nerdexam
CompTIA

CAS-002 · Question #345

A security administrator is investigating the compromise of a software distribution website. Forensic analysis shows that several popular files are infected with malicious code. However, comparing a…

The correct answer is B. The infected files were specially crafted to exploit a collision in the hash function. A hash collision attack allows an attacker to craft a malicious file that produces the same digest as a legitimate file, causing integrity checks to pass despite different content.

Enterprise Security

Question

A security administrator is investigating the compromise of a software distribution website. Forensic analysis shows that several popular files are infected with malicious code. However, comparing a hash of the infected files with the original, non-infected files which were restored from backup, shows that the hash is the same. Which of the following explains this?

Options

  • AThe infected files were using obfuscation techniques to evade detection by antivirus software.
  • BThe infected files were specially crafted to exploit a collision in the hash function.
  • CThe infected files were using heuristic techniques to evade detection by antivirus software.
  • DThe infected files were specially crafted to exploit diffusion in the hash function.

How the community answered

(30 responses)
  • A
    17% (5)
  • B
    43% (13)
  • C
    30% (9)
  • D
    10% (3)

Why each option

A hash collision attack allows an attacker to craft a malicious file that produces the same digest as a legitimate file, causing integrity checks to pass despite different content.

AThe infected files were using obfuscation techniques to evade detection by antivirus software.

Obfuscation techniques disguise the nature of malicious code to evade analysis or antivirus scanning but cannot make a modified file produce the same hash digest as the original file.

BThe infected files were specially crafted to exploit a collision in the hash function.Correct

A collision in a hash function means two distinct inputs produce an identical digest output. The attacker engineered the infected files to deliberately generate the same hash as the original clean files by exploiting a mathematical weakness in the algorithm, such as the known collision vulnerabilities in MD5 or SHA-1. Because the computed hashes match, any integrity verification comparing digests will incorrectly report the file as unmodified.

CThe infected files were using heuristic techniques to evade detection by antivirus software.

Heuristic techniques allow malware to evade behavior-based antivirus detection but have no mechanism for producing a hash value identical to that of an uninfected file.

DThe infected files were specially crafted to exploit diffusion in the hash function.

Diffusion is a design property of cryptographic ciphers describing how input changes propagate through the output - it is not a vulnerability that can be exploited to force two different files to share a hash digest.

Concept tested: Cryptographic hash collision attack defeating file integrity

Source: https://csrc.nist.gov/projects/hash-functions

Topics

#hash collision#cryptographic integrity#malware evasion#hash function weaknesses

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice