1162842 - Application Reputation checks on Windows should include the code signing certificate

Status: NEW

(Toolkit :: Safe Browsing, defect, P3)

Description

[François Marier [:francois]]

We need to include code signing information in the metadata we send to the download verification service on Windows.

This is the relevant field:

https://code.google.com/p/chromium/codesearch#chromium/src/chrome/common/safe_browsing/csd.proto&q=csd&sq=package:chromium&l=208

  message SignatureInfo {
    // All certificate chains for each of the binary's signers.  Multiple chains
    // may be present if the binary or any certificate has multiple signers.
    // Absence of certificate chains does not imply that the binary is not
    // signed (in that case, SignedData blobs extracted from the binary may be
    // preset), but does mean that trust has not been verified.
    repeated CertificateChain certificate_chain = 1;

    // True if the signature was trusted on the client.
    optional bool trusted = 2;

    // PKCS#7 SignedData blobs extracted from a portable executable image's
    // attribute certificate table. The presence of these does not imply that
    // the signatures were deemed trusted by the client.
    repeated bytes signed_data = 3;
  }

  // This field will only be set if the binary is signed.
  optional SignatureInfo signature = 5;

Comment 1

[François Marier [:francois]]

Here is an example link for a signed binary that should trigger a remote lookup: http://www.vlc-download.de/vlc-2.2.1-win32.exe

Comment 3

[Dimi Lee [:dimi]]

We already have code set code signing information on windows[1][2].
Need to confirm what we are missing.

[1] https://searchfox.org/mozilla-central/rev/1ce4e8a5601da8e744ca6eda69e782318afab54d/toolkit/components/reputationservice/ApplicationReputation.cpp#1316
[2] https://searchfox.org/mozilla-central/rev/1ce4e8a5601da8e744ca6eda69e782318afab54d/netwerk/base/BackgroundFileSaver.cpp#795

Comment 4

[Dimi Lee [:dimi]]

I might have some clue about this after checking more detailly,

When we extract signature, we ignore signature if it is not "trusted"[1].
However, Chrome still uses the signature if is not trusted and set "trusted" field in the remote lookup to false[2].

[1] https://searchfox.org/mozilla-central/rev/72b1e834f384a2ffec6eb4ce405fbd4b5e881109/netwerk/base/BackgroundFileSaver.cpp#838
[2] https://searchfox.org/mozilla-central/rev/72b1e834f384a2ffec6eb4ce405fbd4b5e881109/toolkit/components/reputationservice/chromium/chrome/common/safe_browsing/csd.proto#383