How do you think that users and computers can trust all this random software which appears on large public networks? I am of course referring to the internet and the requirement most of us have to download and run software or apps on a routine basis. How can we trust that this is legitimate software and not some shell of a program just designed to infect our PC or steal our data? After all even if we avoid most software, everyone needs to install driver updates and security patches.
The solution generally involves something called code signing which allows companies to assure the quality and content of any file released over the internet. The software is signed by a certificate and as long as you trust the certificate and it’s issuer then you should be happy to install the associated software. Code signing is used by most major distributors in order to ensure the quality of released software online.
Code Signing – the Basics
Coed signing simply adds a small digital signature to a program, an executable file, an active X control, DLL (dynamic link library) or even a simple script or java applet. The crucial fact is that this signature seeks to protect the user of this software in two ways:
Digital signature identified the publisher, ensuring you know exactly who wrote the program before you install it.
Digital signature allows you to determine whether the code you are looking to install is the same as that was released. It also helps to identify what if any changes have been made subsequently.
Obviously if the application is aware of code signing this makes it even simpler to use and more secure. These programs can be configured to interact with signed/unsigned software depending on particular circumstances. One simple example of this are the security zones defined in Internet Explorer. They can be configured to control how each application interacts depending on what zone they are in. There can be different rules for ‘signed’ and ‘unsigned’ applications for instance with obviously more rights assigned to the ‘signed’ applications.
In secure environments you can assume that any ‘unsigned’ application is potentially dangerous and apply restrictions accordingly. Most web browsers have the ability to determine the difference between these applications and assign security rights depending on the status. It should be noted that these will be applied through any sort of connection or access, even a connection from a live VPN to watch the BBC!
This is not restricted to applications that operate through a browser, you can assign and control activity of signed and unsigned applications in other areas too. Take for instance device drivers, it is arguably even more important that these are validated before being installed. You can define specific GPO settings in a windows environment to control the operation and the installation of a device driver based on this criteria.
As well as installation it can control how Windows interacts with these drivers too, although generally for most networks you should not allow installation of an unsigned driver. This is not always possible though, sometimes application or specialised hardware will need device drivers where the company hasn’t been able to sign the code satisfactorily. In these instance you should consider carefully before installing and consider the source too. For example if you have downloaded from a reputable site using a high anonymous proxies to protect your identity then that might be safer than a random download from an insecure site, there is still a risk though.