5 ms·

> The SbieDrv.sys driver must be signed, and since the appropriate certificates are prohibitively expensive, I head to use a leaked code signing certificate I f

by dannyw 6y ago

> The SbieDrv.sys driver must be signed, and since the appropriate certificates are prohibitively expensive, I head to use a leaked code signing certificate I found laying around the Internets. This means some anti malware applications wrongfully flag it as potentially dangerous or a virus. Finding leaked but operational EV code singing certs online should not be a thing ...

corty 6y ago
Just emphasizes what is common knowledge anyways: code signing is security circus in windows, it's just an entry tax really.
- R0b0t1 6y ago
  To anyone who doubts this: while there is strict enforcement for kernel code just having a signature on binaries or scripts silences errors.
  - GordonS 6y ago
    A valid signature. That means the signature must chain to a trusted root CA, and the signing must have taken place within the signing certificate's validity period. If the certificate has expired at the time the user executes the binary, a counter-signature from a trusted timestamping service must also be present, to prove the binary was indeed signed within the certificate's validity period. This seems fairly sane to me, and and allows doing things in software like trusting particular publishers.
    - R0b0t1 6y ago
      No, it doesn't need to chain to a trusted root. Any signature silences a whole class of errors. You can also do strict enforcement if you'd like but the last I looked at this it's not the default.
      - GordonS 6y ago
        Digital signatures absolutely do need to chain to a trusted root (also, I forgot to mention that the certificate also has to have the "digital signature" EKU). What errors do you believe are silenced when an executable has an invalid or untrusted signature?
        R0b0t1 6y ago
        From memory adding a valid but unchained signature to a binary will change how SmartScreen initially evaluates your application. If there's no signature at all you get a yellow box or at least a message that is more alarming than if there is a valid signature even if unrecognized. Similar thing for the script signing policies -- during my testing the default seems to want a signature, but not a valid chained one. I was confused in the same way you are, but the documentation doesn't actually say you need a valid chained signature nor does it really describe the threat and security models. They just have signatures, because signatures make things more secure, right?
        GordonS 6y ago
        Apologies, I was thinking of Windows installers, rather than executables - a warning is given for installers with an invalid or untrusted signature, but you were correct that no warning is given for executables.
gruez 6y ago
But it's not operational. The root CA ("VeriSign Class 3 Public Primary CA") was revoked, and the certificate itself expired in 2011. It's just that windows doesn't bother checking the signatures, as another commenter in this thread mentioned.
IncRnd 6y ago
That was the 2nd pararaph. The first paragraph was, "This is a huge update fixing many bugs and security issues, it also expands on the functionality of the new SandMan.exe UI component, Check out the full ChangeLog for more details." Paragraphs 1 & 2 do not go well together, and I will never use this product, despite my having tested sandboxie itself in the past. Odd Story: The single person listed on the github page also has a fork of the original DiskCryptor code. At a prior employers I had worked, we once wanted to embedd DC into a larger framework. After some time we were able to find people to contact. They were using some elaborate scheme to hide their identities and yet converse over the phone. Since it was an "Open Source" project, and we already had the source code, we had reached out to them as a courtesy and nothing more. In fact we had already found serious bugs that we had fixed interally. Yet, they demanded an astronomically high sum for the use of DC. What did we do? The room of us laughed at the DC folks on speaker phone, then we went off and finished our own framework without using DC. There is a small segment of people on the fringes of the security industry who work for a government (trying to get people to use their product), are running from a government, have stolen code from a government, are involved with shady business dealings, etc. It's best to stay as far away from these people as possible at all times. I'm not saying the person who started this github falls into that category, but it's best to think about that before using what is a security product.

by dannyw 6y ago

corty 6y ago

Just emphasizes what is common knowledge anyways: code signing is security circus in windows, it's just an entry tax really.

R0b0t1 6y ago
To anyone who doubts this: while there is strict enforcement for kernel code just having a signature on binaries or scripts silences errors.
- GordonS 6y ago
  A valid signature. That means the signature must chain to a trusted root CA, and the signing must have taken place within the signing certificate's validity period. If the certificate has expired at the time the user executes the binary, a counter-signature from a trusted timestamping service must also be present, to prove the binary was indeed signed within the certificate's validity period. This seems fairly sane to me, and and allows doing things in software like trusting particular publishers.
  - R0b0t1 6y ago
    No, it doesn't need to chain to a trusted root. Any signature silences a whole class of errors. You can also do strict enforcement if you'd like but the last I looked at this it's not the default.
    - GordonS 6y ago
      Digital signatures absolutely do need to chain to a trusted root (also, I forgot to mention that the certificate also has to have the "digital signature" EKU). What errors do you believe are silenced when an executable has an invalid or untrusted signature?
      - R0b0t1 6y ago
        From memory adding a valid but unchained signature to a binary will change how SmartScreen initially evaluates your application. If there's no signature at all you get a yellow box or at least a message that is more alarming than if there is a valid signature even if unrecognized. Similar thing for the script signing policies -- during my testing the default seems to want a signature, but not a valid chained one. I was confused in the same way you are, but the documentation doesn't actually say you need a valid chained signature nor does it really describe the threat and security models. They just have signatures, because signatures make things more secure, right?
        GordonS 6y ago
        Apologies, I was thinking of Windows installers, rather than executables - a warning is given for installers with an invalid or untrusted signature, but you were correct that no warning is given for executables.

gruez 6y ago

But it's not operational. The root CA ("VeriSign Class 3 Public Primary CA") was revoked, and the certificate itself expired in 2011. It's just that windows doesn't bother checking the signatures, as another commenter in this thread mentioned.

IncRnd 6y ago

That was the 2nd pararaph. The first paragraph was, "This is a huge update fixing many bugs and security issues, it also expands on the functionality of the new SandMan.exe UI component, Check out the full ChangeLog for more details." Paragraphs 1 & 2 do not go well together, and I will never use this product, despite my having tested sandboxie itself in the past. Odd Story: The single person listed on the github page also has a fork of the original DiskCryptor code. At a prior employers I had worked, we once wanted to embedd DC into a larger framework. After some time we were able to find people to contact. They were using some elaborate scheme to hide their identities and yet converse over the phone. Since it was an "Open Source" project, and we already had the source code, we had reached out to them as a courtesy and nothing more. In fact we had already found serious bugs that we had fixed interally. Yet, they demanded an astronomically high sum for the use of DC. What did we do? The room of us laughed at the DC folks on speaker phone, then we went off and finished our own framework without using DC. There is a small segment of people on the fringes of the security industry who work for a government (trying to get people to use their product), are running from a government, have stolen code from a government, are involved with shady business dealings, etc. It's best to stay as far away from these people as possible at all times. I'm not saying the person who started this github falls into that category, but it's best to think about that before using what is a security product.