2 ms·

> they'll just re-sign the modified script with their own signature Nope. Of course if someone stores a Code Signing key on the same server as the distribution

> they'll just re-sign the modified script with their own signature Nope. Of course if someone stores a Code Signing key on the same server as the distribution server then all bets are off, but otherwise it's no possible. PS CodeSign isn't perfect, but there is enough hoops to jump around for this not to be an easy task for a malicious actor gained access a distribution point.

maccard 4y ago
If I take a script, modify it and re sign it with a valid key, it will still be signed, just not by the original author, and will run. Even on windows now, package are often signed by individual developers rather than an entity that you might recognise the name of. > but there is enough hoops to jump around for this not to be an easy task for a malicious actor gained access a distribution point. If this is an optional step (which it would have to be) then the easiest thing to do is to remove the signature from the script and modify the instructions on how to run the script. If an attacker has compromised the supply chain, unless the original host has done something incredibly dumb, chances are they're quite dedicated and jumping through a handful of extra steps arent going to stop them.
- justsomehnguy 4y ago
  > If I take a script, modify it and re sign it with a valid key, it will still be signed, just not by the original author, and will run. > Even on windows now, package are often signed by individual developers rather than an entity that you might recognise the name of. This is implies what you, as an attacker: have the access to the Enterprise PKI can issue code signing certificates somehow your certificate drops in the Trusted Publishers[0] on the endpoint ie you have the access or to the GPO/domain controllers (keys to the kingdom) or to the endpoint (making the whole dance with certs moot) > If this is an optional step (which it would have to be) then the easiest thing to do is to remove the signature from the script This would make the script to fail from running in a proper configuration > and modify the instructions on how to run the script. And again this requires the access to the endpoint, which makes your assumptions moot. > If an attacker has compromised the supply chain, unless the original host has done something incredibly dumb, chances are they're quite dedicated and jumping through a handful of extra steps arent going to stop them. Exactly, which is why you don't "signed by individual developers", don't provide the easy way to access the PKI, don't sign the scripts and yet run them with -bypass. Come on, I did deploy PKI and PS Code Signing. [0] https://old.reddit.com/r/PowerShell/comments/kpwi5r/powershell_script_signing_trusted_publisher_prompt/gi4idy1/ https://old.reddit.com/r/PowerShell/comments/kpwi5r/powershe...

maccard 4y ago

If I take a script, modify it and re sign it with a valid key, it will still be signed, just not by the original author, and will run. Even on windows now, package are often signed by individual developers rather than an entity that you might recognise the name of. > but there is enough hoops to jump around for this not to be an easy task for a malicious actor gained access a distribution point. If this is an optional step (which it would have to be) then the easiest thing to do is to remove the signature from the script and modify the instructions on how to run the script. If an attacker has compromised the supply chain, unless the original host has done something incredibly dumb, chances are they're quite dedicated and jumping through a handful of extra steps arent going to stop them.

justsomehnguy 4y ago
> If I take a script, modify it and re sign it with a valid key, it will still be signed, just not by the original author, and will run. > Even on windows now, package are often signed by individual developers rather than an entity that you might recognise the name of. This is implies what you, as an attacker: have the access to the Enterprise PKI can issue code signing certificates somehow your certificate drops in the Trusted Publishers[0] on the endpoint ie you have the access or to the GPO/domain controllers (keys to the kingdom) or to the endpoint (making the whole dance with certs moot) > If this is an optional step (which it would have to be) then the easiest thing to do is to remove the signature from the script This would make the script to fail from running in a proper configuration > and modify the instructions on how to run the script. And again this requires the access to the endpoint, which makes your assumptions moot. > If an attacker has compromised the supply chain, unless the original host has done something incredibly dumb, chances are they're quite dedicated and jumping through a handful of extra steps arent going to stop them. Exactly, which is why you don't "signed by individual developers", don't provide the easy way to access the PKI, don't sign the scripts and yet run them with -bypass. Come on, I did deploy PKI and PS Code Signing. [0] https://old.reddit.com/r/PowerShell/comments/kpwi5r/powershell_script_signing_trusted_publisher_prompt/gi4idy1/ https://old.reddit.com/r/PowerShell/comments/kpwi5r/powershe...