I have compiled a VB6 app and I digitally sign it after compilation using a batch file containing this command:
signtool sign /f apt.pfx /p MyPassword d:\upload\service_pack_UK_BETA.exe
If I right-click the EXE I can see the digital signature in the file Properties. However if people download the file and try to run it in Windows 8 they get the message in SmartScreen that it's from an Unknown Publisher.
I have read articles such as this one http://social.msdn.microsoft.com/Forums/windows/en-US/00813d25-d258-40d8-b03a-c4468959f311/smartscreen-shows-unknown-publisher-even-though-signed-correctly-using-a-trusted-certificate?forum=winformssetup but the solution they recommend can't be achieved in VB6.
How can I sign the EXE so that SmartScreen will accept it?
See http://blogs.msdn.com/b/vsnetsetup/archive/2013/01/09/windows-smartscreen-prevented-an-unrecognized-app-from-running-running-this-app-might-put-your-pc-at-risk.aspx, specifically the last two sentences of the post
Once this is done, the SmartScreen will continue to warn about the application
until the certificate develops a reputation. But it would display a valid
publisher name instead of unknown publisher.
SmartScreen in Windows 8 maintains a list of valid and trusted publisher certificates (as well as whether the signed files are commonly encountered). When it encounters a new publisher certificate, even when the certificate chain is good and trusted, it won't be added to the list of trusted publishers until enough hits warrant it, what Microsoft calls SmartScreen Application Reputation.
Sources:
http://ie.microsoft.com/testdrive/Browser/DownloadReputation/?o=1
http://blogs.msdn.com/b/ie/archive/2011/03/22/smartscreen-174-application-reputation-building-reputation.aspx
http://blogs.msdn.com/b/ie/archive/2012/08/14/microsoft-smartscreen-amp-extended-validation-ev-code-signing-certificates.aspx (mentions SmartScreen Application Reputation)
Related
I am new to python. I managed to write my code for logging versions and generated executable using cx_freeze. It is working fine in my machine, but when I take it to other machines, I'm getting Windows smart screen error.
Any idea how to get rid of this?
Quick help required.
Thanks in advance.enter image description here
That is how SmartScreen works, it blocks "unpopular" executables. Depending on the system configuration the user might be able to click on "More Info" and run it anyway.
If enough people download and run your .exe then the SmartScreen block will go away. Microsoft does not specify how many downloads are required in their FAQ:
When you download a program from the Internet, SmartScreen Filter will check the program against a list of programs that are downloaded by a significant number of other Internet Explorer users and a list of programs that are known to be unsafe. If the program you're downloading isn't on either list, SmartScreen Filter will display a warning that the file isn't "commonly downloaded."
SmartScreen checks files that you download from the web against a list of reported malicious software sites and programs known to be unsafe. If it finds a match, SmartScreen will warn you that the download has been blocked for your safety. SmartScreen also checks the files that you download against a list of files that are well known and downloaded by many people who use Internet Explorer. If the file that you're downloading isn't on that list, SmartScreen will warn you.
Microsoft SmartScreen & Extended Validation (EV) Code Signing Certificates:
Code signing is important
to our reputation intelligence because this higher level identity allows us to build
reputation across multiple programs signed by a publisher. It is also important
for publishers because signed programs inherit the reputation of the certificate
with which they are signed; this means every program a publisher distributes doesn’t
need to build reputation individually.
...
Programs signed by an EV code signing certificate can immediately establish reputation
with SmartScreen reputation services even if no prior reputation exists for that
file or publisher.
Removing the "Mark of the Web" by unblocking it in the files properties should also prevent the SmartScreen message.
I understand the code signing.
But when I try to download some application, it doesn't even have code signing.
And it can still open without the Windows Defender blue screen.
Example: http://www.eainstall.com/download
How do I do that?
The Windows SmartScreen alert will go away after enough people download it.
If your software is not that popular then the warning will never go away and there is not much you can do about it.
SmartScreen checks files that you download from the web against a list of reported malicious software sites and programs known to be unsafe. If it finds a match, SmartScreen will warn you that the download has been blocked for your safety. SmartScreen also checks the files that you download against a list of files that are well known and downloaded by many people who use Internet Explorer. If the file that you're downloading isn't on that list, SmartScreen will warn you.
Microsoft SmartScreen & Extended Validation (EV) Code Signing Certificates:
Code signing is important
to our reputation intelligence because this higher level identity allows us to build
reputation across multiple programs signed by a publisher. It is also important
for publishers because signed programs inherit the reputation of the certificate
with which they are signed; this means every program a publisher distributes doesn’t
need to build reputation individually.
...
Programs signed by an EV code signing certificate can immediately establish reputation
with SmartScreen reputation services even if no prior reputation exists for that
file or publisher.
I have prepared my MSI package using the Advanced Installer and then signed it using the SignTool:
signtool sign /debug /f "cert.pfx" /fd SHA256
/p "<pass>" /t http://timestamp.comodoca.com/authenticode "<file.msi>"
But, when other user is downloading the signed MSI via web-browser and to install it, the next message occurs:
My MSI has the next attributes:
digital signature, which was generated with paid/commercial
certificate (Comodo)
timestamp
there was used SHA-256 instead of SHA-1, because the last one is insecure in latest Windows
So, the main question is the next:
Why doesn't Windows recognize my signed MSI as well-known, if I have signed it with the commercial code-signing certificate?
PS
If you're interested in, which the version of Windows is used, then answer is the latest Windows 10.
About last one option from list, there is an interesting link, I shall quote some text from it:
Effective January 1, 2016, Windows (version 7 and higher) and Windows
Server will no longer trust new code that is signed with a SHA-1 code
signing certificate for Mark-of-the-Web related scenarios (e.g. files
containing a digital signature) and that has been time-stamped with a
value greater than January 1, 2016. This cut-off date applies to the
code-signing certificate itself.
SmartScreen Protection can show the above message when you try to run a newly released program or an application that has not yet established a reputation.
Reputation is established by SmartScreen® service intelligence algorithms based on how an application is used by Windows and Internet Explorer users.
For details, check the passing the smart screen on Win8 when install a signed application? thread that debates this subject.
We offer a Windows program downloadable as an InstallShield EXE from our website.
When someone running IE9 attempts to download and run our software, they see the following message at the bottom of their screen:
PROGRAMNAME.exe is not commonly downloaded and could harm your computer.
[DELETE] [ACTIONS] [VIEW DOWNLOADS]
I've read http://blogs.msdn.com/b/ie/archive/2011/03/22/smartscreen-174-application-reputation-building-reputation.aspx
It suggests:
Digitally sign your programs with an
Authenticode signature.
Ensure downloads are not detected as
malware.
Apply for a Windows Logo.
We've done all three things. Our EXE is digitally signed with an authenticode signature (and the bar above the warning message is orange, not red, indicating that IE9 recognized and verified the signature). Our download is not detected as malware by any antivirus program we've tried. And we have applied for and received a Windows Logo.
As yet, most of our customers are not using IE 9. But this is very troublesome to those who do. Is there anything else we can do about this, or do we just have to wait until a critical mass of customers have downloaded this software before this message will go away?
(Does that mean when we release a new version, all IE 9 users will get this message again until enough of them have downloaded it?)
UPDATE 2011-06-14:
Thanks, #EricLaw-MSFT. URL is http://dakim.dakiminc.netdna-cdn.com/DakimBrainFitness.exe . (It's found on the "Download Free Trial" button on http://www.dakim.com .)
We've only been offering downloadable trials for a short while. Our primary distribution method is installation DVDs.
Extended Validation Code Signing Certificates don't suffer from the need to build reputation slowly according to this post:
Reputation is generated and assigned to digital certificates as well as specific files. Digital
certificates allow data to be aggregated and assigned to a single certificate rather than many
individual programs. Although not required, programs signed by an EV code signing certificate can immediately establish reputation with SmartScreen reputation services even if no prior reputation exists for that file or publisher. EV code signing certificates also have a unique identifier
which makes it easier to maintain reputation across certificate renewals. Only Authenticode
Certificates issued by a CA that is a member of the Windows Root Certificate Program can establish
reputation.
At this time, Symantec and DigiCert are offering EV code signing certificates.
In an effort to improve my answer, I've added a link to a similar question I asked and eventually answered myself.
I have made an application for Windows & everytime I run the application by opening the executable file I get the "Publisher Unverified" warning in Windows. It is fine if I was the only audience for this app but thats not the case. Is there any way to program my app such that this message does not show up for the users.
The only way to do this is to obtain and use a code signing certificate from a trusted source. Microsoft calls this Authenticode.
Unfortunately for the little guy, these cost. Verisign sells theirs for about four hundie a year.
Here are some starting points you should read about Authenticode:
http://msdn.microsoft.com/en-us/library/ms537359(VS.85).aspx
http://technet.microsoft.com/en-us/library/cc750035.aspx
http://msdn.microsoft.com/en-us/library/aa379872(VS.85).aspx
Some certificate dealers:
http://www.verisign.com
http://www.thawte.com
http://www.globalsign.net
http://www.geotrust.com
For a cheaper code signing certificate, you can use Comodo. There is a reseller called KSoftware which sells their certificates for $99/yr:
http://www.ksoftware.net/code_signing.html
I used them a few years ago and had no problems.
You can then use SignTool from the .net SDK to sign your EXE files. There is a tutorial here:
http://www.tech-pro.net/code-signing-for-developers.html
I think there is a way to resolve this. We need to add digital signature to the executables. The way to add digital signatures is very nicely outlined at,
http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/
http://blog.didierstevens.com/2008/12/31/howto-add-a-digital-signature-to-executables/
Basically we will use OpenSSL to create our own digital signatures and then use the SignTool application by Microsoft to add it to our executable.