Timeline for How do cryptographic algorithms help hackers to bypass Antivirus software?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 30, 2015 at 17:12 | vote | accept | etf | ||
| Jun 29, 2015 at 3:38 | answer | added | user3632719 | timeline score: 1 | |
| Jun 28, 2015 at 0:47 | history | tweeted | twitter.com/#!/StackSecurity/status/614958226552004609 | ||
| Jun 27, 2015 at 17:21 | answer | added | Tomasz Klim | timeline score: 2 | |
| Jun 27, 2015 at 16:12 | comment | added | void_in | There is no difference between an exe and an ASCII file as far as encryption algorithms are concerned. If you have studied AES, you will know the input is 16 bytes of data. This data could be anything: ASCII text, binary blobs from an exe file, anything. So encrypting an exe is the same as encryption any other type of data. For decryption, the decryption routine is executed first in memory and that is why AVs fail to detect it. The signature engine check the file BEFORE execution and not during execution. | |
| Jun 27, 2015 at 15:45 | comment | added | etf | Hi void_in, thanks for reply. I studied few cryptographic algorithms like Rijndael, DES,... and I perfectly understand how they work (for any text as input I know how to get ciphertext using these algorithms), but how these algorithms are applied to input which is .exe? And that is not only one problem to me. Let's say I encrypted .exe (on some way) I want to hide from antivirus. I will get some "unreadable and undetectable file", if I'm not wrong. So to run that file there must be another file to decrypt it, but If I decrypt it I will come to original file (which is detected by antivirus)? | |
| Jun 27, 2015 at 15:31 | comment | added | void_in | For a computer system everything is a binary blob. If you have seen cryptography applied to a text file and all its contents have changed (encrypted), apply the same crypto to an executable binary blob and surely everything will change. AV signatures won't work. The only difference is you will attack the decryption stub to the start of the exe (the initial entry point) so that the encrypted payload is encrypted at runtime for execution. | |
| S Jun 27, 2015 at 15:06 | history | suggested | Vilican | CC BY-SA 3.0 |
Edited question to have less stuff which is irrelevant here
|
| Jun 27, 2015 at 14:58 | review | Suggested edits | |||
| S Jun 27, 2015 at 15:06 | |||||
| Jun 27, 2015 at 14:43 | review | First posts | |||
| Jun 27, 2015 at 15:13 | |||||
| Jun 27, 2015 at 14:39 | history | asked | etf | CC BY-SA 3.0 |