0

I would like to know if it is possible that a file checksum or MD5 Checksum is an option for identifying malicious embedded code. As an example, I have a development environment and I want to prevent somebody or an internal threat from injecting malicious code or something into an external dll and using it with the original dll name. So an developer saying, can during development call an external malicious dll and use it as the same name as the original dll?

That way altering the application's behaviour. Making it difficult to find out. I have done some research but digital signatures may help fix but not sure if all.

Please if there is any solution to this I will be very grateful.

  • 2
    Digital signatures are the exact solution for this. – schroeder Mar 4 '19 at 12:23
1

Merely checking the MD5 hash of a DLL might not be secure enough, since MD5 is not resistant to Hash Collisions and cannot be consideres safe anymore. An attacker could inject malicious code into an DLL and alter it in a way that the malicous DLL returns the same MD5 hash as the "real" DLL.

As @schroeder mentioned, you probably want to use a signature based approach where only DLLs which are signed with a trusted and known certificate (e.g. by the lead developer) are permitted to be used.

This however leads to a few new problems, e.g. certificate management, trust management, etc.

| improve this answer | |
  • So partically I can create a whitelist of all dlls that are in the enviorment is that it? – user182148 Mar 4 '19 at 12:38
  • 1
    Given the good file in advance, finding a bad file with the same hash is second-preimage NOT collision, and even MD5, bad as it is, is not broken for second-preimage. That said, it causes palpitations in checklisters for no benefit since better hashes are just as easy to use. – dave_thompson_085 Mar 5 '19 at 6:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy