Traps ESM - whitelist signers

Reply

Traps ESM - whitelist signers

Hello,

 

We have internal development team and we wnat them to use certificate to sign the exe file so we can then whitelist it in ESM. I have 3 questions related to it:

- "name of trusted signer" - is it CN field of Subject?

- how Traps will behave when certificate is no loger valid?

- how Traps will behave when certificate is revoked (granted CRL list is published and accessible)?

 

BTW there is an error in the documentation. Traps Management Service Admin page 23 - "To allow trusted signers previously seen in your environment, add the signer name (Windows) or SHA256 of the certificate that signs the file (macOS) to the Whitelist Signers list of the relevant Malware Security Profile." It should be SHA1 not SHA256. 

 

 

L7 Applicator

Re: Traps ESM - whitelist signers

@Miroslaw_Iwanowski,

The name would just be the CN field yes. To the best of my knowledge, and in my experiance, once you whitelist a signer it's only looking for that field and it never checks to see if the certificate itself is valid or if the certificate has been revoked.

 

The documentation is correct; you shouldn't be utilizing SHA1 to sign anything anymore, let alone your certificates. 

Re: Traps ESM - whitelist signers

OK, thanks.

 

No, documentation is wrong. Documentation is mentioning signature thumbprint and not hash algorithm.  Thumbprint should be SHA1.

 

There is another question. Does Traps check for validity of certificate? If I will create a self signed certificate with the same name - will it work?

L7 Applicator

Re: Traps ESM - whitelist signers

@Miroslaw_Iwanowski,

Traps is only looking for the Signer of the package; it doesn't matter if that is a Trusted Issuer or not. Traps is simply seeing if the trusted signer of say "Test Code Signing" matches the signer of the package. 

Re: Traps ESM - whitelist signers

Do I understand correctly that I can check for issuer name, generate a self signed certificate with the same name and sign my malware and then avoid beeing checked by Traps if it whitelist that CN? 

L7 Applicator

Re: Traps ESM - whitelist signers

@Miroslaw_Iwanowski,

Correct. The Whitelisted Signer is simply looking at the CN, and if you know that "My Company" is how I sign my custom apps and send a targeted malware campaign with it signed as "My Company" and it's whitelisted in traps my malware will run the same as your custom app. 

Re: Traps ESM - whitelist signers

So it is more like a vulnerability not a security feature. Shame.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!