New malware found on 30k Macs has security pros stumped
Tangentially related to this post: I am surprised at the infosec’s love of file checksums, like MD5 here.
There are endpoint tools which collect MD5’s, network scanners which collect MD5s, and I have heard about actual infosec directors who, upon seeing a blog post like that, would carefully type the hashes in their endpoint management interface to make sure their org is not infected.<p>How on earth can this be effective? It is trivial to create customized binaries in the installer, so no two users have the same file checksum. With a bit of work, one can rig their download server so each user has a completely different installer checksum as well.<p>I remember reading about polymorphic viruses back in the 1990’s - not only those had different checksums for each  computer, they also had no long-ish substrings common between two versions, making signature analysis ineffective. Did malware authors just forgot about all those and went back to trivial “everyone gets the same image” strategy?