Fax Customer Signed with airSlate SignNow

Incorporate zip code certificate

good afternoon everybody welcome to the second day of our technical Trek some folks filtering in here today to talk about code signing certificates and specifically the application of code signing to non executable files so I think it's something that a lot of folks haven't seen too much of we have some really good examples of attackers using this in a while so I'm very very I'm the technical director on our advanced practices team we've seen a lot of my colleagues on the team brief so far this week I hope you guys have enjoyed some of those talks real quick show of hands how many folks are assist peas in the crowd just be certified see a few ok so you should be able to explain this next slide to everybody so PKI this is the standard diagram that you're going to get in your sis pea textbook on PKI it's very obtuse does not make a lot of sense I'm kind of assuming for the rest of this talk that folks have like a passing familiarity with PKI basically pki is the standard by which you can have two hosts or two pieces of data that did not know anything about each other verify something about each other that's the thousand foot view specifically the PKI implementations that most folks in here will be familiar with are tls/ssl and code signing so SSL is probably the one that most folks look at on a daily basis what you're looking at here is a public key of a certificate pair and this is this one is specifically used to sign a file so the standard that defines what this looks like is x.509 and if i'm losing you guys there's gonna be a lot of standards in the first ten minutes but trust me it's worth it so what you're seeing here is the top portion of a public x.509 certificate this is the this contains the public key for the cryptographic cryptographic pair for a code signing very similar to what you're going to see SSL certificate some of the key differences between what you're gonna see for code signing verse SSL is things like extended key usage S&I is something you'll see an SSL that you will not see an x.509 certificate for code signing so there's a lot of different implementations but at this at its core is the same standard so what you're seeing here is a serial number issuer subject validity date these are all metadata on the code signing pair in this case the public certificate that are really useful for threat intelligence purposes and we'll talk a little bit about a few of these so for code signing if folks aren't familiar the most popular implementation the vast majority of signed binaries are using Microsoft authentic code this is Microsoft standard for code signing for portable executables in Windows if folks are more familiar with SSL there's a few key...