I recently started learning cryptography. I have learned some basic stuff. I'm also started learning about pc security, so I was wondering how do hackers use cryptography for bypassing antivirus software? I don't have some deep understanding on how Antivirus software works but I know that every Antivirus has base of signatures, so when we scan exe file it actually compares signature of exe with signatures in it's own base, and if it matches, Antivirus will identify exe as malware. So by applying some cryptographic algorithm on exe file, they change signature of exe, so antivirus can't detect it as malware, right? But concretely, how do they apply cryptograpyic algorithm on exe file? I saw only in my book how plaintext is crypted. There is no information about crypting exe files there (or I didn't see it). I use book "Applied Cryptography, Bruce Schneier". Maybe this was stupid question but don't blame me, I'm amateur :) If there is some book covering this matter, please suggest it to me, I will be grateful. Thanks in advance
-
$\begingroup$ I guess they just hash (most parts) of the exe file using some hash-function (MD5/SHA-1/SHA-2/...) $\endgroup$ – SEJPM♦ Jun 12 '15 at 17:12
-
$\begingroup$ AV software also looks for certain behaviour in memory, like if a process tries to do something that a regular process should not, and it also looks for memory signatures. $\endgroup$ – Richie Frame Jun 12 '15 at 20:09
-
$\begingroup$ Encryption works on anything, not just "text". $\endgroup$ – Paŭlo Ebermann Jun 13 '15 at 20:56
-
$\begingroup$ its not encryption its compression (packing) see en.wikipedia.org/wiki/Executable_compression $\endgroup$ – Abr001am Jun 13 '15 at 21:20
The term "plaintext" in cryptography does not imply that the input is actual text. Traditionally, the plaintext was often actual text, but the term just refers to the input (other than the key) to the encryption algorithm. Plaintext can be a sequence of letters, like in many classical ciphers; it can be an analog telephone signal; it can be an image or map; it can be whatever the cipher uses as an input. In modern digital ciphers, the plaintext is a stream of bits, possibly with length constraints, because that's the kind of data you already have when you're working with computers. Modern ciphers can handle any stream of bits (again, possibly within those length constraints); it doesn't matter what the stream of bits represents. An EXE file is a stream of bits, so it can be encrypted.
