Driver Signing Practical Info

> http://krebsonsecurity.com/wp-content/uploads/2015/07/fb-wifisense.png

“Monkey Boy” must be getting pretty nervous - MSFT’s new manangement is about to do something he could not imagine even in his wildest dream. His best “achievement” was reducing MSFT market share in the world of mobile systems to laughable 3% out of thin air. MSFT’s new management seems to be just desperate to take things to a basically new level and achieve the same result in the world of corporate desktops/laptops, i.e in the market that happens to be one of the last MSFT strongholds at the time. Let’s face it - this “Wi-fi Sense”(or whatever they call it) seems to be just a dream of any Kevin Mitnick-style “hacker” (i.e. the one who mainly relies upon so-called “social engineering”, rather than technical sophistication), as well as any rogue employee who wants to steal corporate data while enjoying an extra protection against any criminal/civil “repercussions”…

Anton Bassov

Hello everyone,

It’s been four days since the official release date of Windows 10 and I just checked - all of my wfp callout drivers (kmdf) as well as legacy ones (wdm) are still loading fine using the old way of signing (cross signing using signtool).

I signed the drivers just now and they load fine. All Windows 10 machines are up-to date. I thought the ‘sysdev portal signing’ should be used also for non pnp drivers.

No?

Just rechecked again the doc at https://www.osr.com/blog/2015/07/24/questions-answers-windows-10-driver-signing/ and I can see that it works for me because my certificate was issued prior to release of Windows 10.

The following statement, however, is unclear:

>
Cross-signing will continue to work, as long as the cross-signing certificate was issued prior to Windows 10 RTM (the cut off). The default state for this policy is turned on, but IT admins can choose to turn it off using a new feature in Windows 10 called configurable code integrity
<<

What is the name of this option? Is there any documentation on how to test this?

>> Was the CAT the only file that was signed? Not the SYS?

I’ll check when I’m back in the office on Monday, Tim.

Interesting, the .sys file and my property page dll are also signed.

Jeff

I don?t know who posted this link and what for ?

this link asks to get info from some social media.

If some remember that you indeed posted this link, could you please also provide your social media login/passwd, so I can look ?

Pro

On Aug 2, 2015, at 10:59 AM, xxxxx@hotmail.com wrote:

> http://krebsonsecurity.com/wp-content/uploads/2015/07/fb-wifisense.png

“Monkey Boy” must be getting pretty nervous - MSFT’s new manangement is about to do something he could not imagine even in his wildest dream. His best “achievement” was reducing MSFT market share in the world of mobile systems to laughable 3% out of thin air. MSFT’s new management seems to be just desperate to take things to a basically new level and achieve the same result in the world of corporate desktops/laptops, i.e in the market that happens to be one of the last MSFT strongholds at the time. Let’s face it - this “Wi-fi Sense”(or whatever they call it) seems to be just a dream of any Kevin Mitnick-style “hacker” (i.e. the one who mainly relies upon so-called “social engineering”, rather than technical sophistication), as well as any rogue employee who wants to steal corporate data while enjoying an extra protection against any criminal/civil “repercussions”…

Anton Bassov


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

On Aug 2, 2015, at 3:58 PM, Jeff Pages wrote:
>
>>> Was the CAT the only file that was signed? Not the SYS?
>
>> I’ll check when I’m back in the office on Monday, Tim.
>
> Interesting, the .sys file and my property page dll are also signed.

That’s good news, I guess. It means that there is a working attestation path for non-PnP drivers.

Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

> this link asks to get info from some social media.

No, Pro, this link does not “ask to get info from some social media.”…

What it does is just displaying an image of a dialog box (or whatever they call it these days) presented to Windows10 users. If you click “OK”, Windows will send an encrypted copy of your password to all your Facebook “friends” and Outlook contacts who happen to be physically close enough to access your wireless network (i.e up to 100m for 802.11) so that they can use it.

Now imagine a system like that in a corporate environment. Seems to be just a crook’s dream, don’t you think - you click “OK” in the office and, once in a sudden, your accomplice with a laptop in a car parked outside has an access to your company’s networks…

Anton Bassov

>easily imagine some “Windows 7 fanboy” who had purchased his RTM version of Windows 7, paid

his $200 -300 (or whatever it costs) to MSFT, so that he does not need any OEM version on his
machine either.

Abnormal.

What is not abnormal is to have a pathetic Windows SKU pre-installed by the vendor on the otherwise great laptop.

In this case, paid SKU upgrade (especially pre-Win8 since that times Windows Home was even more pathetic) is often performed.

Technically it is as simple as re-activating Windows with another key.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

> Now imagine a system like that in a corporate environment. Seems to be just a crook’s dream, don’t

you think - you click “OK” in the office and, once in a sudden, your accomplice with a laptop in a car
parked outside has an access to your company’s networks…

The notion of public/private networks appeared as early as in Vista

More so, the option you’re speaking about was there in Windows Phone for some time.

Many, many things in Win10 are from Windows Phone.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

Well, I mean reasonable people, Max (I really hope you can find some even among Windows users). It does not apply to a sheep that goes with the rest of the herd and thoughtelessly does absolutely everything that it is told to do by a shepherd, i.e by someone whom it finds in a position of authority in a given situation, be it a corporate entity, some dim pop would-be-star or politician.
Someone like that is, indeed, going to do something that you have mentioned above simply because of being told to do so by MSFT.

However, someone who is capable of thinking is going to think a bit,effectively realising that doing something that you have mentioned above is just plainly stupid This is why you will find PLENTY of XP, W2K (and probably even NT4) installations in corporate environments - after all, they are managed by those who are capable of thinking and would not pay money for “updates” and “upgrades” simply because of being told to do so by MSFT.

More so, the option you’re speaking about was there in Windows Phone for some time.
Many, many things in Win10 are from Windows Phone.

…and now look at the statement that you seem to be arguing with

Indeed, they seem to be introducing features of Windows Phone (i.e the system that failed miserably, effectively losing the market almost completely) to the desktop OS, i.e the market that is still dominated by MSFT. Under these circumstances it would not be too unreasonable to expect more or less the same outcome in the desktop market as well, don’t you think…

Anton Bassov

Thanks for pointing Anton !

I just wanted to see what that link about, and I know it asked me to share Facebook info. ? Crazy :slight_smile:

Anyways ?

Pro

On Aug 3, 2015, at 12:34 AM, xxxxx@hotmail.com wrote:

> this link asks to get info from some social media.

No, Pro, this link does not “ask to get info from some social media.”…

What it does is just displaying an image of a dialog box (or whatever they call it these days) presented to Windows10 users. If you click “OK”, Windows will send an encrypted copy of your password to all your Facebook “friends” and Outlook contacts who happen to be physically close enough to access your wireless network (i.e up to 100m for 802.11) so that they can use it.

Now imagine a system like that in a corporate environment. Seems to be just a crook’s dream, don’t you think - you click “OK” in the office and, once in a sudden, your accomplice with a laptop in a car parked outside has an access to your company’s networks…

Anton Bassov


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Anton… You’re once again pointlessly ranting and off topic… Maybe you can find a Linux group where your spew will be appreciated?

One way or the other, find another song to sing or sing your current one elsewhere, please.

Mr. Sinha: Please don’t feed the troll, it only makes him stronger and more determined.

Peter
OSR
@OSRDrivers

> One way or the other, find another song to sing

Agreed - let me try the one that you are,apparently, going to appreciate



God save our Microsoft
Long live our Microsoft
God save Microsoft

Send them victorious
Happy and glorious
Long to reign over us
God save Microsoft

Cutler our God arise
Crash NT enemies
And make them fall

Confound their politics
Frustrate their knavish tricks
On Thee our hopes we fix
Cutler save us all

From every latent foe
From every Stallman’s blow
God save Microsoft

The above “anthem” is just a idiomatic representation of something that certain posters (we don’t really need to name them here, do we) “sing” all the time in this NG, going MILES away from the topic of the original discussion, and doing so on a regular basis. Furthermore, some of them consider themselves too “serious” to subscribe to NTTALK - instead, they prefer to pollute NTDEV with OT discussions. To make it even more interesting, some of them post literally in a machine-gun fashion, making 15-20 posts in a row, effectively turning the whole thread unreadable after making “3-4 sets of 15-20 reps each”.

You don’t seem to have any objections to these posts/posters, do you. However, anyone who
is critical of MSFT is immediately branded as a “troll”, and any criticism is branded as .“pointless ranting”, “spew” and “off topic”.

I DO realise that this is your list so that you are free to set any posting rules that you wish, so that you should take it all simply as a casual observation…

Anton Bassov

>I DO realise that this is your list

Excellent!

Then you’ll understand when I tell you that in order to limit your rants (and my personal annoyance) on my list, yet still allow you to enjoy my renowned hospitality, you are now on moderation.

Congratulations! You are the first list member in the long and storied history of NTDEV to reach this lofty status.

Peter
OSR
@OSRDrivers

Dear all ,

Something is still not clear to may ( may be because I an not so brilliant with interpretation of English texts ) . At the OSR blog
conversation , “James” said :

a… We do support a transitional policy for folks that hopefully alleviates some of the pressure. Cross-signing will continue to
work, as long as the cross-signing certificate was issued prior to Windows 10 RTM (the cut off). The default state for this policy
is turned on, but IT admins can choose to turn it off using a new feature in Windows 10 called configurable code integrity. That’s a
good thing for folks to be aware of before making the decision to continue using their cross-signing certificates. This document
gives a high-level of these changes.

Now , I interprete this as there would be new cross-certificates released starting from the “cutt off” . The cross-certificates at
https://msdn.microsoft.com/en-us/library/windows/hardware/dn170454(v=vs.85).aspx are still the same as from months ago. I
agree this sounds stupid , but can someone explain in simple english what James meant here. Personally I was persuaded that drivers
signed ( and time-stamped ) before the cut-off will be accepted on Win 10 with Secure Boot enabled. Those time stamped after the
cut-off would be rejected. It seems now that I am wrong about this.

Regards ,

Christiaan

Christiaan Ghijselinck wrote:

Something is still not clear to may ( may be because I an not so
brilliant with interpretation of English texts ) . At the OSR blog
conversation , “James” said :

/a… We do support a transitional policy for folks that hopefully
alleviates some of the pressure. Cross-signing will continue to
work, as long as the cross-signing certificate was issued prior to
Windows 10 RTM (the cut off). The default state for this policy
is turned on, but IT admins can choose to turn it off using a new
feature in Windows 10 called configurable code integrity. That’s a
good thing for folks to be aware of before making the decision to
continue using their cross-signing certificates. This document
gives a high-level of these changes.
/
Now , I interprete this as there would be new cross-certificates
released starting from the “cutt off” . The cross-certificates at
https://msdn.microsoft.com/en-us/library/windows/hardware/dn170454(v=vs.85).aspx
are still the same as from months ago. I
agree this sounds stupid , but can someone explain in simple english
what James meant here. Personally I was persuaded that drivers
signed ( and time-stamped ) before the cut-off will be accepted on
Win 10 with Secure Boot enabled. Those time stamped after the
cut-off would be rejected. It seems now that I am wrong about this.

I think the confusion here is that he uses the phrase “cross-signing
certificate” where I would have used the phrase “certificate that needs
to be cross-signed”. The important item is not the cross certificate,
the important item is the original code-signing certificate.

So, drivers that are signed and cross-signed in the traditional manner,
using a code-signing certificate that was issued prior to the RTM date,
will continue to work. No changes will be required.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

I agree with Mr. Roberts. In context, this must be correct.

While those are the exact words Mr. Murray used, I’m actually going to change his quote in the interview to make it more clear.

There’s exactly nothing to gain by having a quote that’s literally correct, but confusing or unclear.

Peter
OSR
@OSRDrivers

Thanks Tim and Peter. Really appreciated.

Regards ,

Christiaan

>It does not apply to a sheep that goes with the rest of the herd and thoughtelessly does absolutely

everything that it is told to do by a shepherd

Well, let’s talk on shepherds and slaves :slight_smile:

My very strong belief is that “rage against the machine” for the sake of rage itself, as also Ego boosting by such rage (which most anti-establishment people do, in Linux fandom/Slashdot community also) - it just plain a moronity.

Sometimes the “shepherd” just knows the way which works (not perfect, but still works). Sometimes it does not demand anything sufficient from you.

Also note the 2 points:

  • a Jew in 1930ies Germany, lying (with forged documents provision) about himself being an Aryan to the Reichs-official - is GOOD. Such a thing is by no mean morally evil, it only deserves respect. And, I personally extend this notion to rather many bureaucratic regulations of the current governments, even if though they are not Nazis. You can consider me as “anti-establishment” (though I’m not such) :slight_smile:
  • “a tame calf sucks from 2 mothers” - the Russian proverb.

something that you have mentioned above is just plainly stupid This is why you will find PLENTY of >XP, W2K (and probably even NT4) installations in corporate environments

Currently? in 2015?

100% false on NT4, which hardly ever survived even in embedded stuff like kiosk boxes (NT4-based boxes just did not survive physically/mechanically/electrically, being very old).

100% false on w2k too. In around 2010, it was not so false on w2k, but in non-Western countries (Spanish-speaking America and Brazil, according to my information). But in 2015 - w2k is gone.

Also note that, even though many companies will not upgrade the OS on their desktops just for the sake of upgrade, no one in serious world will deliberately install obsolete OS to the newly purchased PC.

So, the lifetime of obsolete Windows versions is limited by the physical/mechanical/electrical (and moral, even though Moore’s law does not work anymore and 2008-era desktop is not this abysmal in 2015) lifetime of the PCs themselves.

“Monkey Boy” must be getting pretty nervous - MSFT’s new manangement is about to do something
he could not imagine even in his wildest dream. His best “achievement” was reducing MSFT market
share in the world of mobile systems to laughable 3% out of thin air.

This is absolutely a true, and I think this person will contribute - together with that lady who was the CEO of the company making Barbie dolls - to the list of “great managers who finally ruined their businesses”.

Given the fact that WinPhone is so much technically superior to Android - this is even more laughable.

One of the major contributions to this moronity was, obviously, bad business-wise attitude to hardware makers. Google suggested them with better business/legal conditions, so they went with inferior Google’s OS.

Timeline is also important. Android is 3 years older.

Indeed, they seem to be introducing features of Windows Phone (i.e the system that failed
miserably, effectively losing the market almost completely)

It failed not due to technical reasons, but due to business reasons (MSFT’s style of making relations with hardware vendors, for instance).

Surface - as a single product - is not a failure at all. So are Nokias, especially given their cheap price (Apple do not make devices this cheap, and any Android phone for the same money will be a slow-performance disaster).

But… other HW vendors, one by one, turned their heads away from WinRT/WinPhone.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

Tim Roberts wrote:

I think the confusion here is that he uses the phrase “cross-signing
certificate” where I would have used the phrase “certificate that needs
to be cross-signed”. The important item is not the cross certificate,
the important item is the original code-signing certificate.

Are we confident that James Murray didn’t actually mean “cross-signing certificate”? :slight_smile:
The msdn blog post also says “valid cross-signing certificate”

http://blogs.msdn.com/b/windows_hardware_certification/archive/2015/04/01/driver-signing-changes-in-windows-10.aspx