MD5 Checksum and DLL injection

Question

I would like to know if it is possible that a file checksum or MD5 Checksum is an option for identifying malicious embedded code. As an example, I have a development environment and I want to prevent somebody or an internal threat from injecting malicious code or something into an external dll and using it with the original dll name. So an developer saying, can during development call an external malicious dll and use it as the same name as the original dll?

That way altering the application's behaviour. Making it difficult to find out. I have done some research but digital signatures may help fix but not sure if all.

Please if there is any solution to this I will be very grateful.

Answer 1

Merely checking the MD5 hash of a DLL might not be secure enough, since MD5 is not resistant to Hash Collisions and cannot be consideres safe anymore. An attacker could inject malicious code into an DLL and alter it in a way that the malicous DLL returns the same MD5 hash as the "real" DLL.

As @schroeder mentioned, you probably want to use a signature based approach where only DLLs which are signed with a trusted and known certificate (e.g. by the lead developer) are permitted to be used.

This however leads to a few new problems, e.g. certificate management, trust management, etc.