Can you trust signed code? No, you can't!
Summary: A common misconception is that if a piece of code, such as an application, has been signed, it's clean and safe to install. Wrong!
A common misconception is that if a piece of code, such as an application, has been signed, it's clean and safe to install. Wrong!
According to Jarno Niemelä of F-Secure, there are literally tens of thousands of instances of malware in the wild that are signed.
How does this happen? There are plenty of ways to get a certificate into malware:
- Copying Certificate information from clean files
- Selfsigned certs with fake name
- MD5 forgery
- Get certified and be evil
- Get certificate with misleading name
- Get certificate with misleading name
- Find someone to sign your stuff for you
- Steal a certificate
- Infect developers system and get signed with software release
Bottom line, the certificate is worth the paper it's printed on, so be careful what you go and install! It's a jungle out there!
PDF of the report can be found here.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
And that's what Linux Repos are for.
The Ed Bott story was bo gus.
The product in question didn't even have a GPG Key assigned to it.
Not a vendor worth working with IMO.
How so?
While nothing is impenetrable Linux repos are the closest you can get to it
RE: Can you trust signed code? No, you can't!
You have much to learn little weed hopper.
[i]"Man who catch fly with one chopstick can do anything."[/i]
Get the facts. Jack. ;)
re: How so?
[i]Ed's blog was a valid entry. [/i]
Ed's blog was pants-on-fire FUD. He *way* overplayed his hand. The only people who put "Linux" and "impenetrable" in the same sentence are people aching to see Linux getting taken down a notch.
Ed equates Linux not being impenetrable with the Swiss cheese that was XP in 2003. That's as pants-on-fire as it gets.
:)
I don't have anything to learn.
Not from you anyway. Truth is, Linux can be picked apart just like any other operating system. And no, repositories can't prevent stupid, nor are they impenetrable.
RE: Can you trust signed code? No, you can't!
No thanks, I can't be locked into just one repository.
RE: Can you trust signed code? No, you can't!
I knew it, it would not last long. While we agree about AT&T; you have been sipping WAY too much Kool-Aid.
In addition to the Ubuntu repositories, I also have some at sourceforge and launchpad. So, there is no way I am locked into only one repository.
Sorry, try again. For a moment, I thought that this was an `Ed Bott` article. AKH, I thought you knew better?
Sure worked great here.
In a proper repository the signatures are independent from the packages
My rule of thumb:
I never install anything without first testing it on a non networked PC I have set up. And DEFINITELY DO NOT install browser extensions outside of the expected few.
In a proper repository the signatures are independent from the packages
Adrian ...
RE: Can you trust signed code? No, you can't!
RE: Can you trust signed code? No, you can't!
RE: Can you trust signed code? No, you can't!
True, unfortunately. And we see a lot of that misunderstanding reflected in the posts commenting on this article, too!
The whole point of a cert is NOT that you can "trust the signed code". Rather it moves the question of trust from the code to the company AND the certificate authority.
That is, if the signing is properly done, then you can trust the code IF you a) trust the company and b) trust the certificate authority. For it is the certificate authortity who, among other things, guarantees that the company really is who they say they are before they give them the cert.
But alas, not all certificate authorities even do this! But VeriSign does. So does any reseller of their certs.
The other extreme, of course, is self-signed certs, which really give no additional confidence: you cannot even count on the company being who they say the are with a self-signed cert.
RE: Can you trust signed code? No, you can't!
Another poorly implemented "feature"
People are increasingly demanding easy to use, and easy to understand features that work correctly, and that a non-technical consumer can manipulate to accomplish what a device or piece of software was intended for.
Certificates are a Techie joke. Face it, they are left over from the ealy days of the web when there was maybe some claim to assurance, but they have never been easy to understand. Seriously: hashes, certificates, sums? A joke indeed.
RE: Can you trust signed code? Yes, you can!