4

Just to get an understanding of how indicators of compromise works. Take For example, in this article, the SMB tool. There is a MD5 hash for it. So is my firewalls or IDS supposed to be able to detect this MD5 hash string? How would my firewalls and IDS going to check against this MD5 hash? I am a bit lost on the concept of indicators of compromise. thanks

1
  • 3
    You (or your security soution) are supposed to scan through your disk and keep an eye open for files having one of these suspiciuis heashes. - More specific signatures for firewalls (snort et al.) follow further down below in the CERT article Feb 10, 2015 at 13:28

1 Answer 1

3

This MD5 hash is just a cryptographic hash of a file, i.e. a unique identifier of the file's contents. You can compute a (more-or-less) unique MD5 hash of any file.

What does it have to do with security? You see, when you have a malicious file, you can compute its MD5 hash just like with any other file. Then, if you get this malicious file in your system and compute its hash, you will get exactly the same MD5 hash. What does this mean? It means that your security software can scan your entire file system, computing the MD5 hashes of every single potentially dangerous file and comparing them to the hash of the malicious file. If it finds a match, that means trouble!

In your example, there is a list of MD5 hashes of dangerous files. If the MD5 hash of any file on your computer matches one of these, you're probably screwed.

This is quite a basic malware-detection technique, and it is easily negated by encrypting malware. However, it was the best weapon in the arsenal of most of the earliest antiviruses.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .