Reply to thread

Message

<blockquote data-quote="alexandrud" data-source="post: 1109058" data-attributes="member: 118371">This is an interesting topic. In order to avoid signing tens of thousands of files, Microsoft decided to use a hack. Let&#039;s take as example the RDP client below:[ATTACH=full]286395[/ATTACH]The file itself does not have embedded any digital signature. WFC is using wintrust.dll (this one is signed for some reason) from Windows itself to verify if a file is digitally signed with a valid signature. You need to provide it a file path. The file is not signed, obviously, since Digital Signatures tab is missing from the file properties dialog. WFC will report correctly that the file is not digitally signed.Now the hack from Microsoft. Even if you use signtool verify, the file appears as unsigned, which is again correct. But if you use the /a parameter, suddenly the file is verified. Attention, the word is verified, not digitally signed. This only means that there is a catalog file where the hash of this file is contained and since the hash matches the provided file&#039;s hash, it must be the file which was indexed in the catalog file. It is verified, but not digitally signed.[ATTACH=full]286396[/ATTACH]Going back to WFC, it can not distribute and use signtool.exe to verify if a file was added in a catalog file so that Microsoft recognizes it as valid file based on its hash. If WFC detects the file as unsigned, it means the file does not have embedded a digital signature, detected as this by Microsoft (wintrust.dll), not by WFC.</blockquote>

[QUOTE="alexandrud, post: 1109058, member: 118371"] This is an interesting topic. In order to avoid signing tens of thousands of files, Microsoft decided to use a hack. Let's take as example the RDP client below: [ATTACH type="full"]286395[/ATTACH] The file itself does not have embedded any digital signature. WFC is using [B]wintrust.dll [/B](this one is signed for some reason) from Windows itself to verify if a file is digitally signed with a valid signature. You need to provide it a file path. The file is not signed, obviously, since Digital Signatures tab is missing from the file properties dialog. WFC will report correctly that the file is not digitally signed. Now the hack from Microsoft. Even if you use [B]signtool verify[/B], the file appears as unsigned, which is again correct. But if you use the [B]/a[/B] parameter, suddenly the file is verified. Attention, the word is [B]verified[/B], not [B]digitally signed[/B]. [B][SIZE=4]This only means that there is a catalog file where the hash of this file is contained and since the hash matches the provided file's hash, it must be the file which was indexed in the catalog file. It is verified, but not digitally signed.[/SIZE][/B] [ATTACH type="full"]286396[/ATTACH] Going back to WFC, it can not distribute and use signtool.exe to verify if a file was added in a catalog file so that Microsoft recognizes it as valid file based on its hash. If WFC detects the file as unsigned, it means the file does not have embedded a digital signature, detected as this by Microsoft (wintrust.dll), not by WFC. [/QUOTE]

Verification