Fuzzy Hash Code Signing for Malicious Binary Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large-scale software development environments, automatic code signing mechanisms can be abused by allowing malicious code to be signed without detection, making it difficult to audit and secure the signing process, especially since local admins can submit malicious files without altering the code, leading to potential disastrous consequences.
Innovation Solution
Implementing fuzzy hashes, such as context-triggered piecewise hashes, to compare binary code changes and initiate recovery processes if differences exceed a threshold, providing additional security and authentication by alerting or blocking signing processes when significant changes are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automatic code signing mechanisms are implemented, then code signing efficiency is improved, but security against malicious code is worsened
Solution Approach 1:
The system performs preliminary actions by calculating fuzzy hashes of binaries before signing and storing them in a database. This advance preparation enables later comparison to detect significant changes without blocking the automated signing flow, thus maintaining efficiency while preventing malicious code injection.
Solution Approach 2:
The system implements feedback by comparing the fuzzy hash of a binary being signed against previously stored fuzzy hashes. When significant changes are detected (indicating potential malicious code), the system provides feedback through alerts or blocking mechanisms, allowing the automated signing process to maintain efficiency while ensuring security through continuous monitoring.
2Reliability
If fuzzy hash comparison is added to detect code changes, then security monitoring is improved, but system complexity is worsened
Solution Approach 1:
The system uses fuzzy hashes as a simplified copy or representation of the actual binary code. Instead of storing and comparing entire binaries (which would be complex), the system creates a condensed fuzzy hash representation that captures essential code characteristics, enabling security monitoring with minimal added complexity.
Solution Approach 2:
The system changes the parameter space from comparing full binary contents to comparing fuzzy hash values. This parameter transformation simplifies the comparison process significantly, as fuzzy hashes are designed to be computationally lighter and more suitable for detecting significant code changes without requiring complex analysis of the entire binary structure.
3Difficulty of detecting and measuring
If fuzzy hash calculation is performed on all binaries, then detection capability is improved, but processing time is worsened
Solution Approach 1:
The system performs the fuzzy hash calculation as a preliminary action during the build process, before the binary needs to be signed or deployed. By completing this computationally intensive task early in the pipeline, the system minimizes the time impact during subsequent signing operations and ensures detection capability is ready without slowing down the overall build process.
Data Source
AI summary
Various systems and methods for providing a mechanism for using fuzzy hashes for code signing are described herein. A build system for using fuzzy hashes for code signing including a file system to access a binary file; a signing engine to: generate a one-way hash of the binary; calculate a fuzzy hash of the binary; obtain a fuzzy hash of a second binary; and conditionally sign the one-way hash of the binary when the fuzzy hash of the binary differs less than a threshold amount from the fuzzy hash of the second binary.