Signed updates and threat definitions: trusting only what we published
Why an attacker who controls the network, a mirror or even a download server still cannot push code or definitions to a TotalHeal device.
Why updates are a target
Security software runs with high privileges and updates itself many times a day. That makes its update channel one of the most valuable targets on a computer. Supply-chain attacks against software updaters are among the most damaging incidents of the last decade.
Application updates
TotalHeal’s update metadata is signed with separate keys for separate roles — root, targets, snapshot and timestamp — and the metadata expires on a schedule. Together this means:
- An update is installed only if it was signed by the right key for its role.
- Anti-rollback: an attacker cannot replay an old, vulnerable version as if it were new.
- Anti-freeze: an attacker cannot quietly keep a device on stale updates, because expired metadata is refused.
Threat definitions
Threat definitions are signed with an Ed25519 key whose public half is pinned in the app. A definitions file is used only if its signature, its size and its SHA-256 hash all match. A tampered or truncated file is rejected and the previous definitions stay in use.
Licences
The app reads a signed licence document and runs only the protection modules that licence covers, so a device carries no code it is not licensed for.