2

I am testing a software that I need to install on my computer locally. It seems I can modify one of the .exe or .dll using msfvenom to include a malicious payload, like a reverse shell. From there, I can get a meterpreter shell with user privileges.

My question is do popular software (e.g. Microsoft Office) implement integrity check of all files before executing (e.g. word.exe). If not, why?

Improve this question
1
  • This is not uncommon for video games to do, but that kind of DRM is often easily bypassed.
    – forest
    Mar 13, 2018 at 2:23

2 Answers 2

Reset to default
4

Performing such an integrity check is not a proper security measure. It might be some DRM-like obscurity that makes it harder to bypass licensing or some protection for accidental damage of executable file, but not a Keckerhof-like security countermeasure.

The problem is, once an attacker can modify the binary, she can also modify or completely remove the integrity check. (And if the attacker cannot modify the binary, such an attack is useless.)

Even if an attacker cannot find where the integrity verification is, she can, for example, create an executable that unpacks original executable and some malicious executable and runs both of them. Well, this might make it more obvious that there is some malware on the machine.

But vendors aren't likely to use complex solutions that are hard to find, because it is a lot of work and there is some risk of false alarms etc. On the other hand, some standardized solution will probably be easy to defeat – just because there would then be more motivation to make some universal tool.

A proper solution for the integrity problem are digital signatures that have to be checked before the binary starts. This is something that is commonly used.

Improve this answer
4
  • Correct if I'm wrong, I know of code signing which happens before installation. But, I never heard of digital signatures before the binary starts. Is there information you could link me to?
    – Anderson
    Mar 12, 2018 at 19:32
  • Well, this happens on Windows exe files, but it is probably restricted to exe files with some untrusted origin (e.g., downloaded over Internet), not sure about the details. But this is usually the main threat.
    – v6ak
    Mar 12, 2018 at 19:40
  • 3
    Note that code signature are checked by the OS, not by the application itself. It makes no sense for an application to verify its own integrity to itself. It doesn't make sense because if the attacker can modify your executable, then they can modify the signature check as well. The security model of code signing is one where your application is compromised, but the OS isn't. The goal is to enforce a system policy where the OS only runs digitally signed executables. If the attacker compromised the OS as well, and can subvert the OS to skip the check, then the game is already over.
    – Lie Ryan
    Mar 12, 2018 at 21:40
  • @LieRyan That's exactly my point.
    – v6ak
    Mar 12, 2018 at 21:42
1

My question is do popular software (e.g. Microsoft Office) implement integrity check of all files before executing word.exe.

Some does, some does not.

To know for sure, you would have to ask the vendor.

If not, why?

Probably because such an integrity check would likely take a long time (some software e.g. Microsoft Office is very large) and such a delay would lead to a high volume of complaints.

To know for sure, you would have to ask the vendor.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .