Malware Credential Reuse Detection via Hash Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware signed with multiple valid credentials evades detection by repeatedly obtaining and using different signing credentials, leading to continuous distribution even after individual credentials are revoked, as signing authorities are unaware of the malicious party's use of multiple companies to sign the same malicious program.
Innovation Solution
A system where client computers create secure hashes of signed application bodies and immutable digital signature portions, transmitting them to a central server for comparison to identify multiple instances of the same signed application, and adjudicate potential maliciousness based on matching or non-matching hashes of these signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware uses multiple valid signing credentials to evade detection, then the malware can continue distributing even after credentials are revoked, but the detection system must track multiple credentials and their associations
Solution Approach 1:
The system segments the detection task by separating application body hashing from signature portion hashing. The application body hash identifies the malware variant, while the signature hash identifies the credential set. This segmentation allows the system to track multiple credentials independently while maintaining accurate detection of the underlying malware.
Solution Approach 2:
The system introduces an intermediary database that stores the mapping between application bodies and their signatures. This intermediary structure enables the system to detect when different credentials are used for the same application without requiring direct analysis of all credential combinations, simplifying the detection logic.
2Reliability
If the system tracks all credential revocations and usage patterns, then detection reliability improves, but the amount of information to process and store increases significantly
Solution Approach 1:
The system extracts only the critical identifying features: the application body hash and the signature portion hash. By taking out only these essential elements for storage and comparison, the system reduces the information processing burden while maintaining sufficient data to reliably detect credential reuse patterns.
Solution Approach 2:
The system performs preliminary hashing of application bodies and signature portions before storage and comparison. This preliminary processing reduces the amount of raw data that needs to be stored and processed, as the hashes serve as compact representations that capture the essential identifying features without requiring full data retention.
3Reliability
If the system compares hashes of application bodies and signatures to identify malware, then detection capability improves, but the computational resources required for hashing and comparison increase
Solution Approach 1:
The system creates cryptographic copies (hashes) of the application bodies and signature portions for comparison purposes. These hash copies can be stored and compared without requiring the full original data to be processed repeatedly, reducing computational resource consumption while maintaining detection capability.
Solution Approach 2:
The system transforms the original application data and signature data into hash parameter representations. This parameter transformation converts complex data structures into fixed-length digests that are easier and faster to compare, reducing the computational resources required for detection while maintaining reliability.
Data Source
AI summary
Malware that is signed with multiple, valid credentials is detected. A central computer such as a server receives secure hashes of signed application bodies and immutable portions of corresponding digital signatures for a plurality of signed applications from a plurality of client computers. Received secure hashes of signed application bodies are compared. Multiple instances of a single signed application are identified based on the comparing of multiple received secure hashes of signed application bodies. Responsive to identifying multiple instances of the single signed application, received secure hashes of immutable portions of digital signatures corresponding to identified multiple instances of the single signed application are compared. Responsive to the results of this comparing, a potential maliciousness of the signed application is adjudicated.