Purpose of integrity checking in installers

Question

There are many programs available (like NSIS) that generate installers from a collection of files. One thing that I have noticed is, the installers produced by these programs have some kind of integrity checking built into them.

For a moment I thought that this was perhaps meant not as a security measure, but only to protect against a corrupted download. But, if it's a corrupted download, the installer won't even run, since the resources section is mangled; and even if it runs, extraction of the compressed data will inevitably fail.

The integrity check is, then, perhaps meant as a security measure. However, I'm really in doubt regarding the effectiveness of such a measure. An attacker able to MITM the download could easily disable the integrity checking for purposes of trojanisation (if not serve an entirely different binary).

So why is such a security measure implemented at all?

Answer 1

The extraction of compressed data will not "inevitably" fail. Errors will often be detected, and that's because most compression formats already include checksums. Most, but not all. For instance, the DEFLATE compression algorithm, by itself, includes no checksum. Checksums are added at some external layer, e.g. when DEFLATE is used for a GZIP file (CRC32 is then used). An installer may decide to pack everything with a single general integrity check for the whole archive, thus avoiding such checksums on individual elements.

If you prefer, whenever a compression format includes a checksum, then that checksum is indeed an "integrity feature". Since bad RAM may flip a bit in the wrong position, some sort of checksum is a sane precaution when distributing software (I knew a CISCO router who was altering bits in IP packets for such a reason; TCP checksums did not always catch the problem, so any file longer than 12 megabytes or so was likely to be damaged when transferred through that router).

Checksums cannot protect against malicious alterations, because whoever does the modification can also recompute the corresponding checksum values. If you want an integrity check which works against attackers, then you need the heavy cannons, i.e. digital signatures.

Answer 2

I've had it happen to me more than once that a download was interrupted and therefore incomplete, but the integrity check still ran. It seems integrity checking is done before unpacking.

As a security measure, I don't see how it would be of any value since an attacker would almost certainly overwrite the entire program and not just a small part of it.