Verifying File Integrity
The internet provides us access to content from around the world. When downloading files from the internet we need to verify that the file we have downloaded is the actual file that we were attempting to get and that it hasn't been modified someone where in the middle (i.e. Man In The Middle attacks, hijacked website, etc...) and has been downloaded correctly (i.e. interrupted network connection, FTP binary download instead of ASCII).
When updating the firmware of a device, the integrity of the new firmware file is of utmost importance. You are replacing the machine level control code on the device that all the applications and operational code depend on, including the System Kernel. Malware or hacker tools embedded in the firmware file will likely go undetected and undeterred by Operating System and Application level software (since it occurs at a hardware level)
As with all issues of Cybersecurity, the balance must be obtained between security and convenience. How critical is the piece of equipment you are updating? Are there safety implications to corrupted or tampered firmware?
For the purpose of this article, we are going to be looking at the first level of verification only, FILE HASHES. Alternate methods include certificates and digital signatures which are not covered in this article.
File Types (typical)
.sfv - CRC32 Checksum
.md5 - MD5 Checksum in 128-bit form (md5sum)
.sha1 - 160-bit hash in sha1sum form
How to Verify File Integrity
Note: This guide is for informational purposes only and ICI is not responsible for any damages resulting from running these commands. Should you require further information or clarification, please contact us.
Windows command line example using CertUtil:
- File name to check is c:\windows\explorer.exe
- Open a command prompt and run the following command
certutil -hashfile c:\windows\explorer.exe MD5
The system will respond with the following that you can compare against an MD5 obtained from the download source
MD5 hash of c:\windows\explorer.exe: 800ef617ddc3c635cd25e20e0ec39cc6 CertUtil: -hashfile command completed successfully.
Windows PowerShell example using Get-FileHash
- Filename to check is c:\windows\explorer.exe
- Open a PowerShell terminal and run the following command
Get-FileHash c:\windows\explorer.exe -Algorithm MD5 | Format-List
PowerShell will respond with
Algorithm : MD5 Hash : 800EF617DDC3C635CD25E20E0EC39CC6 Path : C:\windows\explorer.exe