Vault 7: Projects
This publication series is about specific projects related to the Vault 7 main publication.
Projects based on HID, MSD, audio class, CCID:
These USB device classes/projects rely on Microsoft supplied drivers
that are distributed with the operating system, and do not require any user supplied driver packages or .inf files. Therefore,
driver package signing is usually not relevant for these types of applications, as the drivers will normally get installed
automatically when the hardware is attached to the machine.
1.7.5.5 Obtaining a Microsoft Authenticode Code Signing
Certificate
Obtaining a Microsoft Authenticode Code Signing Certificate
There are several Certificate Authority (CA) companies that can sell your organization a signing certificate that will allow you
to sign your own driver packages. However, when submitting a driver package to Microsoft for WHQL certification, either as
a new device/driver, or by reusing a previous submission through the “Driver Update Acceptable” (DUA) process, Microsoft
currently requires that the submitted files be signed with an authenticode signing certificate issued by VeriSign.
Therefore, it is generally preferred to obtain the Microsoft Authenticode code signing certificate from VeriSign (now a part of
Symantec Corporation). Before purchasing the certificate, it is recommended to search for possible promotional/discounted
rates. Historically Microsoft has run a program providing for discounted prices for first time purchasers of VeriSign
certificates.
Authenticode code signing certificates are usually sold on an annual or multi-year basis. Once purchased, the signing
certificate can normally be used to sign an unlimited number of driver package security catalog files (ex: .cat files), along with
other types of files (ex: .exe executable programs). The certificate itself (ex: typically a .pvk file, though other extensions are
possible) needs to be kept physically secure, and should never be distributed publicly.
1.7.5.6 Code Signing Certificates (Other Uses)
Code Signing Certificates – Other Uses
In addition to signing driver packages, a Microsoft Authenticode signing certificate can be used to sign certain other types of
files, such as executable (.exe) programs. Windows, especially Windows 8, does not trust unsigned executables as much as
signed executables. In Windows 8, an unsigned executable that has “no history” and has no reputation established with
Microsoft will be treated as relatively untrustworthy, and is blocked from execution, unless the user manually overrides the
OS behavior, through an advanced options dialogue that is typically hard for new users to find.
Additionally, some virus scanning applications also rely on executable signatures, to help establish relative trustworthiness.
In some cases, unsigned executables, free of malware/viruses, can still be blocked from execution by the virus scanning
software, until a history/reputation is built up establishing the executable as trustworthy. Signing the executable with a
Microsoft Authenticode signing certificate will generally make the executable more trustworthy and less likely to be
(incorrectly) flagged as malware.
1.7.5.7 Using a Code Signing Certificate to Sign Driver Packages
Using a Code Signing Certificate to Sign Driver Packages
1.7 Appendix (FAQs, Important MLA - USB Library Help Driver Signing and Windows 8
298
Protego_Release_01_05-Related-OEM-Documentation-MLA_v2013_12_20-help_mla_usb.pdf