Temporary files created during install process signed with caphyon sign

[juan.01]

Hi Catalin,

They have added the certificate in the Trusted editors certificate list in windows MMC console at the local system level. The problem I think is that there are some temporaly files that are not signed.

I have developed a C# program to monitor C:\Windows\Installer and write a log about files created during installer an show if they are signed. It seems that there are some files whitch are not signed. I don't have the files because they are deleted after installation.

Code: Select all

C:\Windows\Installer\MSI3FED.tmp ---> 
C:\Windows\Installer\MSI3F5F.tmp ---> CN=Caphyon SRL, OU=SECURE APPLICATION DEVELOPMENT, O=Caphyon SRL, L=Craiova, S=Dolj, C=RO
C:\Windows\Installer\MSI87DF.tmp ---> CN=Caphyon SRL, OU=SECURE APPLICATION DEVELOPMENT, O=Caphyon SRL, L=Craiova, S=Dolj, C=RO
C:\Windows\Installer\MSI3934.tmp ---> CN=Caphyon SRL, OU=SECURE APPLICATION DEVELOPMENT, O=Caphyon SRL, L=Craiova, S=Dolj, C=RO
C:\Windows\Installer\MSI36C2.tmp ---> CN=Caphyon SRL, OU=SECURE APPLICATION DEVELOPMENT, O=Caphyon SRL, L=Craiova, S=Dolj, C=RO
C:\Windows\Installer\{E4B55FA4-92BB-4E86-A0DA-C9AEC82290F0}\Installer.exe ---> 
C:\Windows\Installer\MSI13D1.tmp ---> CN=Caphyon SRL, OU=SECURE APPLICATION DEVELOPMENT, O=Caphyon SRL, L=Craiova, S=Dolj, C=RO
C:\Windows\Installer\MSI14FC.tmp ---> CN=Caphyon SRL, OU=SECURE APPLICATION DEVELOPMENT, O=Caphyon SRL, L=Craiova, S=Dolj, C=RO
C:\Windows\Installer\MSI146E.tmp ---> 
C:\Windows\Installer\MSI3588.tmp ---> CN=Sociedad Española de Electromedicina y Calidad S.A
C:\Windows\Installer\MSI340F.tmp ---> CN=Caphyon SRL, OU=SECURE APPLICATION DEVELOPMENT, O=Caphyon SRL, L=Craiova, S=Dolj, C=RO
C:\Windows\Installer\MSI3683.tmp ---> 
C:\Windows\Installer\inprogressinstallinfo.ipi ---> 
C:\Windows\Installer\MSI3567.tmp ---> 

Please, try to reinstall LogService, I think that the temporary files are different when installing for first time or reinstalling.

With regards,

[Catalin]

Hello Juan,

This is quite strange.

I have neabled that Code Integrity feature on my machine and after testing the setups, here are my conclusions:

- if I do not add the caphyon certificate to the config file of the policy, then the setups indeed fail

- if I do not add your certificate there, then the setup fails to start at all

- if both certificates are added, everything works as expected - install and uninstall

Both the certificates were added using the "Add-SignerRule" PowerShell cmdlet.

Could you please check with your customer to make sure they have done the same?

Additionally, is there any way in which you can configure your C# program to copy the files that are not signed outside of the C:\Windows\Installer folder before they are removed?

Best regards,
Catalin

[juan.01]

Could you please check with your customer to make sure they have done the same?

I will check it with our custommer and see how they have configured the certificate. Thanks so much for your notes.

Additionally, is there any way in which you can configure your C# program to copy the files that are not signed outside of the C:\Windows\Installer folder before they are removed?

I have already try and the program copies some of the files but not all because the creation and deletion is very fast. If I block the file to copy the installer will fail. But if it's neccessary I can try anoter time to copy all of them.

With regards,

[juan.01]

Could you please check with your customer to make sure they have done the same?

Good morning Catalin, could you please explain more about the code Integrity feauture? Where you have to configure it and how do you check if the certificate is added correctly to the policicy file that you have mentioned?

I need more details about it to check if our customer system is correctly configured.

With regards,
Juan

[Catalin]

Hello Juan,

Unfortunately, I had to rely on third party blogs as I could not find anything from Microsoft, like a clear how-to.

Despite that, I was succesfull in my attempts and even wanted to create a how-to regarding this feature when I got more free time on my hands.

I will do my best to explain this feature.

Code Integrity (or Device Guard) allows system administrators to customize kernel-mode and user-mode, code integrity checks using Configurable Code Integrity (CCI).

This policy is located as it follows:

- open Local Group Policy Editor (WIN+R --> type "gpedit.msc" without quotes)

- "Administrative Templates" --> "System" --> "Device Guard" --> "Deploy Windows Defender Application Control"

If you double click on that, you will see that it expects a "Code Integrity Policy file path". This is like a configuration file that we need to configure before.

In this configuration file, which previously was an XML file and then converted to a BIN file, we should add the certificate. To do so:

- we need to get the XML that was then converted to the BIN file

- the certificate is added with a PowerShell CMDLET as it follows:

Code: Select all

Add-SignerRule -FilePath C:\MyCIPolicy\MyDEFAULT_CIPolicy.xml -CertificatePath C:\MyCertificates\ContosoDGSigningCert.cer -Kernel -User -Update

- we then have to reconvert the XML to a BIN and then add it to the policy

To be fully honest with you, since you mentioned your customers don't have much knowledge on this subject, most likely they have a SysAdmin that configured this. I'd advise contacting the SysAdmin and he/she may be able to further assist on this matter.

Hope it helps!

Best regards,
Catalin

[juan.01]

Thanks so much for your help with this.
I supose they have a SysAdmin to configure this, but I think this will help to clarify the process because sometimes it seems that they don't have this windows feature so clear...

I'll post if they say that everthing is now working properly

With regards,
Juan

[Catalin]

You're always welcome, Juan!

Hope everything will work as expected now.

Best regards,
Catalin