Closed MelbourneDeveloper closed 5 years ago
Does it work on Windows 10? Thanks!
Yes, USBPcap since release 1.2.0.3 contains Attestation Signed driver which works on Windows 10.
The way to "sort out the certificate problem to satiate Windows 10's desire for certainty" is to get a fiscal sponsor which would take donations for a project and then obtain EV Code Signing certificate. This certificate is immediately trusted by SmartScreen. Unfortunately it is unavailable for individual developers. Registering an organization in my country just to get through this is way too much legal burden for me. Maybe there are countries where registering the organization wouldn't take as much time/money, so a single individual can manage it in his free time (solely to obtain the certificate and sign official releases from time to time).
I tried applying to Software For Public Interest and Software Freedom Conservancy. Unfortunately didn't succeed. However, there's a possibility that these organizations might be interested in the future - the project would need to change from "single hero" to "multiple contributors". This is something where I need contributions from others.
The list of places where contributions are most needed:
@desowin thankyou very much for the detailed reply.
This really does pose a major problem for your software and other pieces of software that may want to do the same thing. Is there a reason that normal code signing won't do the trick? Is it because your software calls APIs that are deemed too volatile by the operating system?
I don't know how really this "gaining SmartScreen reputation" works. The 1.2.0.4 will be released next week, signed both with SHA1 and SHA256 (Certum fixed the bug in their ProCertum Software which made it possible only to have one cert on the card at the same time - which was the reason for previous release being SHA1 only). So if that's going to help, only time will tell.
It doesn't matter what API you call.
You need kernel mode certificate for the driver and for Windows 10 driver you need to do Attestation Signing (possible only with EV Code Signig). Hopefully my employer allows me to do the attestation sining of USBPcap using company certificate, so it's not as hopeless as it might look like.
But sure, the hassle related to certificates (they are quite expensive) is in my opinion the biggest demotivation factor for individuals like me doing Windows OSS software.
I have absolutely no idea why Windows 10 marks USBPcap 1.2.0.4 as Trojan:Win32/Spursint.F!cl. The only possibility would be that I installed infected NSIS or that it is a false positive.
I have submitted the file to Avast whitelisting, I hope there isn't any malware that slipped onto my build machine.
I have submitted the installer to Windows Defender Security Intelligence.
Submitted the installer to Antiy-AVL false positive reporting email.
I have received reply from Windows Defender Security Intelligence that they have reviewed the file and removed the detection.
Fantastic!
@desowin sorry for not being more vocal but I'm stoked about this. My library is https://github.com/MelbourneDeveloper/Hid.Net . I wanted to use your library to reverse engineer USB transfer and this is going to be great. Thanks for doing this.
I have a bunch of other hardwarewallet libraries based on hid.net so I will be able figure out a lot more once I can trace the transfer.
Thanks!
What's preventing you from using it? The red SmartScreen warning is supposed to go away once "enough" people download the installer and click the "run anyway" option. What some websites suggest is that every download that doesn't click the "run anyway" is essentially setting it further away from the goal of "gaining reputation".
The fact that they removed the detection refers to the fact that Windows defender simply removed the file as soon as it was downloaded. That was really harsh. Now it's back to just the red warning.
The red SmartScreen is just unfair, you can google a lot about smaller software publishers getting hit by it. The only solution I found online is to tell users to click the "run anyway" button...
The benefit of the installer being signed is the fact that afer you click the more information the "Run Anyway" button appears on the bottom. Installers that are not signed do not have this luxury.
No wonder why some call this an extortion scheme... https://serverfault.com/questions/389109/why-is-there-a-difference-in-the-prices-of-code-signing-certificates
There is option to report the download as safe in the Internet Explorer. The method is described in https://www.ctrl.blog/entry/how-to-false-smartscreen-positive
If you would like to help, please download USBPcap installer from the official website, and then right click on the downloaded file (in IE downloads list) and select "Report that this download is safe". I have checked that this option is available in Windows 7, 8.1 and 10. I hope if enough people do this, SmartScreen will finally stop this false reporting.
Symantec Endpoint Protection does similar "reputation" checking as SmartScreen, but unlike SmartScreen it doesn't claim that it's malware. Thus such kind of check can be done in a not so completely unfair way as SmartScreen.
All the false positives have now been resolved, and the 1.2.0.4 installer is no longer triggered by any scanner on virtustotal
Fixed!!!!
There is no reason to suspect that this app is malware especially considering that it is open source, and the installer is digitally signed. Yet, Windows 10 gives you an ugly red Malware warning when you try to install. The certificate is issued by Certum. The signer is Tomasz. Is there any way to sort out the certificate problem to satiate Windows 10's desire for certainty?
This screen gives me the heebie jeebies: https://www.dropbox.com/s/cs1jpri7jjflyc9/Malware.png?dl=0