I recently started learning cryptography. I have learned some basic stuff. I'm also started learning about pc security, so I was wondering how do hackers use cryptography for bypassing antivirus software? I don't have some deep understanding on how Antivirus software works but I know that every Antivirus has base of signatures, so when we scan exe file it actually compares signature of exe with signatures in it's own base, and if it matches, Antivirus will identify exe as malware. So by applying some cryptographic algorithm on exe file, they change signature of exe, so antivirus can't detect it as malware, right? But concretely, how do they apply cryptograpyic algorithm on exe file? I saw only in my book how plaintext is crypted. There is no information about crypting exe files there (or I didn't see it). I use book "Applied Cryptography, Bruce Schneier". Maybe this was stupid question but don't blame me, I'm amateur :) If there is some book covering this matter, please suggest it to me, I will be grateful. Thanks in advance
-
$\begingroup$ I guess they just hash (most parts) of the exe file using some hash-function (MD5/SHA-1/SHA-2/...) $\endgroup$– SEJPMJun 12, 2015 at 17:12
-
$\begingroup$ AV software also looks for certain behaviour in memory, like if a process tries to do something that a regular process should not, and it also looks for memory signatures. $\endgroup$– Richie FrameJun 12, 2015 at 20:09
-
$\begingroup$ Encryption works on anything, not just "text". $\endgroup$– Paŭlo EbermannJun 13, 2015 at 20:56
-
$\begingroup$ its not encryption its compression (packing) see en.wikipedia.org/wiki/Executable_compression $\endgroup$– Abr001amJun 13, 2015 at 21:20
1 Answer
The term "plaintext" in cryptography does not imply that the input is actual text. Traditionally, the plaintext was often actual text, but the term just refers to the input (other than the key) to the encryption algorithm. Plaintext can be a sequence of letters, like in many classical ciphers; it can be an analog telephone signal; it can be an image or map; it can be whatever the cipher uses as an input. In modern digital ciphers, the plaintext is a stream of bits, possibly with length constraints, because that's the kind of data you already have when you're working with computers. Modern ciphers can handle any stream of bits (again, possibly within those length constraints); it doesn't matter what the stream of bits represents. An EXE file is a stream of bits, so it can be encrypted.
