Skip to content

Update RIPEMD detection to use round constants.#443

Open
Ek0n wants to merge 1 commit intoYara-Rules:masterfrom
Ek0n:master
Open

Update RIPEMD detection to use round constants.#443
Ek0n wants to merge 1 commit intoYara-Rules:masterfrom
Ek0n:master

Conversation

@Ek0n
Copy link

@Ek0n Ek0n commented Mar 19, 2024

This prevents detecting SHA1 as RIPEMD. Tested with OpenSSL and Nettle.

Here is an example of running it on my system:

yara -i RIPEMD160_Constants -N -r crypto/crypto_signatures.yar /usr/lib/x86_64-linux-gnu/
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/libgcrypt.so.20.4.2
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/libnettle.a
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/ruby/3.1.0/digest/rmd160.so
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/libmd.so.0.1.0
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/libmd.a
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/libnettle.so.8.8
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/libcrypto.so.3
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/libgcrypt.a
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/libavutil.so.58.2.100
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/libmhash.so.2.0.1
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/libmbedcrypto.so.2.28.3
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/librhash.so.0
RIPEMD160_Constants /usr/lib/x86_64-linux-gnu/libcrypto.a

This prevents detecting SHA1 as RIPEMD.  Tested with OpenSSL and Nettle.
@sylvainpelissier
Copy link
Contributor

I have added your rule here: sylvainpelissier/cryptography-yara-rules@f3c6a48

Thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants