0
$\begingroup$

I noticed certain programs have a feature that can have a 'snapshot' of a file from a certaim time and compare it to a more recent snapshot of the file. If one's system has a snapshot of a program when 'first' downloaded and it can compare this to the program 'as it is now' and if there are any changes this might indicate the file is corrupt and it could be marked for possible removal. So could this comparison feature be used to determine if a file is corrupt?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

This is not likely to be very effective in practice. Malware might corrupt the file before you were first able to take a snapshot... or, more realistically, it might corrupt the snapshot you have taken, so that the snapshot matches the current version of the file. It is difficult to defend against that attack.

So, while your idea is not a bad one, it has significant limitations that might render it not terribly useful in practice.

This also assumes that the underlying file is one that should never change. Of course, in practice, for any given file, there are valid circumstances when the file should be allowed to change. So this means you'd need some way to recognize valid, legitimate changes to the file. This starts to get a bit more complex to implement.

You might take a look at Tripwire, which is a system that does something like this -- except it keeps only a cryptographic hash of each monitored file, rather than a full copy of the file.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Furthermore, I think you must define some check or heuristic to distinguish legitimate changes on files from malicious ones. Think of script files, which are executable, but not are not binaries that should not change. And I can replace a script file remotely, e.g., via scp so that you cannot easily distinguish this from malware loading a malicious version of that file. $\endgroup$
    – Rmn
    Sep 26, 2014 at 5:43
  • $\begingroup$ This is not very effective against smart malware, but it is very widely used (a lot of antivirus software does this kind of checks), and it is effective against some malware (not all malware is smart). $\endgroup$
    – Gilles 'SO- stop being evil'
    Sep 26, 2014 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.