AIR does not validate installed files against signature?
27 08 2009
While doing some security tests to an AIR application I'm currently developing, I stumbled over a strange behaviour. In the AIR documentation, Adobe says:
That - at least I thought so - means: if any of the installed files of an application gets modified or removed, the AIR framework will prevent the application from being run. But it doesn't. I modified some JS file of my application, added some alerts and the application just executes fine and also displays those "illegal" alerts. Removing some installation files doesn't seem to make AIR care about, too. Even if I remove the signatures.xml file from the application's META-INF directory, which holds all file signatures, AIR just feels fine and executes my application without any note.
Now I am wondering why modifications to the installation files have no effect on what AIR does with the application. Does this validation only work on "proper" certified files and validation will be skipped if the application if signed with a self-signed certificate? Hope anyone has an idea about this? I'll try to contact Adobe to get some information about this topic.
Each AIR application is signed, and an installed application cannot run if any files in the installed application directory do not match the application’s signature.
That - at least I thought so - means: if any of the installed files of an application gets modified or removed, the AIR framework will prevent the application from being run. But it doesn't. I modified some JS file of my application, added some alerts and the application just executes fine and also displays those "illegal" alerts. Removing some installation files doesn't seem to make AIR care about, too. Even if I remove the signatures.xml file from the application's META-INF directory, which holds all file signatures, AIR just feels fine and executes my application without any note.
Now I am wondering why modifications to the installation files have no effect on what AIR does with the application. Does this validation only work on "proper" certified files and validation will be skipped if the application if signed with a self-signed certificate? Hope anyone has an idea about this? I'll try to contact Adobe to get some information about this topic.
Written by Sebastian Bauer
Comments : No comments »
Categories : Adobe® AIR™
Trackbacks : No Trackbacks »






Tracked: Aug 27, 15:10