Systems and methods for validating application signatures

1. A computer-implemented method for validating application signatures, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

maintaining a signature-validation database that associates application publishers with signature keys by, for each application in a set of applications:

identifying a key used to sign the application;

determining that the application claims to be provided by a publisher;

verifying that the claimed publisher provides the application;

in response to verifying that the claimed publisher provides the application, maintaining an association that indicates that the publisher of the application is authorized to use the key;

querying the signature-validation database to determine whether a particular publisher claimed by an unverified application is associated with a key used to sign the unverified application;

determining, based on a response from the signature-validation database, that the particular publisher is not associated with the key used to sign the unverified application;

concluding, based on the determination that the particular publisher is not associated with the key used to sign the unverified application, that a signature of the unverified application is not legitimate.

2. The computer-implemented method of claim 1 , wherein querying the signature-validation database to determine whether the particular publisher claimed by the unverified application is associated with the key used to sign the unverified application comprises:

identifying the application that has the signature that has not been verified;

determining that the unverified application claims to be provided by the particular publisher.

3. The computer-implemented method of claim 1 , further comprising, upon concluding that the signature of the unverified application is not legitimate, performing a security action.

4. The computer-implemented method of claim 1 , wherein identifying the key used to sign the application comprises identifying a digital signature that was created with the key.

5. The computer-implemented method of claim 1 , wherein determining that the application claims to be provided by the publisher comprises determining that the application appears to claim a domain name owned by the publisher.

6. The computer-implemented method of claim 5 , wherein determining that the application appears to claim the domain name comprises identifying the domain name within the application.

7. The computer-implemented method of claim 1 , wherein verifying that the claimed publisher provides the application comprises determining that the application is available for download from the publisher.

8. The computer-implemented method of claim 1 , wherein verifying that the claimed publisher provides the application comprises determining, based on reputation data of the application that indicates that the application is trusted, that the application is legitimate.

9. The computer-implemented method of claim 1 , wherein maintaining the association that indicates that the publisher of the application is authorized to use the key comprises maintaining an association between a certificate created by the key and the publisher.

10. A system for validating application signatures, the system comprising:

an identification module identifies a key used to sign an application;

a determination module that determines that the application claims to be provided by a publisher;

a verification module that verifies that the claimed publisher provides the application;

an association module that, in response to verifying that the claimed publisher provides the application, creates an association that indicates that the publisher of the application is authorized to use the key;

a signature-validation database that stores the association between the publisher of the application and the key;

a querying module that queries the signature-validation database to determine whether a particular publisher claimed by an unverified application is associated with a key used to sign the unverified application;

an association module that determines, based on a response from the signature-validation database, that the particular publisher is not associated with the key used to sign the unverified application;

a conclusion module that concludes, based on the determination that the particular publisher is not associated with the key used to sign the unverified application, that a signature of the unverified application is not legitimate;

at least one processor configured to execute the association module, the identification module, the determination module, the verification module, the querying module, the association module, and the conclusion module.

11. The system of claim 10 , wherein the querying module queries the signature-validation database to determine whether the particular publisher claimed by the unverified application is associated with a key used to sign the unverified application by:

identifying the application that has the signature that has not been verified;

determining that the unverified application claims to be provided by the particular publisher.

12. The system of claim 10 , further comprising a security module that, upon concluding that the signature of the unverified application is not legitimate, performs a security action.

13. The system of claim 10 , wherein the identification module identifies the key used to sign the application by identifying a digital signature that was created with the key.

14. The system of claim 10 , wherein the determination module determines that the application claims to be provided by the publisher by determining that the application appears to claim a domain name owned by the publisher.

15. The system of claim 14 , wherein the determination module determines that the application appears to claim the domain name by identifying the domain name within the application.

16. The system of claim 10 , wherein the verification module verifies that the claimed publisher provides the application by determining that the application is available for download from the publisher.

17. The system of claim 10 , wherein the verification module verifies that the claimed publisher provides the application by determining, based on reputation data of the application that indicates that the application is trusted, that the application is legitimate.

18. The system of claim 10 , wherein the association module maintains the association that indicates that the publisher of the application is authorized to use the key by maintaining an association between a certificate created by the key and the publisher.

19. A non-transitory computer-readable-storage medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

maintain a signature-validation database that associates application publishers with signature keys by, for each application in a set of applications:

identifying a key used to sign the application;

determining that the application claims to be provided by a publisher;

verifying that the claimed publisher provides the application;

maintaining, in response to verifying that the claimed publisher provides the application, an association that indicates that the publisher of the application is authorized to use the key;

query the signature-validation database to determine whether a particular publisher claimed by an unverified application is associated with a key used to sign the unverified application;

determine, based on a response from the signature-validation database, that the particular publisher is not associated with the key used to sign the unverified application;

conclude, based on the determination that the particular publisher is not associated with the key used to sign the unverified application, that a signature of the unverified application is not legitimate.

20. The non-transitory computer-readable-storage medium of claim 19 , wherein the one or more computer-readable instructions, when executed by the processor, cause the computing device to query the signature-validation database to determine whether the particular publisher claimed by the unverified application is associated with the key used to sign the unverified application by:

identifying the application that has the signature that has not been verified;

determining that the unverified application claims to be provided by the particular publisher.