Signature file with software download?

[gerrogg]

Why is there no signature file to accompany a download please?

[alvarnell]

Are you asking about downloading the app or the malware definitions?

[gerrogg]

The app itself, however, I didn't consider the definitions.

[David H. Lipman]

What do you mean "signature file" ?

A file can be digitally signed and that's by applying a Digital Certificate embedded in the file as a Publisher's Certificate.  An application can be digitally signed by embedding a Publisher's Certificate in the executable.

There are no accompanying signature files.  Anti malware signature files are not signed.  Other than signing an executable some documents like a PDF can be digitally signed.

[gerrogg]

I mean like when I download Tails, it comes with a signature file to verify the binaries.

[alvarnell]

The app is signed with a valid Apple Developer ID which can be checked using RB App Checker Lite:

Evaluating the application “Malwarebytes”.

The application was signed by “Apple Root CA”, “Developer ID Application: Malwarebytes Corporation (GVZRY6KDKR)”.
    The (unverified) signing-time is: Dec 7, 2018 at 4:21:32 AM.
    The object code format is “app bundle with Mach-O thin (x86_64)”.
    The signature contains the Team ID “GVZRY6KDKR”.
    Both bundle and signing identifiers are “com.malwarebytes.mbam.frontend.launcher”.
    The signature specifies explicit requirements. 
        The requirements specify the Team ID “GVZRY6KDKR”.
            This matches the Team ID contained in the signature.
    The signature specifies resource rules (v1). 
    The signature specifies resource rules (v2). 
    Gatekeeper assessment: PASS (Developer ID). 
    Requirements and resources validate correctly.

The code signature has the UUID “4A35FB14-76C7-51BA-0786-1EB99E369243”.
    Executable code for x86_64 has the UUID “A95E705C-4318-3926-935C-233110D9710E”.

A signing-time snapshot of the application’s Info.plist was found. 
    Version 3.6 (3.6.21.2055) Copyright © 2018 Malwarebytes. All rights reserved.

The signature contains 3 certificates. 
    Certificate “Apple Root CA”: 
        Your keychain contains this trusted root certificate.
        Will expire on Feb 9, 2035.
    Certificate “Developer ID Certification Authority”: 
        Will expire on Feb 1, 2027.
    Certificate “Developer ID Application: Malwarebytes Corporation (GVZRY6KDKR)”: 
        Will expire on Apr 19, 2022.
        SHA1 fingerprint: “707A109F12B9A504136DC5933D12234A0824B7FD”.
        Team ID or Organizational Unit: “GVZRY6KDKR”.
            This matches the Team ID contained in the signature.

The application is probably from an authorized Apple Developer.

The application is not sandboxed.

The code signature contains entitlements. 
    Other entitlements:
        com.apple.security.get-task-allow: YES.

No auxiliary executables have been found.

or WhatsYourSign

[David H. Lipman]

I don't know what "Tails" is but...

You verify the binaries by their checksum and by their Digital Signature if they are signed.  The OS goes through an Online Certificate Status Protocol ( OCSP ) server that verifies its status such is if the Certificate was revoked.

For example here is a windows based Malwarebytes file.  What it shows in the file and its Properties which shows a Digital signatures Tab and the Certificates assigned to the binary.

This shows expanded information of the certificate...

 

This shows the Certificate Path from the Certificate Authority ( CA )  to the Publisher ( Malwarebytes ).

 

Now you can see how Apple does an apple Development ID and how a Publisher's Certificate is used to authenticate the Authenticity and "trust" of an application.

 

 

Edited January 25, 2019 by David H. Lipman

[alvarnell]

26 minutes ago, gerrogg said:

I mean like when I download Tails, it comes with a signature file to verify the binaries.

That approach is rarely used these days with the advocation of macOS Gatekeeper protection. Assuming you still have Gatekeeper enabled, Gatekeeper will scan the downloaded Malwarebytes-Mac-x.x.x.x.pkg file and notify you if it is not properly signed. 

If the Malwarebytes web site were hacked and a fake .pkg file were substituted that was validly signed by a malware developer (which has happened on a couple of other sites in the past) they would undoubtedly post a fake hash to match, if Malwarebytes were ever to implement such a system in the future. Apple would need to revoke that developerID and Malwarebytes would need to remove the malware and patch the means by which they were hacked. So having a hash signature would be of little or no use to you.

[treed]

Just to add to what has already been said, for instructions on how to validate the integrity of the installer and the software, see:

https://support.malwarebytes.com/docs/DOC-1994

Once installed, Malwarebytes for Mac does its own internal validity checks as well, and will alert you if it has been modified.

[gerrogg]

Thanks everybody, good info.