Unsigned MBAM update executables

[blind12]

Are the MBAM update executables supposed to be digitally signed or not?

 

I don't know how much protection a signature adds.

But I kind of recall cases where program updates have been used to introduce a payload, like Finfisher in Firefox updates or something, so I try to keep an eye on at least executable update files. I'm sure Finfisher users have no issue adding any signature to anything of course but smaller players might.

 

And how well protected are other MBAM updates, like data files?

 

[blind12]

Oh and where's the "edit post" button...

[digmorcrusher]

I think you need 100 posts to edit, silly I know.

[1PW]

Hello blind12 and
 
For the highest possible level of integrity, please download only from Malwarebytes servers. Yes - mbam-setup-2.0.4.1028.exe is self signed by Malwarebyes Corporation plus VeriSign and countersigned by Symantec Time Stamping Services and Thawte Timestamping CA.
 
To add to that level of integrity, and prior to installation, you may also upload to VirusTotal.com and closely check the validity which should lead you only to:
 
https://www.virustotal.com/en/file/3bdbcf37ad6277f09d2ac9722bbae90e16ce83ac4c5c3cb7922c0fc4ae7b3662/analysis/1419025632/

 

AFAIK, and because MBAM database updates are not scripts nor executables, those updates are not able to be digitally signed in the identical manner as installer applications.
 
 
Due to the unfortunate past actions of a few, post editing of your topic has not been enabled yet in the IP.Board software that supports this forum.

Your ability to post edit will be automatically enabled when your member ranking elevates from Members to Honorary Members upon your 100th post.

Thank you.

[blind12]

AFAIK, and because MBAM database updates are not scripts nor executables, those updates are not able to be digitally signed in the identical manner as installer applications.

 

Hi 1PW, this isn't a database update this time, although I did also wonder how well database updates are verified.

 

It's a program version update and an executable, 2 executables in fact. A previously privileged, signed, 20,447,074-byte "mbam-setup.exe" matching the "mbam-setup-2.0.4.1028.exe" you posted above spawned an unsigned, 706,560-byte "mbam-setup.tmp"

 

https://www.virustotal.com/en/file/6c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a/analysis/

 

which then requested elevated privileges. And an unsigned executable requesting elevated privileges made me wonder.

[David H. Lipman]

If the installed has a Publisher's Certificate verifiable by the Certificate Authority (CA) then executable don't necessarily have to also have the Publisher's Certificate.

 

It is good that you are thinking about such subject matter !

[blind12]

But it does get attention as the unsigned executable was the only one that brought up the elevated privileges screen.

(I cancelled out and retried later and there was no UAC prompt the second time so the installation UAC prompts may vary).

[David H. Lipman]

UAC is PITA !