SHEEP WOLF – Exploit MD5 Collisions For Malware Detection
SHEEP WOLF – Exploit MD5 Collisions For Malware Detection
Some security tools still stick to MD5 when identifying malware samples years after practical collisions were shown against the algorithm. This can be exploited by first showing these tools a harmless sample (Sheep) and then a malicious one (Wolf) that have the same MD5 hash. Please use this code to test if the security products in your reach use MD5 internally to fingerprint binaries and share your results by issuing a pull request updating the contents of results !!
Dependencies:
1. 32-bit Windows (virtual) machine (64-bit breaks stuff)
2. Visual Studio 2012 to compile the projects (Express will do)
3. Fastcoll for collisions
4. Optional: Cygwin+MinGW to compile Evilize
You can Download this tool from here: Click Here
Some security tools still stick to MD5 when identifying malware samples years after practical collisions were shown against the algorithm. This can be exploited by first showing these tools a harmless sample (Sheep) and then a malicious one (Wolf) that have the same MD5 hash. Please use this code to test if the security products in your reach use MD5 internally to fingerprint binaries and share your results by issuing a pull request updating the contents of results !!
Dependencies:
1. 32-bit Windows (virtual) machine (64-bit breaks stuff)
2. Visual Studio 2012 to compile the projects (Express will do)
3. Fastcoll for collisions
4. Optional: Cygwin+MinGW to compile Evilize
You can Download this tool from here: Click Here
Comments
Post a Comment