Re:Windows Bluescreen and Boot Loops (update: caused by a Cr...
by weinzierl on Friday July 19, 2024 @07:26AM
(#41005128)
The tool vendor decides the signature
Sure, but they do it following a certain process. It's not that CrowdStrike employees get paid to be extra creative in their job, so you likely could predict what they choose to include in the signature.
In addition to that, you have no pressure to get it right the first time. You can try as often as you want and analyzing the updated signatures you even get some feedback about your attempts.
Re:Windows Bluescreen and Boot Loops (update: caused by a Cr...
by lmm on Saturday July 20, 2024 @12:39AM
(#41014110)
> Sure, but they do it following a certain process.
Which is going to include checking that it doesn't match any OS files.
> You can try as often as you want and analyzing the updated signatures you even get some feedback about your attempts.
As others said, probably only if you can reverse a hash function.
No they're not. The tool vendor decides the signature, they pick something characteristic that the malware has and other things don't, that's the whole point.
> how hard would it be to craft a malware that has the same signature as an important system file?
Completely impossible, unless you mean, like, bribe one of the employees to put the signature of a system file instead of your malware or something.