Readers!
Merry Christmas and Happy new year to all. The days of holiday spam and vendor predictions are here.
Here I am spending summer afternoon watching TV and writing on my blog. As I am bit lazy during holidays I am posting something simple. The post is about HASH values and how trivial they are in identifying malicious files/programs.
You can read about Hash here.
Hash values are important to first verify the files. Think of it as a signature or footprint. As living beings has a signature or footprint that we can recognise them from, similarly files have something called digital footprint that we can identify them from.
Take example of HashCalculator. Following screenshot shows different hash values of HashCalc.exe.
As you can see HashCalc provides lot of information (digital footprint) of its own. With regards to security the hashes are normally used to verify the file as mentioned earlier. Let’s look at the output in brief for commonly used hash values :
- MD5 – Based on Message Digest algorithm. Normally represent as 32 hexadecimal digits. Vulnerable to collision attacks. Read further here.
- SHA-1 – Secure Hash Algorithm 1. Represented as 40 digit hexadecimal digits. Generates 160 bits message digest. Vulnerable to collision attacks. No longer in use and has been replaced by SHA-2 and SHA-3. Read further here.
- SHA-256 – Secure Hash Algorithm 2. Represented as 64 digit hexadecimal digits. Generates six digests – SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256. Read further here.
Now, why the blog entry. The information is available on google and Wikipedia. Reason for the blog is Hash values are considered trivial/important in Threat Intelligence and/or cyber security world. Lots of OSINT, vendor intelligence systems share hash values of known malware dropper. This could be an executable, MS office document, Adobe document, image files etc.
Following are few scenarios where Hash values can assist :
- Hash values can assist in identifying whether the file/program that we have is legitimate or not.
- Lot of malware analysis blogs will always provide Hash value of identified file/program.
- The Hash value is also used by Endpoint solutions to detect known malicious files/programs.
- During Incident Response, one can also use Hash values in YARA rules to detect any malicious files/programs.
- Organisations can have a list of program with the Hash values of known good and authorised programs in their organisation, which than can be used to identify any unwanted programs on the system, either via endpoint for real time detection and/or during incident resposne. Benchmarking/Baselining is a complicated process and sometimes not feasible in large organisations.
NIST provides list of known good hash values of legitimate programs, that one can use to compare good vs bad. Read here.
Hash values are just another indicator that gives more targeted detection of malicious files/programs. IP address and URLs are dynamic, not 100% reliable and have low confidence level as a Threat Indicator and therefore Hash values is considered important artefact in Security world.
Happy Holidays!
