Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 996023" data-attributes="member: 62850">Hey CS!&nbsp; We have several protections in place to mitigate bad sigs.&nbsp; First, VS does not auto allow by digital signature at all... unless the sig is already in the endpoint&#039;s tiny, customized whitelist.&nbsp; And of course we exclude certain sigs for this feature for obvious reasons.The second layer is what I call VoodooVerified.&nbsp; We have a list of roughly 15,000 of the most common sigs we have collected the last 10+ years that have all been verified.&nbsp; So if a file is signed and verified by the issuer, but is not verified by our list, then the user will get a prompt like this...[ATTACH=full]267918[/ATTACH]So even if VoodooAi and WLC determine the file to be safe, and even if the file is signed and verified by the issuer, the user is still warned that &quot;The digital signature cannot be verified by VoodooShield&quot;.We have a couple of other minor protections in place, but I would have to look through the code to remember what they are.&nbsp; But by far VS&#039;s most important protection for digital signatures is simply not allowing by sigs alone <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" />.I have not thought of checking the counter-signature before, but that would be a really great idea to do as well, thank you for the suggestion!&nbsp; BTW, if you need a license let me know.&nbsp; Thank you!</blockquote>

[QUOTE="danb, post: 996023, member: 62850"] Hey CS! We have several protections in place to mitigate bad sigs. First, VS does not auto allow by digital signature at all... unless the sig is already in the endpoint's tiny, customized whitelist. And of course we exclude certain sigs for this feature for obvious reasons. The second layer is what I call VoodooVerified. We have a list of roughly 15,000 of the most common sigs we have collected the last 10+ years that have all been verified. So if a file is signed and verified by the issuer, but is not verified by our list, then the user will get a prompt like this... [ATTACH type="full"]267918[/ATTACH] So even if VoodooAi and WLC determine the file to be safe, and even if the file is signed and verified by the issuer, the user is still warned that "The digital signature cannot be verified by VoodooShield". We have a couple of other minor protections in place, but I would have to look through the code to remember what they are. But by far VS's most important protection for digital signatures is simply not allowing by sigs alone ;). I have not thought of checking the counter-signature before, but that would be a really great idea to do as well, thank you for the suggestion! BTW, if you need a license let me know. Thank you! [/QUOTE]

Verification