Codesigning, untrusted CAs and why certain Mac apps aren’t launching

https://derflounder.wordpress.com/2021/08/24/codesigning-untrusted-certificate-authorities-and-why-certain-apps-arent-launching/

by zdw • 5 years ago

53 20 5 years ago

derflounder.wordpress.com

tyingq2• 5 years ago

Affects: RSA SecurID Software Token 4.2.1, Citrix Receiver and Cisco AnyConnect 4.7 and earlier

Ouch. That's going to break a lot of remote work.

Side note: I guess I hadn't seen, or maybe really looked at "codesigning" as a single word before. It reads like "co-designing" for me.

bonyt• 5 years ago

Citrix Receiver

At least this has been replaced with Citrix Workspace, I think. Receiver hasn't been updated since 2018.

https://www.citrix.com/downloads/citrix-receiver/mac/receive...

https://www.citrix.com/downloads/workspace-app/mac/workspace...

https://docs.citrix.com/en-us/citrix-workspace/workspace-app...

Citrix Workspace app replaces and extends the full capabilities of Citrix Receiver. Citrix recommends using the latest version of Citrix Workspace app to access workspaces.

tyingq2• 5 years ago

Yes, and the others are older versions too. But, I've worked at stodgy old places, and it's very common for stuff like Citrix receiver to hang around.

__warlord__• 5 years ago

PulseVPN also, without any warnings...

Thanks Apple.

jrochkind1• 5 years ago

The "Intent to Deprecate and Remove: Trust in existing Symantec-issued Certificates" is actually dated March 2017 -- that was the date the community started realizing Symantec-signed certs should not be trusted.

That it took until August 2021 (~4.5 years) for that to actually affect trust for some things signed by Symantec certs... seems to say something about the ability of the ecosystem to actually act on removing trust from a CA? Like, if those apps won't open because it's been decided they can't be trusted... 4.5 years ago... and if in fact the apps were totally safe all along, why do they have to be rejected now? What should we take from this about how we understand code-signing and other uses of trusted certs and what they do for us?

tru3_power• 5 years ago

What lead up to the reasoning for no longer having faith in Symantec-signed certs? Also what exactly made them so trusted/popular originally? Seems like you still see a lot of people using their certs

initplus• 5 years ago

https://wiki.mozilla.org/CA:Symantec_Issues

zinekeller2• 5 years ago

Seems like you still see a lot of people using their certs

It's Symantec in name only, at least for the certificates (https://www.digicert.com/news/pr/digicert-completes-acquisit...). Symantec as a company has been completely disintegrated by this point, with the other half now merged into LifeLock.

zamadatix• 5 years ago

No need for FUD. Symantec for many years led shoddy certificate validations. As a result of many audits finding inappropriately assigned certs the security community at large decided to just stop trusting them rather than continuously find issues in audits. That being said the audits had already been done, the harm of just immediately distrusting the CA wholesale would be orders of magnitudes more than the harm of whatever cert assignments slipped though the audits. A target date for the distrust needed to be chosen, at the same time the security community had been shifting to a maximum of <3 years on TLS certificates and about the same for code signing certificates with a preference they be even less than that farther in the future. The combination of these 2 goals to harden certificate trust going forward leads to the reasoning of why distrust it after all of these years, any certificates that were trusted prior to the distrust of new Symantec certs should be well expired.

Clearly quick reaction is possible if deemed necessary, new certs were almost immediately untrusted following concensus on action against Symantec. Should the situation have been more dire (e.g. a leak of the CA keys) a more dire course of action may have been warranted.

hamburglar• 5 years ago

I'm not an expert on code signing, but wouldn't a code-signing cert with a 2 year lifetime mean that none of the apps it signs can be used for more than 2 years? Or is the code-signing valid as long as the signature was generated within the signing cert's lifetime?

comex• 5 years ago

This is not how macOS's code signing system works; e.g. it does not use .cire files.

I tried installing two of those applications and I can't reproduce the error myself, but I can see the "Error loading the application. Contact your administrator." message within the strings of /Applications/SecurID.app/Contents/MacOS/SecurID, along with references to ".cire" and some strings from the .cire file ("certificate", "hash"). edit: I also see references to SecTrustCreateWithCertificates, SecTrustEvaluate, and other related functions from Security.framework which are designed to validate certificates (but wouldn't be called directly by applications as part of standard macOS code signing).

Conclusion: They probably rolled their own custom code signing system, albeit one that uses the system trust store to verify certificates.

torarnv• 5 years ago

Nor is this related to Qt in any way. As far as I know Qt has never shipped .cire files as a way to sign the libraries. This is something the vendor of the software token library (stauto32) has done when embedding Qt.

cwizou• 5 years ago

Yep, nothing to do with GateKeeper as the article imply. If I had to guess, the security framework returns that the bundled certs are invalid, and that crashes the apps in question as they can't go forward ?

southerntofu2• 5 years ago

Wait i don't get it, if some piece of software isn't signed or has invalid signature on MacOS, you don't get a prompt to run it anyway? It just says "nope"? If so, why would anyone ever use that system if you can't run apps of your choice?!

CamperBob2• 5 years ago

https://matrix.fandom.com/wiki/Cypher

southerntofu2• 5 years ago

To be clear because i'm getting downvoted, i'm not opposed to signed builds as the default. For example the GNU/Linux distros i use, by default only distribute signed and reproducible packages. However, users are still free to run any program they want, which is in my understanding why we use general-purpose computers at all.

See also Cory Doctorow's talk "The coming war on general-purpose computation" from 2011 CCC conference.

Codesigning, untrusted CAs and why certain Mac apps aren’t launching

Related Stories