I feel like I'm missing something obvious here, but I don't see it written anywhere.
I sign my executables using an Authenticode certificate, but as I've started to learn a bit more about it, I am questioning the value as-is.
- A signed exe has a digital certificate that shows as being a "valid" certificate. When you download such a file from the internet, it shows a warning in Windows saying you're about to run a program from a potentially unsafe location published by Xyz Corporation.
- Without the signature, the downloaded file will give a totally different-looking warning box saying the file is untrusted
Now, what concerns me, is:
If a signed exe is altered, when you go into Properties > Digital Signatures > Select signature > Details... it shows "This digital signature is not valid". That's a pretty obscure way to view what is likely a severe problem, and a huge indicator you shouldn't run the file.
- If you run this file from Windows (not downloaded), it will run just fine. No warning or any indication there is something wrong
- I didn't check what happens if you download the file and then try to run it.
If you strip the signature from the file (using delcert), there is no indication anything is wrong either. Again, you can run the file, and just no certificate is shown in the properties dialog.
To make this more useful, I'm thinking that a signed file needs to verify itself. Upon start up, it should be checking that there is a valid signature, and potentially that the sha1 fingerprint of the signature matches the expected signature for the Xyz Corporation certificate.
(Granted, this still doesn't handle the situation where someone strips the certificate, and then edits the file to remove the certificate check)
I can't find anyone talking about how to do this (at least not in .NET, and certainly not with a simple API call like I'd expect) - so this leads to a couple questions:
- Is there a reason the signature isn't checked? What other benefits are there to signing without this check?
- Is trying to verify the signature as a means of tamper detection so futile that it's pointless to try?
- How do you check the certificate of the current executable in .NET?