There is a new feature in the upcoming major Windows 11 24H2 update that I've not seen a
lot of people talk about. It has to do with the properties window for all file types. And
while some people might think this is not too interesting, I think it is. So the first part
of this change is that now, if you go into any file, it will always show that Digital Signatures
tab in the properties window. Before, it would only show if there was a digital signature. I'll
explain why it's important in a second. I made a video about digital signatures before, if you want
to go back and watch it. But now, in addition to always showing it regardless of whether there's a
signature or not, there's a second new block below for catalog type signatures. And the embedded
signatures one at the top is just what it showed before. So the bottom thing is new. And actually,
believe it or not, these catalog signatures are something I just learned about after seeing this
new feature and wondering what this new section in this properties window is all about. So I
looked it up and that's what I'm going to talk about. It's pretty... it's important to know,
I would say, not critical. You're not going to see these quite as often as regular signature,
but it's still good to know about if you do come across it. Like I mentioned before, I did make a
video talking about the importance of knowing how to recognize a signed file in general. So this is
usually going to be in the case of like EXEs or executables of several kinds, whether it's an MSI
installer or PowerShell script. If you go to the digital signatures tab and it shows one of these
and you click on the details for it, and it says that the signature is okay, that means it's signed
by a trusted code signing certificate. And it's probably in all likelihood safe. But the thing is
you can only sign certain types of files, like the ones I mentioned, here's a whole list. But that's
actually where I was wrong. See, you can only sign these types for an embedded signature type,
like to sign directly, but you can actually sign files apparently, as I learned, using
this other catalog signature method, and it is just as valid. And this new feature is important
because before it would not show you at all if it was signed by a catalog using the other method,
whereas now you can actually see it. And a lot of times you'll see this for like driver files, where
for example, it might come as a driver package with several files, like the EXE installer,
but also maybe an INF file, which also contains driver info. So if you look at that, for example,
and right click, now you go to the properties, digital signatures, it'll actually show it as part
of a signed catalog. Whereas before it would just show as completely unsigned. Now, in any case,
you do still need to actually check the details of the signature, whether it's the embedded
signature like before, or a new catalog signature, because it is possible to have a signature that is
not trusted. For example, I made this one "Hacker Inc" signed, and that says that it is not verified
because it's one that I made up and did not add to the certificate store in Windows to be trusted. So
don't just see that there's a signature there and automatically assume that it's safe. I really wish
it had some kind of symbol more readily visible when you just look at the tab, not having to
double click in, but still. Now, at this point you're probably wondering, wait a minute, what the
heck is a catalog file that you're talking about anyway? So I can explain that. Before getting to
that though, something that you should never have to wonder about is whether you're about
to be scammed. And you won't have to, thanks to a very interesting free new service from today's
sponsor, Bitdefender. They've got a new AI scam detector called Scamio in the form of a chatbot.
You can provide it with anything, including suspicious emails, links, texts, screenshots,
or even just describing the situation and it will analyze it. For example, let's say I'm selling
something online and the person "accidentally" sends me way too much money and asks me to send
it back. Right away, Scamio tells me it's a common scamming tactic and even describes how it works.
Or here's an example of a scam text message like many of us get, and I can literally attach it to
a message and it will analyze it. And yep, again, it talks about how it is a common
scamming tactic. Or you could even send it a link like this one from a text someone on Reddit got,
and after checking it, it does tell me it does contain known phishing elements. You can chat with
Scamio either on Bitdefender's website or through Facebook Messenger, and now even on WhatsApp too,
by adding it to your WhatsApp list. You can just scan this QR code if you want to do that. Also,
Scamio now supports multiple languages, English, French, German, Italian, and Spanish. And again,
it's totally free. To use it, you just need to create a free Bitdefender account. With
criminals constantly coming up with new scamming techniques, even using AI themselves, Scamio is a
great way to stay ahead of scammers and spot scams you haven't heard of before. So visit the link in
the description or go to scamio.bitdefender.com and try it out for yourself. It's really cool.
And with all that being said, let's continue. Alright, so now onto what exactly a catalog file
is. A catalog file is one that will have a .cat extension and it will have this type of icon.
It's like a bundle of papers. And what a catalog file does, whether it's signed or not, it doesn't
have to be necessarily signed for it to exist, is that it contains only a list of files. It only
contains information about files. It's not like an archive that contains compressed files or stored
files or like a zip file or anything like that. And also do not confuse it with a cabinet file,
which is another type of archive. A catalog file simply stores information about a file or multiple
files in the form of hashes. So that basically is a unique identifier of a file. Theoretically,
if you run a hash algorithm on a file, then even if you changed one single character within that
file, it should have a completely different hash. So having a hash of a file is a good way to make
sure that it has not been changed. And then the idea is you create this catalog file of
whatever files you want. Maybe it's all the files in some kind of driver package and you store all
the hashes of them. So if someone goes to download that or goes to install them, then Windows will
check the catalog file and say, "Okay, yep. All these files are unchanged. So I can go ahead."
Whereas if it was corrupted, it would not match and probably fail. And also for security purposes,
you can sign the catalog file as a whole directly. And then that signature will apply to all of the
files mentioned in that catalog file. So that's how you can actually sign other types of files
that normally can't be signed directly with a catalog file. If you double click on a catalog
file and open it up, it'll show you information about the catalog file itself, like its hash,
and then also the files contained within it and their hashes. They're called tags in this case,
but they're the hashes. And from what I've seen, it might contain either just an SHA-1 or also an
SHA-256 hash. SHA-256 is the newer one. It's really what everyone should be using at this
point, but I guess for whatever reason, some companies, maybe it's an older driver, still
use SHA-1. Anyway, you'll see these listed and you might see multiple tags for each. That's why,
it's different hashing algorithms. You might also see it mentioned a thumbprint elsewhere. That's
the same thing as a hash. Again, it seems to have a lot of names. However, I will point out that
to get that catalog signature to actually show up in the properties window, it's a little bit
different than a usual embedded signature. With an embedded signature, you put the signature right in
the file itself, so it's right there. But with a catalog signature, the signature is totally
separate. So if you just create a catalog file referencing some file, and then sign that catalog,
it's not going to show that signature in the original file in the properties, because Windows
only looks for catalog signatures in a specific place in the installation directory for Windows
called the Catroot, catalog root. So specifically this is located in C:\Windows\System32\Catroot,
and there's also Catroot2. And I think Catroot2 is just specific for like Windows update purposes,
but for the most part, Catroot is the main one. Anyway, within Catroot, there are two
folders. One of them is apparently for Windows components. That's the one starting with F750.
And then one that's apparently for third-party catalogs. That one starts with 127D. And for me,
there was nothing in there originally, I just added a bunch for myself for testing. Now to
be clear, these catalog files, if you create one, like for integrity purposes, it doesn't need to go
into the catalog root. That's only if you want it to be able to show as a signature anywhere on the
system, because that's where it looks for them. Anyway, so how it works is you create a catalog
for some files. There's just a PowerShell command that looks like this for that. And
then you sign that catalog file directly with an embedded signature, copy it to the catalog root,
and then anywhere on the system, it will then show that catalog signature in the properties window.
And apparently any type of file can be signed via catalog. I even created one "test3.blah" and added
that to a catalog and signed it, put it in the catalog root, and that indeed was recognized as
a signature. Also, apparently it recognizes the signature, even if the original file is renamed.
So I had a file "Test Text File.txt", and I renamed it to "Test Text File Renamed.txt2".
So I changed the extension as well, and it still shows that signature as being valid. So it must
go purely based off the hash. Now there is an additional use for this new feature. Actually,
I think this worked before, you just couldn't see it. And that is if you're like an IT professional,
you work as a sysadmin or something, and you have AppLocker or Windows Defender application control
rules on systems, you can actually use catalog files and they will be just as valid as embedded
signatures. AppLocker is basically a Windows feature in Windows Pro and higher that lets you
restrict Windows to only running specifically whitelisted or Allow-listed files. It's pretty
advanced though, most people are not going to want to deal with that. Anyway, for example,
I have AppLocker rules that only allows the computer to run signed PowerShell scripts. I
would do the same thing for batch files, but you can't sign a batch file. So for those,
if I wanted to run them, I would have to manually go in and create a hash rule,
allowing that through AppLocker. But what I realized is I can now create a catalog file
with the batch file referenced in it, sign that, put it in the catalog store, and then I don't
have to clutter up all my AppLocker rules, each with a new thing, allowing certain files. Anyway,
so just a cool little new feature. If you go into the properties window for any file
and you notice that there's a digital signatures tab there, where you wouldn't have expected it,
that's why. So let me know what you think of this down in the comments. Is this something
you're going to even care about? Or maybe you're going to use it every day. Who knows? We can talk
about that down there. Thanks again to Bitdefender for sponsoring, and be sure to check out their new
free scam detector chatbot called Scamio by clicking the link in the description. If you
enjoyed the video, give it a big giant thumbs up for the YouTube algorithm. And if you want
to keep watching, I'll put a link to that video where I was talking about digital signatures on
EXE files and stuff and how to recognize them. It's pretty important to know about. You can
click on that right there. So thanks so much for watching and I'll see you in the next one.