Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Hypothetically, you'd rename the malicious payload after a known whitelisted file, like svchost.exe.


And if you used a hashing algorithm, RC4 or the like, what fun that would be when binaries were updated!


What problems will occur?


You would need to use a hashing algorithm that is not public and cryptographic in some way. Otherwise, a malicious actor can "pad" malware until it reaches a desired checksum and passes the whitelist.

This would also make it extremely difficult for software to be distributed and updated in the way it is currently on Mac and Windows.


Of course hash is the key, not name.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: