nerdexam
CompTIA

CAS-001 · Question #427

A security administrator is investigating the compromise of a software distribution website. Forensic analysis shows that several popular files are infected with malicious code. However,comparing a…

The correct answer is B. The infected files were specially crafted to exploit a collision in the hash function. If an infected file and an original file produce the same hash value, an attacker crafted the malicious file to exploit a hash collision, where two different inputs yield an identical digest.

Enterprise Security

Question

A security administrator is investigating the compromise of a software distribution website. Forensic analysis shows that several popular files are infected with malicious code. However,comparing a hash of the infected files with the original, non-infected files which were restored from backup, shows that the hash is the same. Which of the following explains this?

Options

  • AThe infected files were using obfuscation techniques to evade detection by antivirus software.
  • BThe infected files were specially crafted to exploit a collision in the hash function.
  • CThe infected files were using heuristic techniques to evade detection by antivirus software.
  • DThe infected files were specially crafted to exploit diffusion in the hash function.

How the community answered

(33 responses)
  • A
    12% (4)
  • B
    79% (26)
  • C
    3% (1)
  • D
    6% (2)

Why each option

If an infected file and an original file produce the same hash value, an attacker crafted the malicious file to exploit a hash collision, where two different inputs yield an identical digest.

AThe infected files were using obfuscation techniques to evade detection by antivirus software.

Obfuscation techniques disguise malicious code to avoid antivirus signature detection but do not alter how a cryptographic hash function processes the file's bytes, so they would not produce matching hashes.

BThe infected files were specially crafted to exploit a collision in the hash function.Correct

A hash collision occurs when two distinct inputs produce the same hash output. The attacker specifically engineered the infected file so that, despite containing malicious code, its hash value is identical to that of the legitimate original file. This defeats integrity verification because automated tools and administrators comparing hashes would incorrectly conclude the files are identical and unmodified.

CThe infected files were using heuristic techniques to evade detection by antivirus software.

Heuristic detection is a method used by antivirus software to identify unknown threats by behavior; it is an AV technique, not something an attacker applies to a file to manipulate its hash.

DThe infected files were specially crafted to exploit diffusion in the hash function.

Diffusion is a design property of hash functions ensuring each input bit influences many output bits; it is not a vulnerability that can be exploited to force two different files to share the same hash output.

Concept tested: Hash collision attack defeating file integrity verification

Source: https://csrc.nist.gov/glossary/term/collision

Topics

#hash collision#cryptographic hashing#integrity verification#malware evasion

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-001 Practice