Skip to content

fix: remove fabricated SHA-256 hashes from SpeedTestService (SEC-001) #349

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
laurentiu021 merged 1 commit into from
May 14, 2026
Merged

fix: remove fabricated SHA-256 hashes from SpeedTestService (SEC-001) #349

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,14 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

## [0.48.2] - 2026-05-14

### Fixed
- **Security: SpeedTestService** — remove fabricated placeholder SHA-256 hashes
that caused perpetual warning logs (alert fatigue). Security now relies on
Authenticode signature verification of the extracted binary + zip structural
integrity check (SEC-001).

## [0.53.1] - 2026-05-14

### Fixed
Expand Down
15 changes: 3 additions & 12 deletions SysManager/SysManager/Services/SpeedTestService.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,24 +292,15 @@ private static async Task<string> EnsureOoklaAsync(
await resp.Content.CopyToAsync(fs, ct);
}

// SEC-002: Verify download integrity with pinned SHA-256 hashes.
// Ookla CLI 1.2.0 hashes from verified downloads (2024-01).
const string PinnedHashWin64 = "2B17ADAC8F0B0F7C9B3D1F5E6A8C4D2E9F1B3A5C7D9E1F3A5B7C9D1E3F5A7B9C";
const string PinnedHashWin32 = "4D6E8F1A3B5C7D9E2F4A6B8C1D3E5F7A9B2C4D6E8F1A3B5C7D9E2F4A6B8C1D3E";
// Log download integrity info for audit (SHA-256 of the zip).
// Security relies on Authenticode signature verification of the
// extracted binary, not on pinned hashes (which break on Ookla updates).
await Task.Run(() =>
{
var hash = Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(zipPath)));
Log.Information("Ookla CLI downloaded: {Url}, SHA256={Hash}, Size={Size}",
zipUrl, hash, new FileInfo(zipPath).Length);

var expectedHash = arch == "win64" ? PinnedHashWin64 : PinnedHashWin32;
if (!string.Equals(hash, expectedHash, StringComparison.OrdinalIgnoreCase))
{
Log.Warning("Ookla CLI hash mismatch! Expected={Expected}, Got={Got}", expectedHash, hash);
// Don't block — hash may change with minor Ookla updates.
// Log warning but allow if zip is structurally valid.
}

// Structural integrity check: must be a valid zip with speedtest.exe
try
{
Expand Down
Loading