{"id":40218,"date":"2021-12-22T10:00:11","date_gmt":"2021-12-22T15:00:11","guid":{"rendered":"https:\/\/simpleprogrammer.com\/?p=40218"},"modified":"2021-12-22T07:28:12","modified_gmt":"2021-12-22T12:28:12","slug":"code-signing-primer","status":"publish","type":"post","link":"https:\/\/simpleprogrammer.com\/code-signing-primer\/","title":{"rendered":"All About Code Signing: What it is, How it Works, And Why You Should Do it"},"content":{"rendered":"
\n

\"codeIn the summer of 2021, Microsoft\u00a0issued a security advisory<\/a>\u00a0letting users know of a critical vulnerability in the Windows Print Spooler service. The flaw made it possible for attackers to run arbitrary code on just about any affected Windows machine if they could trick a user into installing a compromised printer driver. From there, they could gain near-total control of the machine and access to anything connected to it.<\/p>\n<\/div>\n

\n

But if you read the details of the bulletin, you\u2019d have noticed a critical piece of information: that the vulnerability revolved around the users\u2019 ability to install unsigned printer drivers. Signed drivers weren\u2019t a problem\u2014because it\u2019s all but impossible for attackers to alter them to include the malicious bits they needed to launch an attack.<\/p>\n<\/div>\n

\n

And within that distinction lies a lesson for software developers around the world: Code signing is important and something we all need to do when publishing software meant for public consumption. That said, there seem to be plenty of developers out there that don\u2019t bother with code signing or don\u2019t understand its significance.<\/p>\n<\/div>\n

\n

Make no mistake, though: Code signing is just as important to protect your customers as it is to protect yourself as a software developer. Imagine, for example, that a hacker or other bad actor decides to inject malicious code into one of your pieces of software. When that code does the damage it\u2019s designed to do, who do you think your customers are going to blame?<\/p>\n<\/div>\n

\n

Two points if you guessed it\u2019ll be you.<\/p>\n<\/div>\n

\n

Code signing isn\u2019t all that difficult to do. To help you understand how it works, here\u2019s a complete guide to code signing. We\u2019ll cover what it is, how it works, and why you should be doing it. Let\u2019s get started, shall we?<\/p>\n<\/div>\n

\n

What Is Code Signing?<\/h2>\n<\/div>\n
\n

To get started, let\u2019s first take a look at what code signing is\u2014it\u2019s very simple, really. Code signing is the process of issuing a trusted digital certificate attesting to who you are and guaranteeing that a piece of software contains only the code you wrote and that you can vouch for.<\/p>\n<\/div>\n

\n

In other words, it\u2019s a bit like a certificate of authenticity you might get if you buy a signed piece of movie memorabilia. Except in the case of code signing, you\u2019re not just guaranteeing authenticity, you\u2019re guaranteeing providence and security.<\/p>\n<\/div>\n

\n

It\u2019s based on the same kind of logic that web browsers use to open\u00a0SSL-encrypted connections<\/a>\u00a0to remote servers. The use of trusted certification authorities makes it possible for computers\u2014and users\u2014that don\u2019t know you personally to be reasonably certain that software they\u2019re going to execute hasn\u2019t been tampered with in any way.<\/p>\n<\/div>\n

\n

If you\u2019ve ever downloaded a program from the internet and tried to run it anytime in the last twenty years, you\u2019ve likely seen code signing in action. Modern operating systems check downloaded software for a valid signature and use that information to alert you as to who is asking to alter your computer.<\/p>\n<\/div>\n

\n

Software that isn\u2019t signed will generate a colorful and dire-looking warning letting you know that an unknown entity wishes to make changes to your PC. But signed software results in a benign-looking alert listing the software developer\u2019s name and asking for permission to proceed.<\/p>\n<\/div>\n

\n

There\u2019s an excellent chapter on the subject in the book\u00a0Web Security, Privacy and Commerce<\/em><\/a>\u00a0that discusses code signing\u2014and numerous other web security topics developers should know about. It\u2019s also a great handbook that I believe every developer should have on their shelf as a reference on myriad online security topics.<\/p>\n<\/div>\n

\n

How Does Code Signing Work?<\/h2>\n<\/div>\n
\n

The process of signing your code isn\u2019t all that different from the way you\u2019d obtain an SSL certificate for a website. It involves the use of a public and private encryption key pair to have a\u00a0trusted certification authority<\/a>\u00a0issue a valid code signing certificate to you to use when you publish software.<\/p>\n<\/div>\n

\n

To get a code signing certificate, you have to prove your identity to a certification authority, so they\u2019ll know you are who you say you are. But how you do that depends on the kind of certificate you\u2019re trying to obtain. There are two main types:<\/p>\n<\/div>\n

\n