Friday, September 28, 2012

Adobe signature system was compromised

Adobe just published an article "Inappropriate Use of Adobe Code Signing Certificate" describing the inappropriate use of their code signature private key.

Adobe uses a Hardware Security Module (HSM) to store the private key. The signature requests are sent by build servers and signed by the HSM.

Unfortunately one build server has been compromised and malicious software has been signed.

Lessons

Maybe the lesson is that automatic code signing, without human verification, is an error. Of course the human verification shall be smart enough to avoid repetitive and boring tasks.

In general smart card doing cryptographic signature with a legal value (eID or citizen cards) are configured so that the user PIN has to be entered before each signature. And the use of a pinpad reader is a big security improvement. So even if the user computer is compromised the attacker cannot sign many documents without the user noticing something wrong.
But:
  • only one signed document may be enough for the attacker
  • noticing something is wrong requests some user intelligence

Conclusion

The best security architects can do is:
  • provide systems simple to understand
  • provide some kind of detection of strange events
  • provide a way to easily revoke a compromised key

Tuesday, September 18, 2012

Tokend installer for Mac OS X Mountain Lion

2 months after the release of Mountain Lion, Apple (Shawn Gedddis) just released a new (beta) tokend package installer for Mountain Lion (10.8).

From http://smartcardservices.macosforge.org/trac/wiki/installers

« This installs the Tokend modules which no longer ship from Apple as part of Mac OS X beginning with OS X Lion (v10.7). Note that this installer will ONLY install onto OS X Mountain Lion v10.8. The Tokend modules installed are: BELPIC, CAC, CACNG, JPKI and PIV.

New to this release:
JPKI.Tokend - Build 38522 added to the update to support LASCOM in Japan.
cacloginconfig.plist - Default configuration file as optional install for those using Attribute Matching or PKINIT configurations.
SystemCACertificates.keychain - Automatically added to the Keychain Search List if not already present. »

Related post "Mac OS X Mountain Lion and smart card status".