AIR does not validate installed files against signature?

27 08 2009
While doing some security tests to an AIR application I'm currently developing, I stumbled over a strange behaviour. In the AIR documentation, Adobe says:
Each AIR application is signed, and an installed application cannot run if any files in the installed application directory do not match the application’s signature.


That - at least I thought so - means: if any of the installed files of an application gets modified or removed, the AIR framework will prevent the application from being run. But it doesn't. I modified some JS file of my application, added some alerts and the application just executes fine and also displays those "illegal" alerts. Removing some installation files doesn't seem to make AIR care about, too. Even if I remove the signatures.xml file from the application's META-INF directory, which holds all file signatures, AIR just feels fine and executes my application without any note.

Now I am wondering why modifications to the installation files have no effect on what AIR does with the application. Does this validation only work on "proper" certified files and validation will be skipped if the application if signed with a self-signed certificate? Hope anyone has an idea about this? I'll try to contact Adobe to get some information about this topic.

Bookmark AIR does not validate installed files against signature?  at del.icio.us Digg AIR does not validate installed files against signature? Mixx AIR does not validate installed files against signature? Bloglines AIR does not validate installed files against signature? Technorati AIR does not validate installed files against signature? Bookmark AIR does not validate installed files against signature?  at Furl.net Bookmark AIR does not validate installed files against signature?  at blogmarks Bookmark AIR does not validate installed files against signature?  at Ma.gnolia.com wong it! Stumble It!

Trackbacks


27 08 2009
PingBack
Weblog: www.adobelearn.com
Tracked: Aug 27, 15:10

Comments

Display comments as (Linear | Threaded)
No comments

Add Comment


Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.
E-Mail addresses will not be displayed and will only be used for E-Mail notifications

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA