Code signing
Signing software so that users and systems can verify who published it and that it has not changed since. Its value depends on protecting the signing key, often in an HSM or by using short-lived keyless certificates, and on verifiers requiring the expected signer rather than any valid signature.
Covered in
Verify artifact signatures against an explicit trust policy
Require the expected artifact, signer and release context before allowing a signed package or image to proceed.
Case study: the SolarWinds Orion build compromise (SUNBURST)
How an implant on SolarWinds' build server inserted the SUNBURST backdoor into signed Orion updates in 2020, how it was found, why code signing and review could not catch it, and which build controls would have.
Flame: MD5 certificate forgery
Follow how a weak digest and an overpowered certificate trust path enabled forged code-signing authority, without equating the event with RSA key theft.
Case study: the 3CX DesktopApp supply-chain attack (CVE-2023-29059)
How a trojanized trading application on one employee's personal computer led to 3CX's build servers and to signed, malicious 3CX DesktopApp releases in 2023: the first cascading software supply-chain compromise Mandiant had seen, how EDR caught it, and the controls that would have stopped it.
Practice: Signed artifact provenance lab: Reject a release from the wrong producer · Local project: Build and verify a signed software release