Tangentially related to this post: I am surprised at the infosec’s love of file checksums, like MD5 here.
There are endpoint tools which collect MD5’s, network scanners which collect MD5s, and I have heard about actual infosec directors who, upon seeing a blog post like that, would carefully type the hashes in their endpoint management interface to make sure their org is not infected.
How on earth can this be effective? It is trivial to create customized binaries in the installer, so no two users have the same file checksum. With a bit of work, one can rig their download server so each user has a completely different installer checksum as well.
I remember reading about polymorphic viruses back in the 1990’s - not only those had different checksums for each computer, they also had no long-ish substrings common between two versions, making signature analysis ineffective. Did malware authors just forgot about all those and went back to trivial “everyone gets the same image” strategy?
How on earth can this be effective? It is trivial to create customized binaries in the installer, so no two users have the same file checksum. With a bit of work, one can rig their download server so each user has a completely different installer checksum as well.
I remember reading about polymorphic viruses back in the 1990’s - not only those had different checksums for each computer, they also had no long-ish substrings common between two versions, making signature analysis ineffective. Did malware authors just forgot about all those and went back to trivial “everyone gets the same image” strategy?