There are many programs available (like NSIS) that generate installers from a collection of files. One thing that I have noticed is, the installers produced by these programs have some kind of integrity checking built into them.

For a moment I thought that this was perhaps meant not as a security measure, but only to protect against a corrupted download. But, if it's a corrupted download, the installer won't even run, since the resources section is mangled; and even if it runs, extraction of the compressed data will inevitably fail.

The integrity check is, then, perhaps meant as a security measure. However, I'm really in doubt regarding the effectiveness of such a measure. An attacker able to MITM the download could easily disable the integrity checking for purposes of trojanisation (if not serve an entirely different binary).

So why is such a security measure implemented at all?

  • Perhaps the integrity check is simply meant as a sanity check before launching the full process? No use in trying to extract if the package is corrupt. – schroeder Jun 23 '14 at 14:58

The extraction of compressed data will not "inevitably" fail. Errors will often be detected, and that's because most compression formats already include checksums. Most, but not all. For instance, the DEFLATE compression algorithm, by itself, includes no checksum. Checksums are added at some external layer, e.g. when DEFLATE is used for a GZIP file (CRC32 is then used). An installer may decide to pack everything with a single general integrity check for the whole archive, thus avoiding such checksums on individual elements.

If you prefer, whenever a compression format includes a checksum, then that checksum is indeed an "integrity feature". Since bad RAM may flip a bit in the wrong position, some sort of checksum is a sane precaution when distributing software (I knew a CISCO router who was altering bits in IP packets for such a reason; TCP checksums did not always catch the problem, so any file longer than 12 megabytes or so was likely to be damaged when transferred through that router).

Checksums cannot protect against malicious alterations, because whoever does the modification can also recompute the corresponding checksum values. If you want an integrity check which works against attackers, then you need the heavy cannons, i.e. digital signatures.

| improve this answer | |

I've had it happen to me more than once that a download was interrupted and therefore incomplete, but the integrity check still ran. It seems integrity checking is done before unpacking.

As a security measure, I don't see how it would be of any value since an attacker would almost certainly overwrite the entire program and not just a small part of it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.