GCIH · Question #254
Adam works as a sales manager for Umbrella Inc. He wants to download software from the Internet. As the software comes from a site in his untrusted zone, Adam wants to ensure that the downloaded…
The correct answer is D. Compare the file's MD5 signature with the one published on the distribution media. MD5 cryptographic hashing is the correct method to verify that downloaded software has not been tampered with or Trojaned, as it produces a unique digest that changes if any file content is altered.
Question
Adam works as a sales manager for Umbrella Inc. He wants to download software from the Internet. As the software comes from a site in his untrusted zone, Adam wants to ensure that the downloaded software has not been Trojaned. Which of the following options would indicate the best course of action for Adam?
Options
- ACompare the file size of the software with the one given on the Website.
- BCompare the version of the software with the one published on the distribution media.
- CCompare the file's virus signature with the one published on the distribution.
- DCompare the file's MD5 signature with the one published on the distribution media.
How the community answered
(28 responses)- B4% (1)
- C4% (1)
- D93% (26)
Why each option
MD5 cryptographic hashing is the correct method to verify that downloaded software has not been tampered with or Trojaned, as it produces a unique digest that changes if any file content is altered.
File size is trivially easy to preserve even after malicious code is injected, making it an unreliable integrity check.
Software version metadata can be spoofed or left unchanged in a Trojaned binary, so it provides no real assurance of file integrity.
A virus signature is used by antivirus engines to detect known malware patterns, not to verify the authenticity or integrity of a legitimate software package.
MD5 produces a fixed-length cryptographic hash digest unique to the exact contents of a file. If any byte is modified by a Trojan, the MD5 hash will be completely different from the one published by the legitimate vendor. Adam can compute the MD5 of the downloaded file and compare it to the vendor-published checksum to confirm integrity.
Concept tested: File integrity verification using MD5 checksums
Source: https://csrc.nist.gov/glossary/term/message_digest
Topics
Community Discussion
No community discussion yet for this question.