Signing certificates stolen in data breach - what are the risks?

Question

Created Jan ’23

Replies 4

Boosts 1

Views 1.9k

Participants 3

Hi there, thanks in advance for the help.

Two of my code signing certificates (Installer & Developer ID) and an app-specific password were part of a data breach of a CI platform. I have revoked the app-specific password.

As I understand it, the risk is that someone in control of a private key and certificate can sign code in my name, which would be detrimental to my reputation as a developer. I was wary of handing over my certificate and private key to the platform, so I created 2 new certificate and private key pairs (Developer ID & Developer ID Installer) for use on the platform. So far, none of my software has been signed with these certificates. All software currently in distribution has been signed with certificates that I have kept offline.

Do I need to revoke all my certificates or just those that were breached? What risks am I exposed to currently?

Thank you.

Answer 1

DTS Engineer OP

Apple

Jan ’23

We have specific about this on the Developer website. See the Compromised certificates section of Developer > Support > Certificates.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Answer 2

AdamVenn OP

Jan ’23

Thank you, but they actually sent me here when I asked the above question.

Answer 3

DTS Engineer OP

Apple

Jan ’23

Hey hey!

So, lemme explain this from a DTS perspective. The T in DTS stands for Technical, so we try to stay focused on the technical aspect of things. If you ask me a technical security question, I’m happy to answer that. So, if you ask “Can an attacker monitor the traffic on a pipe between a parent and child process?” I’ll say “No. [1]” OTOH, I steer well clear of folks asking big picture security questions, like “Is this product design security?” or “Is this business process secure?” DTS isn’t qualified or authorised to answer such questions.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] With caveats, of course (-:

Answer 4

MohabSign OP

Oct ’24

This is very dangerous as it can lead others to use it in fraud (scamming), it should be revoked immediately from your developer account interface!

This will also give you warnings on your account which will eventually ban your company from ever getting an account