3 ms·

> On the other hand, it stops tons of malware. Signed binaries is considered one of the most successful anti-malware strategies by security experts. Are you say

by iuguy 15y ago

> On the other hand, it stops tons of malware. Signed binaries is considered one of the most successful anti-malware strategies by security experts. Are you saying otherwise? As you've decided to pick anonymous security experts, I thought I'd chip in. I don't know if I'd call myself an expert but I've over a decade in industry breaking systems, fixing software and booting out bad guys, I'm speaking at BlackHat EU next month and I co-founded a security conference so I guess that means I'm not a complete security chump. I can categorically tell you that signed binaries are only part of a strategy, and not necessarily the best one at that. If your goal is to increase the cost of exploitation then signing can help, but so can a decent access control model (into which signing becomes a part thereof). To put it another way, it's possible to defeat applocker (windows binary signing), iOS code signing on iOS 5.0.1, the XBox and Xbox 360's code signing restrictions, the PS3's code signing restrictions, and more recently, an analysis of RSA keys showed that between 2 and 4 out of every thousand keys are insecure due to weak randomness[1]. The bottom line is that code signing, like placebos only work if you believe them to unless they're backed up by something more solid to augment them and they form a stronger coherent strategy. At this stage all code signing settings will do is encourage developers to get Apple IDs and for customers to use the App store as they know "it's safe". Even though we know it doesn't mean anything[2] to the end user in reality. The real thing that Apple will do is further on the line when they decide to make it so that you can only run signed apps (and this is at least the direction apple are taking) through their app store. Your edge case point applies to countless open source developers, including those that worked on the original FreeBSD code that went into Darwin. Apple are of course, under the licences they've inheritied allowed to implement code signing, but please don't think this is an anti-malware measure, it isn't. It's about control of distribution. Anyone that wants to bypass code signing on an Apple product will find a way to do it. [1] - http://www.theregister.co.uk/2012/02/16/crypto_security/ http://www.theregister.co.uk/2012/02/16/crypto_security/ [2] - http://thenextweb.com/insider/2012/02/15/what-ios-apps-are-grabbing-your-data-why-they-do-it-and-what-should-be-done/ http://thenextweb.com/insider/2012/02/15/what-ios-apps-are-g...

Someone 15y ago
"code signing […] only work if […] they're backed up by something more solid to augment them and they form a stronger coherent strategy." You mean things like sandboxing and blacklisting? Or do you think this is not (an attempt at) a coherent strategy? "At this stage all code signing settings will do is encourage developers to get Apple IDs and for customers to use the App store" It also (even if ever so slightly) decreases the attack surface. It is harder to infect executables if the OS checks the hash of the code every time it is run. Finally, it gives Apple a handle for disabling malware, once it has detected it. That will not prevent malware from infecting systems, but it can make it less likely that machines will keep getting infected for years after the time.

by iuguy 15y ago

Someone 15y ago

"code signing […] only work if […] they're backed up by something more solid to augment them and they form a stronger coherent strategy." You mean things like sandboxing and blacklisting? Or do you think this is not (an attempt at) a coherent strategy? "At this stage all code signing settings will do is encourage developers to get Apple IDs and for customers to use the App store" It also (even if ever so slightly) decreases the attack surface. It is harder to infect executables if the OS checks the hash of the code every time it is run. Finally, it gives Apple a handle for disabling malware, once it has detected it. That will not prevent malware from infecting systems, but it can make it less likely that machines will keep getting infected for years after the time.