[roger_smith]

Well then, it's been quite a while since I did one of these.

In light of the recent issue w/ Linux Mint I thought I'd teach you a quick way to verify files.

In the case I linked above, the Linux Mint ISO available for download on Feb 20th was a modified ISO that had a backdoor in it. Scary stuff. What could we do to reduce the chances of such a thing happening? Compare hashes.

A hash is an alpha-numeric representation of something. We can use this to verify the integrity of a file.

For example, let's say I have a text file with the word "potato" in it. If I then generate an MD5 hash of that file, we see something like this

Code:

8ee2027983915ec78acc45027d874316 .\potato.txt

The long string is the md5 hash for the file potato.txt. Now, watch what happens when I modify the file and instead put the word "potatoe" in it. Notice the extra e.

Code:

f0dc5f42de2651148ed243e26394cc93 .\potato.txt

See what's happening here? Notice the file name is the SAME as it was before. I modified the word inside the text file, and as you can see the MD5 hash is COMPLETELY different.

So, when would you use this? Let's say you are downloading a file from some website. In the case of linux distros for example, they usually supply a known good md5 hash to verify your download. Sometimes, files can be damaged in transit, rendering them unusable, or inaccurate. Generating an MD5 on your newly downloaded file, and comparing it to the author's known-good hash, can tell you if the integrity of the file is in tact or not.

So now to the meat of the subject: How to do it.

If you already are running linux, it's easy. You simply use the md5sum command

username@localhost ~$: md5sum /path/to/file

This can sometimes take a few minutes to run depending on teh size of the file you're generating the hash for.

In a Windows environment, you have to get a tool from Microsoft. That tool is available at https://www.microsoft.com/en-us/download...x?id=11533 and is a stand alone exe.

you would run this simply by doing

Code:

fciv.exe filename

More info below

Code:

C:\Users> .\fciv.exe
//
// File Checksum Integrity Verifier version 2.05.
//

Usage:  fciv.exe [Commands] <Options>

Commands: ( Default -add )

        -add    <file | dir> : Compute hash and send to output (default screen).
                dir options:
                -r       : recursive.
                -type    : ex: -type *.exe.
                -exc file: list of directories that should not be computed.
                -wp      : Without full path name. ( Default store full path)
                -bp      : specify base path to remove from full path name

        -list            : List entries in the database.
        -v               : Verify hashes.
                         : Option: -bp basepath.

        -? -h -help      : Extended Help.

Options:
        -md5 | -sha1 | -both    : Specify hashtype, default md5.
        -xml db                 : Specify database format and name.

To display the MD5 hash of a file, type fciv.exe filename

I highly recommend you take the few minutes required to check the hash in anything you've downloaded. I can tell you of a recent story where I didn't check the hash of a downloaded file. I was installing a Linux distro on a laptop and it would get about 90% through one of the steps, and fail without any explanation or error code. After fighting for over an hour to try and find the cause of the issue, I decided to check the integrity of the ISO. Wouldn't you know it, the hashes didn't match, and the file I had was actually damaged in transit. After re-downloading and checking the hash, I had a valid ISO, and it installed first time, no problems .

As always, let me know if you have any questions. I hope this information is useful and interesting.

Ch[/quote]eers

[Bish0pQ]

Good tutorial, thanks for the sharing! Hashing is indeed an important proces.

Anyway I just wanted to say I'm currently developing a program to check all the Windows files for Hashes and if anything changed. A sort of tripwire actually. I will be re-creating it for Linux as well. As this is written in .NET, but it will be re-written in pyhton.

It's not finished yet, but I will release it here.

[Loki123]

Good tutorial, thanks for the sharing! Hashing is indeed an important proces.

Anyway I just wanted to say I'm currently developing a program to check all the Windows files for Hashes and if anything changed. A sort of tripwire actually. I will be re-creating it for Linux as well. As this is written in .NET, but it will be re-written in pyhton.

It's not finished yet, but I will release it here.

Rkhunter does this technically. It takes the SHA-1 sum of files and matches them to known good ones in an online database. You could possibly make it list all of the files on the system and compare them to a local database.

[Bish0pQ]

Rkhunter does this technically. It takes the SHA-1 sum of files and matches them to known good ones in an online database. You could possibly make it list all of the files on the system and compare them to a local database.

Only difference is, my application doesn't scan for rootkits. It scans for change. It also used MD5 instead of SHA-1 sums. It builds a local database of your computer. Than it scans those hashes each day - hour. When change is detected, it gets added to a list. In that way you have an overlook of what files have changed with or without the user knowing. That is what my application is meant for. So I understand what you mean, but it's not really the same.

[Loki123]

Only difference is, my application doesn't scan for rootkits. It scans for change. It also used MD5 instead of SHA-1 sums. It builds a local database of your computer. Than it scans those hashes each day - hour. When change is detected, it gets added to a list. In that way you have an overlook of what files have changed with or without the user knowing. That is what my application is meant for. So I understand what you mean, but it's not really the same.

I said technically. It isn't exactly the same but does the same thing with a different route and different agenda. The idea is good though, will be interesting to see how it pans out.

But; you need to remember that files such as databases and so on are constantly changing so you must have exceptions too. Shoot the application at me when the *nix version is out. I'd like to see how it works. It is interesting.

[Bish0pQ]

I said technically. It isn't exactly the same but does the same thing with a different route and different agenda. The idea is good though, will be interesting to see how it pans out.

But; you need to remember that files such as databases and so on are constantly changing so you must have exceptions too. Shoot the application at me when the *nix version is out. I'd like to see how it works. It is interesting.

Thank you, I certainly will, it will be a public release. I'm coding the most I can, I have made different programs before, but this is my biggest project so far.

I will shoot you a PM if I finish the Beta version.

My apologies to the OP.

[Seize]

This is extremely helpful..very nice

[Sans]

Thank you, I certainly will, it will be a public release. I'm coding the most I can, I have made different programs before, but this is my biggest project so far.

I will shoot you a PM if I finish the Beta version.

My apologies to the OP.

This already exists. Tripwire, OSSEC, Samhain, AIDE all do this. They're all functional right now.

In response to the OP, why MD5? You know better than that, Roger.
http://natmchugh.blogspot.com/2014/10/ho...e-md5.html
https://marc-stevens.nl/research/papers/...-104-S.pdf

[Bish0pQ]

This already exists. Tripwire, OSSEC, Samhain, AIDE all do this. They're all functional right now.

In response to the OP, why MD5? You know better than that, Roger.
http://natmchugh.blogspot.com/2014/10/ho...e-md5.html
https://marc-stevens.nl/research/papers/...-104-S.pdf

Yeah I know, but as most software, almost everything exists. You said it yourself, Tripwire, OSSEC, Samain... there is plenty of room for one more.

[roger_smith]

This already exists. Tripwire, OSSEC, Samhain, AIDE all do this. They're all functional right now.

In response to the OP, why MD5? You know better than that, Roger.
http://natmchugh.blogspot.com/2014/10/ho...e-md5.html
https://marc-stevens.nl/research/papers/...-104-S.pdf

It was the subject of the Linux Mint hack. The developer of Linux Mint was specifically referencing the MD5SUM of the proper ISO.

Everything stated here for MD5 works for SHA1, or really any other hash for that matter. Same principle, just different implementation.