2017-09-05 18:02 GMT+05:00 Samuli Seppänen <[email protected]>:
> On 05/09/2017 14:30, Илья Шипицин wrote:
> >
> >
> > 2017-09-05 12:15 GMT+05:00 Samuli Seppänen <[email protected]
> > <mailto:[email protected]>>:
> >
> > On 04/09/2017 16:32, Igor Bozovic wrote:
> > > Hello,
> > >
> > > I downloaded openvpn-install-2.4.3-I602.exe from
> > > https://openvpn.net/index.php/open-source/downloads.html
> > <https://openvpn.net/index.php/open-source/downloads.html> and
> uploaded
> > > the file to https://www.virustotal.com.
> > >
> > > Baidu and TrendMicro-HouseCall reported a virus:
> > > https://www.virustotal.com/#/file/f722ff1d187951c4e7454e2d845ba6
> d0d43d505112e073fa60b67b350fd6bc87/detection
> > <https://www.virustotal.com/#/file/f722ff1d187951c4e7454e2d845ba6
> d0d43d505112e073fa60b67b350fd6bc87/detection>
> > >
> > > I used gpg to check the file integrity:
> > >
> > > --------------------
> > > gpg -v --verify openvpn-install-2.4.3-I602.exe.asc
> > > gpg: armor header: Version: GnuPG v1
> > > gpg: assuming signed data in `openvpn-install-2.4.3-I602.exe'
> > > gpg: Signature made петак, 14. јул 2017. (this means Friday, 14th
> July)
> > > 15:28:49 CEST using RSA key ID 8CC2B034
> > > gpg: using subkey 8CC2B034 instead of primary key 2F2B01E7
> > > gpg: using PGP trust model
> > > gpg: Good signature from "OpenVPN - Security Mailing List
> > > <[email protected] <mailto:[email protected]>
> > <mailto:[email protected] <mailto:[email protected]>>>"
> > > gpg: WARNING: This key is not certified with a trusted signature!
> > > gpg: There is no indication that the signature belongs to
> the
> > > owner.
> > > Primary key fingerprint: F554 A368 7412 CFFE BDEF E0A3 12F5 F7B4
> 2F2B 01E7
> > > Subkey fingerprint: B596 06E2 D8C6 E10B 80BE 2B31 D72A F344
> 8CC2 B034
> > > gpg: binary signature, digest algorithm SHA1
> > > --------------------
> > >
> > > I assume it's a false positive, but I would appreciate if you could
> > > confirm this. I guess that the exe file could be infected at
> compile time.
> >
> >
> > recently we (I work in private company in Russia) were contacted by
> > GlobalSign CA, they want to sell us digital certificates.
> >
> > they state that if we will buy EV codesign cert, so SmartScreen filter
> > will automatically "whitelist" our software.
> >
> > @mattock, am I right, openvpn binaries are signed with codesign EV
> already ?
> >
>
> No. Only the tap-windows6 driver has been signed with an EV certificate.
> Everything else has been signed with a "normal" AuthentiCode certificate.
>
> In our case EV signing is done with a special dongle. The dongle
> integrates with Windows Certificate Store, but I've been told that it
> has a built-in failure counter. Afaik if the fail count exceed the
> dongle will be bricked, or at least disabled,. As such, the dongle is
> not particularly well suited for automation like that used in
> openvpn-build.
>
well, I hope that we will issue codesign EV for ourselves, I will test it
with whitelisting and tell you
>
> Samuli
>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
