/windows/desktop/bb931395%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396 https://msdn.microsoft.com/en-us/library/windows/desktop/bb9...

iffycan 9y ago
Is there a macOS equivalent?
- pudquick 9y ago
  Look at --timestamp in codesign here: https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/codesign.1.html https://developer.apple.com/legacy/library/documentation/Dar... By default, this is currently enabled, as noted here: https://stackoverflow.com/questions/11712322/error-the-timestamp-service-is-not-available-when-using-codesign-on-mac-os-x https://stackoverflow.com/questions/11712322/error-the-times... You have to go out of your way when signing an app on macOS to disable timestamping in current OS versions.

jasonlotito 9y ago

Apparently this was changed in a recent update (1.22 to 1.23 iirc). In 1.22, it would have been fine.

midnitewarrior 9y ago

Can you just change the clock on your PC to get it to work again?

r1ch 9y ago
Yes, several users are already doing this as a workaround.
Piskvorrr 9y ago
This has unrelated but equally nasty side effects, though.

51Cards 9y ago

According to one thing I read (which I will admit was third party comments) there was a countersignature present up until version 1.22 and then in 1.23 it disappeared. I am not familiar with Oculus' binaries though so I don't know how far back that would be.

zzbzq 9y ago

I don't see enough info in the article to conclude what happened. But I have a hypothesis. I bet they use certificate pinning. Process A launches process B and checks against a pinned certificate. This is even more secure than just using the windows code signing stuff. Problem is, when their cert expired, they were supposed to renew the same cert. Instead, somebody got a new one and signed the build of process B. The device automatically downloads process B, but then the certificate pin check fails when it tries to launch it. All the security guides that tell you to do certificate pinning need flashing neon signs explaining this problem. You can't pin certs if you intend to ever change certs.

dockd 9y ago

The Windows signature tool, signtool.exe, makes the timestamp an optional parameter. There are no warnings if you don't supply it. I'd suggest this is a poor design--do most signatures not want the timestamp by default?

braderhart 9y ago
No problems on Linux... problem solved and it is open source and auditable.