Feeds

Camouflaged code threatens security apps

Evil twin hash bash

Providing a secure and efficient Helpdesk

Antivirus firms are concerned about the emergence of techniques that could render meaningless the use of checksums to mark applications as safe.

The issue concerns hash functions - one way mathematical functions that produce a small fixed length checksum or message digest from a much longer batch of code or email message. When two different input values produce the same output value this is called a collision.

Weaknesses in hashing algorithms, such as MD5, that allowed the discovery of collisions much more quickly than would be possible using brute-force attacks have been known about by cryptographic researchers for more than three years.

Previous techniques meant one type of junk message might be mistaken for another junk message, a weakness of interest to cryptographers but that carried little sting in practice. In addition, high speed computers were needed to discover collisions.

But a recent post on a full disclosure list explains a method to append a few thousand bytes to two arbitrary files such that both files have the same MD5 value. One of the arbitrary files might be malicious. Not only that but the researchers - Marc Stevens, Arjen K. Lenstra, and Benne de Weger - produced their proof-of-concept files using a single PC in less than two days.

Symantec reports that the approach threatens to undermine the use of hash functions to identify applications as safe (whitelisting). Malware authors might get harmless code, which generates the same MD5 output as a companion (malicious) app, whitelisted by submitting it to a classification server. Such a technique would clear the way to later distribute a companion malicious application that generates a MD5 result previously flagged as safe.

The approach is far from trivial but creates a means to smuggle malicious apps past whitelisting tools. Both the malicious and harmless apps might be digitally signed to make the malware look even more harmless.

"While what they have achieved is not the same as producing an identical MD5 for an existing file, it's still not a good thing. In particular it causes serious trouble for application white-listing implementations," Symantec notes.

Looking for extra bytes might be a common sense means of detecting the trick. But the extra bytes may look like compressed data in an installer application, or some kind of signature, so that approach to solving the problem is unreliable.

MD5 is not the only hashing function known to have cryptographic weaknesses. SHA-1 is also known to produce collisions and is thus potentially subject to the same kinds of trickery. The solution might be to move towards more robust hashing algorithms such as SHA-2, Symantec researcher Peter Ferrie concludes. ®

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.