Author: Yathaarth Swaroop

Reading Time : 3 minutes

Code signing is a crucial mechanism to establish authenticity and trust, ensuring that software is not compromised during distribution. However, improper code signing practices can introduce significant risks. In this blog, we explore the importance of code signing and delve into the potential consequences of a compromised code signing process.

The Devastating Impact of a Code Signing Failure

Below are a few notable attacks that occurred as a result of code signing compromise or failure:

1. NotPetya Attack

   In June 2017, the global shipping conglomerate A.P. Moller-Maersk fell victim to the NotPetya malware attack. The attack originated from a small Ukrainian software company that had fallen victim to state-sponsored hackers. Exploiting vulnerabilities in the company’s security infrastructure, the hackers gained access to the code signing keys, allowing them to inject malware into a legitimate software update. This malicious update was subsequently distributed to customers, including A.P. Moller-Maersk, resulting in widespread infection and significant disruptions.

2. ShadowPad Supply Chain Attack

   In 2017, a sophisticated supply chain attack targeted the software update mechanism of the popular Ukrainian accounting software, MeDoc. The attackers compromised the code signing process, allowing them to distribute a backdoored software update to MeDoc users. This malicious update ultimately led to the spread of the ShadowPad malware, compromising numerous organizations worldwide.

3. ASUS Live Update Hack

   In 2019, hackers infiltrated ASUS’s web update server and injected malware into legitimate ASUS driver updates. The compromised code signing keys allowed the malicious updates to appear authentic, resulting in over one million infected ASUS computers. This attack highlighted the vulnerability of software supply chains and the importance of robust code-signing practices.

4. CCleaner Backdoor

   In 2017, the popular system optimization tool CCleaner was compromised when hackers injected malware into one of their official software updates. The attackers signed the malicious update with a valid code signing certificate, tricking users into believing it was a legitimate update. The incident affected millions of users and underscored the significance of code signing integrity.

These attacks serve as a stark reminder of the critical role code signing plays in ensuring the trustworthiness and authenticity of the software.

Assessing Software Trust and Vetting Processes

In light of such incidents, it is crucial to question the level of trust we place in the software we install and utilize. Businesses rely on numerous external software packages to support their daily operations. However, the lack of stringent vetting processes for these software packages can introduce significant risks. To enhance software security, consider the following measures:

1. Vetting and Whitelisting

   Implement a robust process to vet and approve software before allowing users to install it. Consider establishing a whitelist of trusted software and restrict installations to only those approved applications.

2. Internal Software Production

   Recognize the importance of securing your company’s software. Treat your private code signing keys as the keys to your business’s kingdom. Implement strict access controls, encryption, and monitoring mechanisms to safeguard these keys from theft or misuse. Consider using Hardware Security Modules (HSMs) to store and protect your code signing keys, as they provide high security and tamper resistance.

3. Supply Chain Integrity

   Ensure that the software you receive from external sources undergoes thorough security checks. Implement mechanisms to verify the integrity and authenticity of software updates before installation.

Understanding the Code Signing Problem

The efficacy of code signing in protecting software supply chains has been proven over the past three decades. However, certain challenges hinder its effectiveness. Organizations often struggle to effectively manage private code signing keys, leading to vulnerabilities and potential compromises. Let’s explore some common issues:

1. Lack of Centralized Key Management

   Many global organizations have geographically dispersed teams of software developers. These teams require access to private code signing keys to sign their software. However, when keys are stored on developers’ laptops, build servers, or web update servers, they become susceptible to theft or misuse.

2. Failure to Recognize Key Importance

   Private code signing keys should be treated as the master keys to your business. Unfortunately, organizations often overlook their criticality and fail to implement adequate security measures to protect them.

3. Insufficient Security Practices

   Inadequate security practices, such as weak password management, lack of encryption, and inadequate access controls, further contribute to code signing vulnerabilities.

Best Practices for Robust Code Signing

To enhance the security and integrity of your software infrastructure, it is imperative to implement best practices for code signing. Consider the following recommendations:

1. Implement Hardware Security Modules (HSMs)

   HSMs provide a dedicated and secure environment for key storage and cryptographic operations. By leveraging HSMs, organizations can protect their private keys from physical and logical attacks, ensuring the integrity of the code-signing process.

2. Regularly Rotate Keys

   Periodically rotate code signing keys to mitigate the impact of potential key compromises. By regularly updating keys, organizations minimize the risk of unauthorized access and maintain the trustworthiness of their signed software.

3. Employ Code Signing Policies and Procedures

   Develop comprehensive code-signing policies and procedures that define roles, responsibilities, and workflows for the code-signing process. Ensure employees receive proper training and adhere to these policies to maintain a secure code-signing environment.

4. Continuous Monitoring and Auditing

   Implement a robust monitoring and auditing mechanism to detect and investigate any suspicious activities related to code signing. Regularly review logs and perform audits to identify potential security gaps and take corrective actions promptly.

5. Scan for viruses

   While code signing provides authentication, it does not guarantee the security of the code itself. Therefore, conducting thorough virus and malware scans on the code before publication and signing with digital certificates is highly recommended. Performing these scans enhances the overall quality of the code and helps identify and mitigate potential security risks.

Want to know how we can assist you?

Encryption Consulting’s CodeSign Secure provides organizations with a comprehensive code-signing solution tailored to their unique requirements. By utilizing this solution, organizations can establish a strong code-signing policy that effectively mitigates security risks and ensures the authenticity of their software. Our product streamlines the code-signing process and offers a range of features designed to enhance security.

One key feature of CodeSign Secure is secure key management. It enables organizations to securely store their private keys of the code-signing certificate by integrating with industry-leading Hardware Security Modules (HSMs) that are FIPS certified. This integration eliminates the potential risks associated with stolen, corrupted, or misused keys, as the private keys never leave the HSM during the code signing operation.

Conclusion

Code signing is a critical component of ensuring software authenticity and trust. However, the potential consequences of a compromised code signing process are severe, as demonstrated by notable attacks like the NotPetya malware attack on A.P. Moller-Maersk and other incidents. To protect your software infrastructure, it is essential to implement robust code-signing practices and prioritize the security of private code-signing keys. Organizations can mitigate the risks associated with code signing failures by adhering to best practices such as HSM usage, regular key rotation, stringent code signing policies, continuous monitoring, and virus scanning.

Reading Time : 3 minutes

Security is critical in today’s digital world, especially when it comes to the protection of codesigning certificate private keys. Over the years, developers have used code-signing certificates to establish their software applications’ authenticity, integrity, and trustworthiness. However, the private keys associated with the code signing certificate were not adequately protected due to a lack of stringent policies and guidelines.

In this blog, we will delve deep into the recent updates to Baseline Requirements for Code Signing Certificates by the Certificate Authority/Browser (CA/B) Forum, which have to be implemented from 1^st June 2023.

What are CA/B Forum updates?

The CA/Browser Forum, a consortium of certificate authorities (CAs) and browser vendors, periodically revises its guidelines and requirements to enhance the security of digital certificates. In a recent update, the forum introduced new recommendations specifically aimed at code-signing certificate private keys. These updates aim to address emerging security threats and strengthen the overall security posture of the code-signing ecosystem.

Starting June 1, 2023, it is mandatory for subscriber private keys associated with code signing certificates to be protected using a Hardware Crypto Module that complies with either FIPS 140-2 Level 2 or Common Criteria EAL 4+ requirements. Subscribers are required to select one of the approved approaches for generating and securing their code signing certificate private keys:

1. Option 1

   Use a Hardware Crypto Module operated by them that adheres to the prescribed standards.

2. Option 2

   Employ a cloud-based key generation and protection solution that satisfies the following criteria:

   • Keeps private keys within the secure boundaries of the cloud platform’s hardware crypto module, meeting the specified requirements.
   • Logs all access, operations, and configuration changes related to the resources securing the private key.

3. Option 3

   Utilize a Signing Service that meets the established baseline requirements.

In addition, CAs shall verify that the subscriber’s private key is generated, stored, and used in a suitable hardware crypto module using one of the following methods:

1. The CA provides a hardware crypto module with pre-generated key pairs.
2. The subscriber uses key attestation to verify the private key’s secure generation in a hardware crypto module.
3. The subscriber employs a prescribed crypto library and suitable hardware crypto module for key pair generation and storage.
4. The subscriber presents an IT audit report confirming the exclusive use of a suitable hardware crypto module for key pair generation of code signing certificates.
5. The subscriber provides a report from their cloud-based key protection solution, demonstrating the secure configuration of resources protecting the private key.
6. The CA relies on a report, signed by an approved auditor, confirming key pair creation in a suitable hardware crypto module, including cloud-based solutions.
7. The subscriber provides an agreement agreeing to use a Signing Service that meets the requirements.

How can you stay compliant?

To ensure compliance with these updates and enhance the security of their digital certificates, organizations should take the following steps:

• Review the Requirements

  Thoroughly study the updated recommendations the CA/Browser Forum provided to understand the specific requirements and changes related to code signing certificate private keys.

• Assess Existing Infrastructure

  Organizations need to review their current infrastructure and identify their methods to generate and protect code signing certificate private keys. This assessment will help identify gaps or areas that must be addressed to comply with the new guidelines.

• Select a Suitable Approach

  Organizations must choose one of the approved approaches stated in the blog for generating and securing their code signing certificate private keys.

Want to know how can we assist you?

Encryption Consulting’s CodeSign Secure provides organizations with a comprehensive code-signing solution tailored to their unique requirements. By utilizing this solution, organizations can establish a strong code-signing policy that effectively mitigates security risks and ensures the authenticity of their software. Our product streamlines the code-signing process and offers a range of features designed to enhance security.

One key feature of CodeSign Secure is secure key management. It enables organizations to securely store their private keys of the code-signing certificate by integrating with industry-leading Hardware Security Modules (HSMs) that are FIPS certified. This integration eliminates the potential risks associated with stolen, corrupted, or misused keys, as the private keys never leave the HSM during the code signing operation.

Conclusion

In conclusion, the recent updates to the Baseline Requirements for Code Signing Certificates by the CA/Browser Forum emphasize the criticality of protecting code signing certificate private keys. Organizations must adapt to these updates by implementing robust measures, such as using Hardware Crypto Modules that do not only comply with but exceed the requirements of FIPS 140-2 Level 2 or Common Criteria EAL 4+ standards. Organizations can bolster trust, integrity, and authenticity in their software applications by prioritizing the security of code signing certificate private keys.

Reading Time : 3 minutes

As technology advances and the world becomes more reliant on software, cyber threats continue to evolve, posing a significant risk to organizations. Code-signing policies have become a critical aspect of ensuring the safety and integrity of software. These policies ensure that only authorized code is executed on systems, preventing malware from being installed. Despite its importance, many organizations still fail to enforce these policies, leaving their systems vulnerable to attacks.

Lack of Understanding

One of the main reasons why code signing policies are being disregarded or not enforced is due to a lack of understanding. Many organizations may not fully comprehend the risks associated with unsigned code or may not understand how to implement a code-signing policy effectively. Sometimes, the IT team may not have the necessary skills and knowledge to manage code-signing policies. As a result, the organization may not prioritize code signing policies and may not be given the necessary attention.

Cost

Another reason why organizations may be reluctant to enforce code-signing policies is the cost associated with implementing them. Code signing certificates can be expensive, and organizations may not want to invest in them, especially if they do not fully understand their benefits. Additionally, implementing code signing policies may require changes to existing infrastructure, which can be time-consuming and costly. This may result in organizations deciding not to enforce code signing policies, leaving them vulnerable to cyberattacks.

Lack of Accountability

In some organizations, there may be a lack of accountability when it comes to enforcing code-signing policies. This may occur if it is unclear who is in charge of overseeing the code signing guidelines.  If there is no one person or department responsible for implementing and enforcing code signing policies, it can be challenging to ensure that they are followed consistently. This lack of accountability can lead to policies being disregarded or not implemented.

Legacy Applications

Legacy applications can also be a hindrance to enforcing code signing policies. Many older applications were not designed with code signing in mind and may not be compatible with modern code-signing certificates. In some cases, code signing may not be possible without significant modifications to the application, which may not be feasible or cost-effective. This can create a situation where code-signing policies cannot be enforced effectively, leaving the organization vulnerable to cyberattacks.

Lack of Awareness

Another reason why code signing policies may be ignored or not enforced is due to a lack of awareness. Some organizations may be unaware of the advantages of code-signing policies or may not completely comprehend how they work. This can lead to a situation where code signing policies are not considered a priority and may not be enforced. Furthermore, employees may be unaware of the significance of code signing policies, which can lead to unintentional violations.

Resistance to Change

Finally, some organizations may resist implementing code-signing policies due to resistance to change. Change may be challenging, particularly when introducing new security measures. Employees may be reluctant to workflow changes or unwilling to learn new methods. This can make it difficult to implement and enforce code-signing policies effectively.

Conclusion

In conclusion, code-signing policies are essential to modern cybersecurity, and their implementation and enforcement are critical for protecting software applications against malicious attacks. Ignoring or neglecting these policies can result in severe consequences for organizations, including data breaches, financial loss, and damage to reputation. Organizations can ensure their systems and data remain secure by addressing the common barriers to code signing policy implementation, such as a lack of understanding, cost, and resistance to change.

Reading Time : 5 minutes

In today’s digital age, where almost everything is interconnected, cybersecurity has become more important than ever before. One of the most critical aspects of software security is code signing. It ensures that the software being installed on a system is genuine and has not been tampered with. However, as the use of code signing has increased, so have the risks associated with it. Hackers are getting better at stealing code-signing machine identities, which poses a significant threat to the security of software systems.

What is Code Signing, and How Does It Work?

Code signing is a process that involves digitally signing software with a certificate to prove its authenticity. A code signing certificate is essentially a digital ID that is issued by a trusted third party, such as a certificate authority (CA). The certificate includes information about the software vendor, the software’s hash value, and the digital signature. When the software is installed, the operating system checks the signature against the certificate to ensure that the software is genuine and has not been tampered with.

Code signing provides several benefits, such as ensuring the integrity of the software, protecting against malware, and establishing trust between the software vendor and the end user.

The Risks Associated with Code Signing:

One of the most significant risks associated with code signing is the theft of code-signing machine identities. If a hacker gains access to the code signing keys, they can steal and use them to insert malware. This can allow the malware to bypass antivirus software and other security measures, making it much harder to detect and remove.

Another risk associated with code signing is the misuse of certificates by insiders. Insiders, such as developers or system administrators, may have access to code-signing certificates and can misuse them to sign malicious software. This can happen accidentally or deliberately, which can be challenging to detect and prevent.

Finally, code signing can also be vulnerable to phishing attacks. Hackers can send phishing emails to developers or system administrators, tricking them into revealing their credentials or downloading malware. This allows the attacker to sign malicious software with a legitimate code signing certificate, making it much harder to detect and remove.

The Consequences of Code Signing Identity Theft:

The consequences of code-signing identity theft can be severe. This can result in a range of negative consequences, such as:

• Loss of trust

  If software vendors’ code signing certificates are compromised, it can lead to a loss of trust between the vendor and the end-user. This can result in a loss of business and a damaged reputation.

• Financial loss

  Malware signed with a legitimate code signing certificate can result in significant financial losses for both the software vendor and the end user.

• Legal issues

  If a software vendor’s code signing certificate is stolen and used to sign malware, the vendor may face legal issues, such as lawsuits or regulatory fines.

 Preventing Code Signing Identity Theft:

• Using code signing best practices

  Software vendors should follow code signing best practices, such as using the latest certificate technologies, validating certificate chains, and verifying the certificate’s revocation status. This can help prevent code signing identity theft and ensure the integrity of the software.

• Monitoring for suspicious activity

  Software vendors should monitor code signing machines for suspicious activity, such as unauthorized access attempts or unusual signing patterns. This can help detect code signing identity theft early and prevent further damage.

• Implementing strong security policies

  Software vendors should implement strong security policies that cover all aspects of code signing, such as password management, access control, and incident response. This can help prevent code signing identity theft and minimize the impact of any security incidents.

Conclusion

Code signing is a critical component of software security that ensures software integrity and establishes trust between the vendor and the end user. Preventing code-signing identity theft requires a multi-layered approach, including securing code-signing machines, limiting access to code-signing certificates, storing the keys in a safe environment, educating employees, following code-signing best practices, monitoring for suspicious activity, and implementing strong security policies. By taking these steps, software vendors can help prevent code signing identity theft and ensure the integrity of their software systems.