Does a database with pre-calculated SHA256 values exist for Windows EXEs?

Question

Background: At my place of work, we're trying to block all unapproved browsers on all Windows machines and the IT Security guys did a search on our internal infrastructure and came up with a list of all the hash values of the installed Verboten browsers, but I noticed that a bunch were missing from their list and as I'm a BOFH, I know that users not liking Edge, Chrome nor Firefox are just going to look for stuff that isn't blocked. ¯\_(ツ)_/¯

So I told the Security guys to just have a look at the Wikipedia List of browsers and block everything.

Question: Is there an on-line public / commercial database of all a lot of pre-calculated SHA256 hash values of (Windows) applications available out there that I can point them to instead of having to install myself ~200 applications that are not allowed, calculating the hash values myself and giving it to them or they won't even listen to me?

Note 1: Yes, I know this is an XY problem and we should really be whitelisting, but we're bad at Organisational Change Management and I'm just a mere InfoSec PM, so although I used to be technical, I'm a mere suit nowadays... :-(
Note 2: I tried searching the Internet already but my search didn't reveal anything...
Note 3: Yes, I'll bring up whitelisting on next IT Security meeting I'm part of, but I know where that'll go unless I give extremely detailed instructions on how to do this for browsers only...

Answer 1

The National Software Reference Library is probably the best public dataset available.

It may not always be completely up to date (especially with things like browsers, because they change so often), but it should be a good starting point for you.

Answer 2

Whitelisting is your only realistic option here.

Your currently proposed solution has three major flaws:

• for every software you add to the blacklist, you need to keep up-to-date with news releases as they go. With the release cadence of most software. From a human resource standpoint, that's bad.
• for every software you add, you're likely blacklisting the legitimate versions, effectively encouraging downloading from unreliable sources which might bundle/alter the software. From a security standpoint, that's bad.
• for every binary you've blacklisted, I can just append garbage to it, effectively changing its hash and it will (usually) still work. From an effectiveness standpoint, that's bad.

Combine all three and you get an expensive to maintain, ineffective and counter-productive solution.

If people are installing verboten software, you don't have a technological problem; you have a human problem.

The human problem can have various sources and until you understand them it's hard to know how you should act.

• does the verboten software address a specific need that the allowed software doesn't?
• are people unaccustomed to the allowed software and lack guidance?
• are they just boneheaded users that BOFHs hate and need to be disciplined?

This answer is by no means exhaustive but gives you some points that the security team should consider before going through with that terrible idea.