Aurena agent security issue

Hi @Mathias Dahl ,

Can we consider this as a bug in the aurena agent? 

Thanks & Best Regards,

Nipun

Hi,

As of now, we're only signing the MSI package which the exe file is included in. Right now I cannot say if it would be more "correct" to also sign the exe file before it is packaged into the MSI.

Can you verify that the MSI used to install the agent is signed? The latest version should be.
 

As an extra data point, I checked some of the standard exe files that are included in Windows. Some were not signed (Notepad, Cmd, PowerShell), some where (Explorer). Not sure if this is relevant or not though…

Yes I think it’s a signed one. Although when we add Url to the installation process, it says it’s installed successfully. But the local path is not set at user settings

Hi,

Firstly, in case you decide to file a case about the signing, the agent is part of the client framework and supported by their support teams.

Although when we add Url to the installation process, it says it’s installed successfully. But the local path is not set at user settings

Did you follow the steps in trouble shooting guide in our tech docs?

Also, make sure to reload any open web browser tab where you want to use the agent, after it has been installed.

So their Security Restriction Policies basically removes the exe file, or stops Windows from executing it then. That is something the installer would never know is happening, I think.

I have started a discussion internally about if we should also sign the exe file, or not. If you like you can file a support case about it already now.