4 ms·

Long time downloader of things from `http / port 80` here. I treat every Windows binary I download as if it's a trojan or something with some malicious behavior

Long time downloader of things from `http / port 80` here. I treat every Windows binary I download as if it's a trojan or something with some malicious behavior in it. One heuristic to look at is: Does this binary have a 'digital signature'[0]? If not, why does the author of the software not add one, and does not having a signature make the binary suspicious? Even with a signature present, I still upload the .EXE to Virustotal[1] to scan for malware. I don't trust modern AV software that sits in your machine since it is a privacy concern, but Virustotal is a website that runs in the cloud and doesn't scan every file on my computer and report back to HQ. [0] https://www.ghacks.net/2018/04/16/how-to-verify-digital-signatures-programs-in-windows/ https://www.ghacks.net/2018/04/16/how-to-verify-digital-sign... [1] https://www.virustotal.com/old-browsers/ https://www.virustotal.com/old-browsers/

judge2020 5y ago
The biggest thing with digital signatures is that getting one trusted by Windows means entertaining a racket enabled by Microsoft. There are two types of code signing certificates: regular, and EV. With regular certificates, all you get is effectively a way to carry your antivirus-based reputation with you as you continue to sign new binaries with it. At first sight, Windows will still throw up smartscreen warnings about it being potentially dangerous, until it's seen the certificate enough to trust it for new binaries. With EV certificates, everything is smooth sailing - only if actual malware is reported does your certificate get slammed by antivirus reputation, otherwise you can sign anything and it'll instantly bypass all AV software and Windows smartscreen prompts. The issue with getting either of these is that absolute cheapest one you can get is $59 a year for 3 years via a reseller[0] of Sectigo certificates, and that is only for regular code signing. If you want an EV certificate, it's going to be $219 a year for 3 years at the minimum via the same reseller (do not try to go through the regular channels or you'll likely be paying 2x-3x more[1]). Thankfully Microsoft is aware of these concerns[2,3] and there is a potential solution coming up called Azure Code Signing[4] however no new public information has been released since that video went up. 0: https://codesigncert.com/brand https://codesigncert.com/brand (this is just the cheapest site I've found - I am not affiliated with them beyond being a customer) 1: https://sectigo.com/ssl-certificates-tls/code-signing https://sectigo.com/ssl-certificates-tls/code-signing 2: https://github.com/MicrosoftDocs/windows-driver-docs/issues/2001#issuecomment-610700857 https://github.com/MicrosoftDocs/windows-driver-docs/issues/... 3: https://github.com/MicrosoftDocs/windows-driver-docs/issues/2001#issuecomment-611705469 https://github.com/MicrosoftDocs/windows-driver-docs/issues/... 4: https://youtu.be/Wi-4WdpKm5E?t=530 https://youtu.be/Wi-4WdpKm5E?t=530

judge2020 5y ago

The biggest thing with digital signatures is that getting one trusted by Windows means entertaining a racket enabled by Microsoft. There are two types of code signing certificates: regular, and EV. With regular certificates, all you get is effectively a way to carry your antivirus-based reputation with you as you continue to sign new binaries with it. At first sight, Windows will still throw up smartscreen warnings about it being potentially dangerous, until it's seen the certificate enough to trust it for new binaries. With EV certificates, everything is smooth sailing - only if actual malware is reported does your certificate get slammed by antivirus reputation, otherwise you can sign anything and it'll instantly bypass all AV software and Windows smartscreen prompts. The issue with getting either of these is that absolute cheapest one you can get is $59 a year for 3 years via a reseller[0] of Sectigo certificates, and that is only for regular code signing. If you want an EV certificate, it's going to be $219 a year for 3 years at the minimum via the same reseller (do not try to go through the regular channels or you'll likely be paying 2x-3x more[1]). Thankfully Microsoft is aware of these concerns[2,3] and there is a potential solution coming up called Azure Code Signing[4] however no new public information has been released since that video went up. 0: https://codesigncert.com/brand https://codesigncert.com/brand (this is just the cheapest site I've found - I am not affiliated with them beyond being a customer) 1: https://sectigo.com/ssl-certificates-tls/code-signing https://sectigo.com/ssl-certificates-tls/code-signing 2: https://github.com/MicrosoftDocs/windows-driver-docs/issues/2001#issuecomment-610700857 https://github.com/MicrosoftDocs/windows-driver-docs/issues/... 3: https://github.com/MicrosoftDocs/windows-driver-docs/issues/2001#issuecomment-611705469 https://github.com/MicrosoftDocs/windows-driver-docs/issues/... 4: https://youtu.be/Wi-4WdpKm5E?t=530 https://youtu.be/Wi-4WdpKm5E?t=530