Why is signing drivers such a mess?

NTDEV
6

xxxxx@gmail.com wrote:

  1. Since this forum is riddled with posts about driver signing is it time to open a new forum for it?

Since the answer is always the same, it hardly needs its own forum. The
answer is to follow this simple procedure:

  1. Read the driver-signing white paper
  2. Read the driver-signing white paper
  3. Try to understand the driver-signing white paper
  4. Do exactly what it says in the driver signing white paper
  5. Read the driver-signing white paper
  6. Do EXACTLY what it says in the driver signing white paper
7

For a second there I thought you were being serious.

8

> For a second there I thought you were being serious.

As I said earlier on this thread, all your questions are perfectly reasonable…

The problem is that you just asked all your questions in the wrong place. This is why you got such treatment. Never mind - after all, when you go to some religious sect’s website and start questioning the teachings of their gurus/leaders, what kind of replies would you expect to get from the followers, no matter how ridiculous these teachings are from “non-follower’s” perspective??? Therefore, you’ve got nothing to worry about…

Anton Bassov

9

wrote in message news:xxxxx@ntdev…

[snip]
> For example, drivers can be distributed not as executable PE images in
> “ready-to-run” form but as sets of binary sections derived from
> .pre-compiled OBJ files with a linker script describing them, so that
> linking a driver into a final executable image can take place on the
> target machine as a part of driver installation process.

Do you describe the IL and ngen? then wait a little for .NET based kernel…

> In order to ensure that package does not get altered by some third party
> on its way to the target machine it can get signed with a randomly
> generated by building environment private key and decrypted by the
> installer with its corresponding public key embedded into the package (
> i.e. “either decrypt with this particular key or you are guaranteed to get
> a heap of binary rubbish out of this package”)
>

“Sealing” the code is not hard, the hard problem is the proof of origin

> These final images can be signed with a unique key specific to a given
> installation (i.e. the one derived from a product key that is stored in
> the registry and is supposed to be unique) by a linker, indicating that
> the final executable image got linked precisely on the target machine.

Sure, and exactly in this way “serious” users can sign 3rd party drivers
with their own cert which they trust, and remove
all these new CAs installed by Windows Update.
If you are individual developer working for such “serious” customer, they
can just take your driver as is, and do the chores themselves.

>
> As you can see, kernel may be made to load only those drivers that got
> installed upon Admin user’s decision without any problem mentioned by the
> OP anywhere in sight…

Amen.
–pa

>
>
> Anton Bassov
>

10

> Do you describe the IL and ngen? then wait a little for .NET based kernel…

Actually, I got the main idea of what I had described from the Linux kernel that fails insmod() in case of symbol mismatch. In practice it means that if you want to distribute a module that somehow relies upon GPLed kernel exports (i.e. something that the vast majority of modules do, although there are some rare exceptions like NVIDIA drivers) and make it work everywhere you have to provide it as a bunch of source files with Makefile so that it can get built against currently running kernel version during installation process.

I just adjusted this idea to Windows specifics. Once Windows is not an open-source system the requirement of providing drivers as .c source files does not apply, for understandable reasons. However, the idea in itself seems to be valid even under Windows - it just requires some modifications…

“Sealing” the code is not hard, the hard problem is the proof of origin

Actually, I am not sure that the concept of " proof of origin" is of so vital importance to drivers, in the first place - it seems to be applicable more to web applications that rely upon ActiveX components, Java applets and other UM plugins that you are prompted to install on every other webpage if you want to take the full advantage of its contents… However, KM driver is a relatively “rare beast” that comes either as a part of a very specific product that requires a full-fledged setup, or as a piece of a malware that gets installed without user’s knowledge .

Therefore, I think the main security-related questions with drivers are more of “Does the user know about its very existence” and “Has it been modified/replaced after installation”, rather than “Who wrote it”…

Anton Bassov

11

The US has an excess of lawyers. The proof of origin allows the vultures
someone to sue.

wrote in message news:xxxxx@ntdev…
>> Do you describe the IL and ngen? then wait a little for .NET based
>> kernel…
>
> Actually, I got the main idea of what I had described from the Linux
> kernel that fails insmod() in case of symbol mismatch. In practice it
> means that if you want to distribute a module that somehow relies upon
> GPLed kernel exports (i.e. something that the vast majority of modules do,
> although there are some rare exceptions like NVIDIA drivers) and make it
> work everywhere you have to provide it as a bunch of source files with
> Makefile so that it can get built against currently running kernel version
> during installation process.
>
> I just adjusted this idea to Windows specifics. Once Windows is not an
> open-source system the requirement of providing drivers as .c source files
> does not apply, for understandable reasons. However, the idea in itself
> seems to be valid even under Windows - it just requires some
> modifications…
>
>> “Sealing” the code is not hard, the hard problem is the proof of origin
>
> Actually, I am not sure that the concept of " proof of origin" is of so
> vital importance to drivers, in the first place - it seems to be
> applicable more to web applications that rely upon ActiveX components,
> Java applets and other UM plugins that you are prompted to install on
> every other webpage if you want to take the full advantage of its
> contents… However, KM driver is a relatively “rare beast” that comes
> either as a part of a very specific product that requires a full-fledged
> setup, or as a piece of a malware that gets installed without user’s
> knowledge .
>
> Therefore, I think the main security-related questions with drivers are
> more of “Does the user know about its very existence” and “Has it been
> modified/replaced after installation”, rather than “Who wrote it”…
>
>
> Anton Bassov
>
>
>

12

I think it was very nice for Jan Bottorff to take all the time that such a complete answer obviously took to write. His answer is clear, complete, and correct.

Now, we can debate whether “hobby” developers should be excluded from being able to supply drivers to their communities of interest (as the currently are with the driver signing program). I think it’s a shame that they are, personally.

I’d LOVE to see a “we’ll sign your drivers for a few bucks” type company emerge. I’ve even heard rumblings of one such company being organized (nothing to do with OSR, by the way). I think such a company would provide a valuable service to numerous hobby-oriented communities.

Peter
OSR

13

> I’d LOVE to see a “we’ll sign your drivers for a few bucks” type company emerge.

How a company like is supposed to get its key to sign code??? Will VeriSign or any other signing authority issue a key for a company that makes money by signing code to anyone who wishes to pay few dollars , without assuming any legal liability for damages that code signed with its key may do??? After all, it just defeats the very purpose of code signing, in the first place…

However, if what you had mentioned in your post, indeed, becomes true, if will be just a wonderful practical explanation of why the very concept of driver signing (at least in its currently existing form) is fundamentally flawed in itself…

Anton Bassov

14

>

> I’d LOVE to see a “we’ll sign your drivers for a few bucks” type
company
> emerge.

How a company like is supposed to get its key to sign code??? Will
VeriSign
or any other signing authority issue a key for a company that makes
money by
signing code to anyone who wishes to pay few dollars , without
assuming any
legal liability for damages that code signed with its key may do???
After
all, it just defeats the very purpose of code signing, in the first
place…

However, if what you had mentioned in your post, indeed, becomes true,
if will
be just a wonderful practical explanation of why the very concept of
driver
signing (at least in its currently existing form) is fundamentally
flawed in
itself…

I think that the practice itself would be okay, as long as everyone
understands that if even 1 single malicious binary is ever signed
with that key, that key could be revoked, with obvious consequences to
everything else signed with that key.

It will be interesting to see what happens when 64 bit operating systems
starts to outnumber 32 bit operating systems on PC’s and become a
worthwhile target for rootkit style malware… I’ve said before that I
think the bad guys will just find a backdoor that doesn’t require
signing if they want to badly enough, but it remains to be seen if this
is the case or not…

James

15

> as long as everyone understands that if even 1 single malicious binary is ever signed with

that key, that key could be revoked, with obvious consequences to everything else signed with that key.

As long as someone understands the above, he will immediately understand its implications and imagines the ensuing mess that he is more than likely to deal with, regardless of his role in the scheme- no matter if you happen to be a code writer, a signing authority or an “intermediate” company that signs someone else’s code with its key, the whole thing is just bound to cause you a lot of pain in the neck, in the back
and below . …

Anton Bassov

16

>

> as long as everyone understands that if even 1 single malicious
binary is
> ever signed with
> that key, that key could be revoked, with obvious consequences to
everything
> else signed with that key.

As long as someone understands the above, he will immediately
understand its
implications and imagines the ensuing mess that he is more than
likely to
deal with, regardless of his role in the scheme- no matter if you
happen to be
a code writer, a signing authority or an “intermediate” company that
signs
someone else’s code with its key, the whole thing is just bound to
cause you a
lot of pain in the neck, in the back
and below . …

… which was my point :slight_smile: Easier just to purchase a proper key.

James

17

a proper key? the infrastructure is not cryptographically sound. ask
any one at microsoft, they’ll go umm ahhh.

just my personal crypto experience.

brucee

On 1/4/10, James Harper wrote:
> >
> > > as long as everyone understands that if even 1 single malicious
> binary is
> > > ever signed with
> > > that key, that key could be revoked, with obvious consequences to
> everything
> > > else signed with that key.
> >
> > As long as someone understands the above, he will immediately
> understand its
> > implications and imagines the ensuing mess that he is more than
> likely to
> > deal with, regardless of his role in the scheme- no matter if you
> happen to be
> > a code writer, a signing authority or an “intermediate” company that
> signs
> > someone else’s code with its key, the whole thing is just bound to
> cause you a
> > lot of pain in the neck, in the back
> > and below . …
> >
>
> … which was my point :slight_smile: Easier just to purchase a proper key.
>
> James
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>

18

Verisign doesn’t care WHY, but WHO you are. You must be a business via one
of several ways to acquire that, and of course you must be willing to part
with 800 schekels for the class 3 code signing certificate. I’ve paid for
that certificate twice, and the ONLY contact I have with Veri-sign from the
time the certificate is delivered, was for them to tell me they wanted more
schekels when the certificate was about to expire. Not once did Verisign
EVER asked why or for what I intended to use the ceretificate.

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.net

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Sunday, January 03, 2010 11:38 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Why is signing drivers such a mess?

I’d LOVE to see a “we’ll sign your drivers for a few bucks” type company
emerge.

How a company like is supposed to get its key to sign code??? Will
VeriSign or any other signing authority issue a key for a company that makes
money by signing code to anyone who wishes to pay few dollars , without
assuming any legal liability for damages that code signed with its key may
do??? After all, it just defeats the very purpose of code signing, in the
first place…

However, if what you had mentioned in your post, indeed, becomes true, if
will be just a wonderful practical explanation of why the very concept of
driver signing (at least in its currently existing form) is fundamentally
flawed in itself…

Anton Bassov

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus signature
database 4743 (20100104) __________

The message was checked by ESET Smart Security.

http://www.eset.com

__________ Information from ESET Smart Security, version of virus signature
database 4743 (20100104) __________

The message was checked by ESET Smart Security.

http://www.eset.com

19

xxxxx@gmail.com wrote:

Driver signing is the most complex and expensive addition to hit drivers since I have been writing them for 20 years. I am unsure why it has to be this way.

In retrospect, I don’t think this situation is any more complicated than
any of the other learning curves we climb to get a driver out into the
public. There is a large amount of boilerplate in the recipe, but once
you get the recipe right, it just works from then on.

Answers to any of these questions might help me understand this situation:

  1. Why are there different classes of certificates for driver developers? For instance, why can’t the VeriSign organization certificate be used for code signing or a GlobalSign code signing certificate be used for winqual?

Partly, this is so certificate vendors can generate profit. The
certificate specification (and there IS a spec) does define a large
number of different “certificate uses”. The usage codes are embedded in
the certificate. This goes with the “perceived value” principle; some
usages are perceived as being more valuable than other usages, so the
capitalist principle is that you should pay more.

There IS some overlap. You can get a single VeriSign certificate that
does code signing AND works for Winqual. Neither VeriSign nor Winqual
are particularly interested in reducing your cost of business.

  1. Why are we absolutely required to do business with VeriSign for logo? What would happen if they went out of business?

This is probably historical. Winqual has had the certificate
requirement for a very very long time, and when they started, there
really were no other alternatives. No one of importance has ever
complained seriously about it, so there has been no incentive to
change. After all, the $99 certificate is a relatively minor cost,
compared to the cost of submitting driver packages. The onesy-twosy
shops are not the important people. The important people are the Dells
and HPs of the world, who submit dozens or hundreds of driver packages
throughout the year.

  1. Why are certificates forced to expire every 1-3 years. Why can’t we just buy one that lasts forever?

Because people (and companies) move. The fundamental purpose for driver
signing is to provide a reliable path for lawyers to find you when your
driver causes damage. VeriSign is not going to promise that you can
still be reached at the address you signed up with 8 years ago.

  1. Why are certificates so expensive? And why is it an annual fee based rather than a single setup fee? How much work does VeriSign do year 2 compared to year 1?

Capitalism. You and I both know that the incremental cost of a
certificate is nearly nil. They do 10 minutes of automated background
checking by looking at your Dun & Bradstreet database record, and that’s
pretty much it.

  1. Why is so much red tape necessary to get a certificate issued? It is impractical to get a certificate for some mobile, internet based consultants who need to meet physical presence tests for somewhere they have barely stayed or won’t be there much longer anyway.

And those are exactly the people who should not be getting certificates,
because they can’t be reached when liability issues arise.

As disgusting and disappointing as it may be, the Windows world of today
is not like the Wild West MS-DOS world of 1987, where virtually all of
the good stuff came from one-off shareware authors doing it for the
fun. Today, what we have is much more like the mainframe world of
1975. PCs are now corporate mission-critical. Rogue kernel code can
cause millions of dollars of damage to a company. If you want to submit
your driver into that world, you need to be willing to submit to a fair
amount of scrutiny. That’s just the way it is.

  1. Why is signing the driver not part of the build tool? I modified mine by hand that everytime I press build it pops out a perfectly release signed driver, even for checked builds. I and my customers agree this has every advantage and no disdavantage.

I’m not sure what you mean. You can certainly add a “signtool” call to
your sources/makefile setup so that it runs when you call “build”.
There don’t happen to be any samples that show this, but that doesn’t
mean it’s “not part of the build tool”.

  1. Why aren’t individuals allowed to write drivers anymore? They are prohibited from obtaining a certificate and thus barred from access to new Windows systems.

Liability. Individuals are inherently less reachable than corporations
when subpeona time rolls around.

  1. Since this forum is riddled with posts about driver signing is it time to open a new forum for it?

I don’t think so. Like most driver questions, once you climb over the
learning curve hump, this becomes a non-issue.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

20

James Harper wrote:

It will be interesting to see what happens when 64 bit operating systems
starts to outnumber 32 bit operating systems on PC’s

This seems to be happening.

The last few days I was looking for netbooks. To my surprise some
companies pre-install 64bit versions of Windows on some of them.

21

NOT for a hobby developer, who would the main target of such an enterprise… and for whom the idea of “if one piece of software is determined to be malware the signature winds up on the CRL” isn’t such a big deal.

His customers, each having paid zero to a few dollars for the software, come back to him and say “your stuff doesn’t work” – to which he answers “oh, darn! You’re right. Sorry. Disable driver signature enforcement and reboot” or whatever, until he gets his NEXT signature from SigsRus.com

Peter
OSR

22

At least for the hobbyist, are there alternatives to the $400/year VeriSign
ID? I’d pay $50/year (the cost of some alternative certificate authorities)
but for the 0.1 drivers per year I write these days, I cannot justify the
high costs of the VeriSign certificate.

There was some talk at earlier driver conferences about alternate
certificate authorities being approved, but I have not heard anything about
whether this went through.
joe

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@osr.com
Sent: Monday, January 04, 2010 2:52 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Why is signing drivers such a mess?

NOT for a hobby developer, who would the main target of such an
enterprise… and for whom the idea of “if one piece of software is
determined to be malware the signature winds up on the CRL” isn’t such a big
deal.

His customers, each having paid zero to a few dollars for the software, come
back to him and say “your stuff doesn’t work” – to which he answers “oh,
darn! You’re right. Sorry. Disable driver signature enforcement and
reboot” or whatever, until he gets his NEXT signature from SigsRus.com

Peter
OSR

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

–
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

23

> OT for a hobby developer, who would the main target of such an enterprise…

I just wonder if the company that signs his code will be forced to assume liability for it …

Let’s face it - the vast majority of malware in existence is produced exactly by developers of the type you have mentioned, and if someone who signs his code is not forced to assume liability for it, the very idea of code signing loses any practical meaning…

His customers, each having paid zero to a few dollars for the software,

Well, I think the vast majority of his “customers” would not mind paying more than few dollars to ensure that his “production” never gets installed on their PCs…

Anton Bassov

24

“forced” by whom? Stalin’s been dead a long time, dude…

As far as *I* know, the only thing that could happen to the company signing the driver is that MSFT will revoke the cert. Oh well!

Whatever. But the vast majority of companies that would want this service don’t produce malware. They produce drivers for tiny markets, in their spare time, for the sheer joy of assisting the community of which they are a part. Or something.

The company doing the signing will probably WANT to do some minimal amount of due diligence, just to avoid having to keep getting new certs. But, whatever.

Nobody HAS to install a driver signed by “WeSignUrShitForTenEuros.com” – It’s entirely up to the user. Like I said… whatever.

It’d be a damn-sight better than hobby devs not be able to have people use their stuff AT ALL without disabling driver signing completely.

Peter
OSR

25

> “forced” by whom?

By the court, apparently…

Look -the very idea behind code signing is to make it possible to trace code originator in case if it turns out to be malicious. Therefore, if you sign a piece of software with your key and then it turns out that this particular piece of software, say, steals credit card numbers, it will be you who gets summoned to court, because it is signed with your key, and, hence, for the time being you are treated as its originator. What I meant in my previous post is whether you will be kept liable for everything that code signed with your key does, or whether you will be allowed just to shrug it off like “I don’t know anything - I sign anything for anyone who pays me few dollars for it”. In the latter case the whole idea of code signing does not seem to be particularly meaningful, don’t you think…

Stalin’s been dead a long time, dude…

Where is Mr. Kyler - I bet he is going to love it…

Nobody HAS to install a driver signed by “WeSignUrShitForTenEuros.com”

IIRC, malware never had a reputation of asking users whether they want to install it…

Anton Bassov