Traps ESM - whitelist signers

[Miroslaw_Iwanowski]

Hello,

We have internal development team and we wnat them to use certificate to sign the exe file so we can then whitelist it in ESM. I have 3 questions related to it:

- "name of trusted signer" - is it CN field of Subject?

- how Traps will behave when certificate is no loger valid?

- how Traps will behave when certificate is revoked (granted CRL list is published and accessible)?

BTW there is an error in the documentation. Traps Management Service Admin page 23 - "To allow trusted signers previously seen in your environment, add the signer name (Windows) or SHA256 of the certificate that signs the file (macOS) to the Whitelist Signers list of the relevant Malware Security Profile." It should be SHA1 not SHA256. 

[BPry · Accepted solution]

@Miroslaw_Iwanowski,

The name would just be the CN field yes. To the best of my knowledge, and in my experiance, once you whitelist a signer it's only looking for that field and it never checks to see if the certificate itself is valid or if the certificate has been revoked.

The documentation is correct; you shouldn't be utilizing SHA1 to sign anything anymore, let alone your certificates. 

[Miroslaw_Iwanowski]

OK, thanks.

No, documentation is wrong. Documentation is mentioning signature thumbprint and not hash algorithm.  Thumbprint should be SHA1.

There is another question. Does Traps check for validity of certificate? If I will create a self signed certificate with the same name - will it work?

[BPry]

@Miroslaw_Iwanowski,

Traps is only looking for the Signer of the package; it doesn't matter if that is a Trusted Issuer or not. Traps is simply seeing if the trusted signer of say "Test Code Signing" matches the signer of the package. 

[Miroslaw_Iwanowski]

Do I understand correctly that I can check for issuer name, generate a self signed certificate with the same name and sign my malware and then avoid beeing checked by Traps if it whitelist that CN? 

[BPry]

@Miroslaw_Iwanowski,

Correct. The Whitelisted Signer is simply looking at the CN, and if you know that "My Company" is how I sign my custom apps and send a targeted malware campaign with it signed as "My Company" and it's whitelisted in traps my malware will run the same as your custom app. 

[Miroslaw_Iwanowski]

So it is more like a vulnerability not a security feature. Shame.