Signing and verifing an application

Question

Hi
We have an application contained in a jar file. We need to sign the application so that user can be sure that the application has not been modified maliciously. This is a standard desktop application which will be run on a desktop pc. We sign our jar file with jarsigner and keytool to test it. when it works correctly we buy a "Sun Java Signing Digital ID" from www.verisign.com!
but now i have the problem that i need to check the jar if it's verified on every startup as first! It's to check if nobody has changed classes in the jar to avoid the registration, for example! how can i check on the startup if the jar is verified? must i run a special method in the security manager?
THANKS!

Answer 1

It makes no sense to verify the application with some code inside the application itself.
When the app is patched with malicious code, the code for verifying may be manipulated too.That is true. There is no guaranteed way except to have a secure application loader on the system already.
but it makes it difficulter for criminal persons, when
we check if the classes has been verifyed and check if
the sign is the right! if somebody wants to crack a
application and he is good, he can crack every
application(see winXP ;-)) but we can make it as
difficult as possible for the cracker! when the
complexity is bigger than the costs, most of the
cracker wount crack the application! it is impossible
to secure your application completely!I certainly understand the concern and I have read a fair amount on code signing and other security concerns, but frankly I wonder how ubiquitous this problem really is. Does this type of thing really happen?
There is already a built-in diffculty for a hacker to do this. Bob, the hacker, cannot just take any arbitrary data stream and inject or replace data into it except for the purposes of corrupting the stream to the point of making it not usable. Of course, Bob could simply replace the entire stream with his own application if he knows that the stream is an application originally (if it's an image, it makes no sense, as I'm not going to "execute" an image file, nor the OS, as it's going to open it based on file extension). So the only way for Bob to do anything useful is to first get a copy of the application, then decompile it and or profile it to see what it is and how it works and then spent time figuring out how he can change it to actually get it to do anything except not work.
There is a generally better way to handle this: MD5 or SHA digests for the application package. If you go to get any open source application these days (anything from Apache, as an example), you can get an MD5 sum for it to check against what to download. Of course, the user has to do this, but such is life.