From f2710b1d2eb7a71082cdf3274bb2471c7d19a361 Mon Sep 17 00:00:00 2001
From: laurentiu021 <laurentiu021@users.noreply.github.com>
Date: Thu, 14 May 2026 10:16:37 +0300
Subject: [PATCH] fix: remove fabricated SHA-256 hashes from SpeedTestService
 (SEC-001)

Remove placeholder PinnedHashWin64/PinnedHashWin32 constants that never
matched real Ookla CLI downloads, causing perpetual warning logs and
alert fatigue. Real attacks were indistinguishable from normal operation.

Security now relies on:
1. Authenticode signature verification (checks Ookla subject in cert)
2. Zip structural integrity (must contain speedtest.exe)
3. SHA-256 logged for audit (but not compared against fake values)

Closes #308
---
 CHANGELOG.md                                      |  8 ++++++++
 .../SysManager/Services/SpeedTestService.cs       | 15 +++------------
 2 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b5197e8e..7596ffbc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,14 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.48.2] - 2026-05-14
+
+### Fixed
+- **Security: SpeedTestService** — remove fabricated placeholder SHA-256 hashes
+  that caused perpetual warning logs (alert fatigue). Security now relies on
+  Authenticode signature verification of the extracted binary + zip structural
+  integrity check (SEC-001).
+
 ## [0.53.1] - 2026-05-14
 
 ### Fixed
diff --git a/SysManager/SysManager/Services/SpeedTestService.cs b/SysManager/SysManager/Services/SpeedTestService.cs
index e9cb4523..c178ec07 100644
--- a/SysManager/SysManager/Services/SpeedTestService.cs
+++ b/SysManager/SysManager/Services/SpeedTestService.cs
@@ -292,24 +292,15 @@ private static async Task<string> EnsureOoklaAsync(
             await resp.Content.CopyToAsync(fs, ct);
         }
 
-        // SEC-002: Verify download integrity with pinned SHA-256 hashes.
-        // Ookla CLI 1.2.0 hashes from verified downloads (2024-01).
-        const string PinnedHashWin64 = "2B17ADAC8F0B0F7C9B3D1F5E6A8C4D2E9F1B3A5C7D9E1F3A5B7C9D1E3F5A7B9C";
-        const string PinnedHashWin32 = "4D6E8F1A3B5C7D9E2F4A6B8C1D3E5F7A9B2C4D6E8F1A3B5C7D9E2F4A6B8C1D3E";
+        // Log download integrity info for audit (SHA-256 of the zip).
+        // Security relies on Authenticode signature verification of the
+        // extracted binary, not on pinned hashes (which break on Ookla updates).
         await Task.Run(() =>
         {
             var hash = Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(zipPath)));
             Log.Information("Ookla CLI downloaded: {Url}, SHA256={Hash}, Size={Size}",
                 zipUrl, hash, new FileInfo(zipPath).Length);
 
-            var expectedHash = arch == "win64" ? PinnedHashWin64 : PinnedHashWin32;
-            if (!string.Equals(hash, expectedHash, StringComparison.OrdinalIgnoreCase))
-            {
-                Log.Warning("Ookla CLI hash mismatch! Expected={Expected}, Got={Got}", expectedHash, hash);
-                // Don't block — hash may change with minor Ookla updates.
-                // Log warning but allow if zip is structurally valid.
-            }
-
             // Structural integrity check: must be a valid zip with speedtest.exe
             try
             {