Downloadable files on the web are often accompanied by checksums, which can be used to verifiy the integrity of these files after being downloaded. However, studies have found that this verification check almost always goes unused, because many users are unfamiliar with the verification procedure, and the procedure is manual and tedious. This presents a problem, because users that download files from the web without verifying the integrity of these files may be exposing themselves to the risk of malware, ransomware, etc. in the event that the downloadable file was tampered with by a malicious actor. To counter this attack vector, we offer an automated solution for verifying the integrity of web downloads that runs without user intervention.
If you’ve landed on this page, then you’re probably familiar with checksums used to verify the integrity of downloadable files on the web. These checksums are usually derived from cryptographic hash functions, and are typically published near the link to download a file from the web, like so:
After downloading the file to their system, the user can take the checksum of the file, and verify that the actual checksum of the file matches the expected checksum as published on the site. If not, then the file may have been compromised or tampered with.
This verification is especially vital if the file is hosted on a third-party server, such a mirror site or content delivery network (CDN). Even if an attacker (such as a rogue employee of the company hosting the third-party server, or a hacker that is able to gain access to the third-party server) is able to compromise the file hosted on the third party server, the attacker would then also need to update the checksum published by the trusted server. Compromising both the trusted server and the third-party server is beyond the capability of the attacker in most cases. Therefore, by comparing the actual checksum of the file downloaded from the third-party server with the expected checksum published by the trusted server, the user is able to detect if the file was compromised or tampered with while hosted on the third-party server.
However, this integrity verification procedure often goes unused, as reported in a 2018 paper by Mauro Cherubini et al. Most non-technical users are simply unfamiliar with the verification process and how to apply it. And, even technical users often neglect to perform the verification process, because it’s manual and tedious. Yet, failure to verify the integrity of a file downloaded from the web can have disastrous consequences if the file was compromised. Adrian Colyer’s blog post on this subject does an outstanding job of summarizing Cherubini’s findings, and goes on to underscore the need for an automated solution to this problem.
Below is a second demo, simulating a case where the file may have been tampered with, as the actual checksum of the file does not match the expected checksum. Upon clicking the link below, the user sees that the integrity verification fails, and the file is not made available to the user to open or save to their system:
Downloadable files tend to be static and larger in size, so these files are well suited for hosting on a third-party host such as a mirror site or CDNs. By offloading these files to a third-party host, companies are able to the reduce load on their primary web servers, and achieve greater redundancy and reliability for the hosting of these files, while users are likely to benefit from faster downloads of these files. However, companies that choose to offload downloadable files to third-party hosts should be aware of the security implications of doing so, and may want to consider implementing this solution.
Licensing and Implementation Inquiries
This solution is protected by US Patent #10,505,736. Licenses and implementation assistance are available free of charge to all non-profit organizations distributing open-source software, and are available for a reasonable charge to all other entities. Please contact Meixler Technologies, Inc for all licensing and implementation inquiries.