2 ms·
Hypothetically, you'd rename the malicious payload after a known whitelisted file, like svchost.exe.
by nosmokewhereiam 2y ago
Hypothetically, you'd rename the malicious payload after a known whitelisted file, like svchost.exe.
- nullindividual 2y agoAnd if you used a hashing algorithm, RC4 or the like, what fun that would be when binaries were updated!
- BodyCulture 2y agoWhat problems will occur?
- talldayo 2y agoYou would need to use a hashing algorithm that is not public and cryptographic in some way. Otherwise, a malicious actor can "pad" malware until it reaches a desired checksum and passes the whitelist. This would also make it extremely difficult for software to be distributed and updated in the way it is currently on Mac and Windows.
- BodyCulture 2y agoOf course hash is the key, not name.