Open
Bug 1162842
Opened 9 years ago
Updated 2 years ago
Application Reputation checks on Windows should include the code signing certificate
Categories
(Toolkit :: Safe Browsing, defect, P3)
Toolkit
Safe Browsing
Tracking
()
NEW
People
(Reporter: francois, Unassigned)
References
(Blocks 1 open bug)
Details
We need to include code signing information in the metadata we send to the download verification service on Windows. This is the relevant field: https://code.google.com/p/chromium/codesearch#chromium/src/chrome/common/safe_browsing/csd.proto&q=csd&sq=package:chromium&l=208 message SignatureInfo { // All certificate chains for each of the binary's signers. Multiple chains // may be present if the binary or any certificate has multiple signers. // Absence of certificate chains does not imply that the binary is not // signed (in that case, SignedData blobs extracted from the binary may be // preset), but does mean that trust has not been verified. repeated CertificateChain certificate_chain = 1; // True if the signature was trusted on the client. optional bool trusted = 2; // PKCS#7 SignedData blobs extracted from a portable executable image's // attribute certificate table. The presence of these does not imply that // the signatures were deemed trusted by the client. repeated bytes signed_data = 3; } // This field will only be set if the binary is signed. optional SignatureInfo signature = 5;
Reporter | ||
Comment 1•9 years ago
|
||
Here is an example link for a signed binary that should trigger a remote lookup: http://www.vlc-download.de/vlc-2.2.1-win32.exe
Reporter | ||
Updated•7 years ago
|
Component: Downloads API → Safe Browsing
Priority: -- → P3
Reporter | ||
Updated•7 years ago
|
Summary: Application Manager checks on Windows should include the code signing certificate → Application Reputation checks on Windows should include the code signing certificate
Updated•6 years ago
|
Assignee: nobody → dlee
Status: NEW → ASSIGNED
Priority: P3 → P2
Comment 3•6 years ago
|
||
We already have code set code signing information on windows[1][2]. Need to confirm what we are missing. [1] https://searchfox.org/mozilla-central/rev/1ce4e8a5601da8e744ca6eda69e782318afab54d/toolkit/components/reputationservice/ApplicationReputation.cpp#1316 [2] https://searchfox.org/mozilla-central/rev/1ce4e8a5601da8e744ca6eda69e782318afab54d/netwerk/base/BackgroundFileSaver.cpp#795
Assignee: dlee → nobody
Status: ASSIGNED → NEW
Comment 4•6 years ago
|
||
I might have some clue about this after checking more detailly, When we extract signature, we ignore signature if it is not "trusted"[1]. However, Chrome still uses the signature if is not trusted and set "trusted" field in the remote lookup to false[2]. [1] https://searchfox.org/mozilla-central/rev/72b1e834f384a2ffec6eb4ce405fbd4b5e881109/netwerk/base/BackgroundFileSaver.cpp#838 [2] https://searchfox.org/mozilla-central/rev/72b1e834f384a2ffec6eb4ce405fbd4b5e881109/toolkit/components/reputationservice/chromium/chrome/common/safe_browsing/csd.proto#383
Updated•6 years ago
|
Updated•5 years ago
|
Priority: P2 → P3
Updated•2 years ago
|
Severity: normal → S3
You need to log in
before you can comment on or make changes to this bug.
Description
•