Have you ever gone to download a program or file, and on the download page you noticed
a big long string of letters and numbers next to it, and wondered what that was?
Well it's actually called a hash, and that's what this video is about, and why you should
not ignore it. A hash basically allows you to ensure that the file you're downloading
is exactly what it's supposed to be, and is not corrupted or modified in any way.
And if you're not familiar with hashes, the idea is that virtually every single file
will have a unique hash, and if you change even one single letter within that file,
it should theoretically completely change the hash. So you know that if there's any
tiny amount of corruption in that file, then you'll know.
Now there are some caveats with that, so if you're getting mad at me, don't worry
I'll explain a little bit later, but that's the basics of it. Anyway, so what a lot of
software publishers do is post the hash next to a downloadable file, so after it downloads, you
can check it yourself, and if it doesn't match, then you know something is wrong with the file.
The file might have been corrupted at some point, so you can try downloading it again,
or it might be corrupted on the server. Or it might actually be
a hacker replaced the file with something malicious, like with a man in the middle
attack. I'll get to some options for how to check the hash in a second,
but I do want to point out that not every website obviously offers hashes for downloads.
Also on many sites, you might have to dig a bit to find the hashes,
so look around to see if you can find some of these terms anywhere on the page. So what are
some ways that you can easily check the hash of files? One is using the Windows
built-in function in PowerShell, which is the Get-FileHash command.
So in that case you can just search PowerShell, open it up, and then type get-filehash, and then
drag in the file, and it should automatically bring in the path. And then it'll show you the
hash. By default, it'll show you SHA-256, but if you want to specify a different algorithm,
you can actually use the "-Algorithm" parameter in there and put in a different one if you want.
Now typing in this command and trying to remember it might not be the easiest thing,
so using software is the next best option. And one of those options is 7-zip. A lot
of you might not realize that 7-zip has a hash checker built in. So if you right-click
on a file and then go to the 7-zip, then go to CRC-SHA, and you'll see a few options.
You can click SHA-256, and it'll show that. Or you can click the asterisks,
and it will show you a whole bunch at once. That's probably the main one you'll want to
click. So if you already have 7-zip, then you can just use that. Another
option I really like and have been using for years is called HashTab.
Now officially it's been discontinued, but you still can download it, and it wasn't updated
since 2017 anyway, and it still works. But basically with this, after you install it,
if you right-click and go to properties on any file, you'll see a new "File Hashes" tab,
and that'll just automatically calculate a bunch of the hashes on that file,
and you can actually go into settings and choose which ones you want to show up.
So with this, you probably just want to check the more common ones, like maybe MD5 and SHA-256,
because if you choose too many, especially if it's a large file, then it might take
a long time to get all those. It also makes it easy to paste in a hash, like if you were
copying it right off a website. And actually I believe if you have it in the clipboard,
it'll automatically grab it from the clipboard anyway, so you might not even have to paste it,
and it'll show a little checkmark if it matches one of them, so you know.
And it also lets you compare a file to see if it truly is exactly the same as another one. Now
another software option which is similar is called OpenHashTab. It's open source,
and it's not the same program, but it's inspired by HashTab. And like the previous one,
if you go to properties, this time you'll see a "Hashes" tab, and it's kind of the same idea.
Though I will point out that OpenHashTab has a couple bugs,
one that's pretty significant that I'll mention later. Anyway, you can click the
gear to view a lot more settings than you did have with HashTab. So you can,
for example, have it look for "sumfiles", which are basically files that list a bunch of hashes.
These are often ".sha256" files, like the Notepad++ one here. You can see it lists
the file names and hashes. Though this doesn't always work, and I found usually doesn't work,
because the file name has to match exactly to the file you're checking, and it doesn't always.
So usually if it's a SHA-256 file, you kind of have to open it in Notepad and check yourself.
It also has a VirusTotal option, so you can easily upload it there. And another thing
this one does that HashTab doesn't, is if you open the properties and the tab on a folder,
it will actually hash all the files in that folder. However, that leads to one bug which
is pretty significant, and that is if you open the tab on a folder that has a whole
bunch of files, or a lot of very large files, it will simply freeze Explorer,
and you'll basically have to close Explorer out completely for it to unfreeze.
Which means that if you have OpenHashTab installed, and you happen to look at the
properties window of a folder, and you know it has a whole bunch of files in there, then you have to
be careful not to click on the Hashes tab, because it might freeze Explorer. And for that reason,
I would probably not recommend OpenHashTab at the moment, unless they fix that issue.
And I guess I'll put in the description if they did at the time you watch this.
So I still think HashTab is the way to go. Finally I'll mention QuickHash,
which is a more traditional program. You kind of open it up, and then it has a whole bunch
of features. But it does have some that are very advanced that the others don't.
For example, you can compare an entire folder,
or even an entire disk worth of hashes. So if you need a lot of advanced features,
that might be one to have. Now in addition to checking the file hash of a file you download,
or if the file hash isn't available, another thing you can do is check the signature of a file.
A lot of times, big companies will usually sign these files, especially like Microsoft. And
specifically, it'll be signed by something called a Root Authority Certificate. And basically that
just means that whoever signed this file, if it was signed by a root certificate,
that means that they went through a whole bunch of verification, and did identity
verification and stuff like that, and are kind of being vouched for by a trusted authority.
So you can usually trust files that were signed by a trusted
root authority. But how do you tell if a file was signed by a root authority? Well,
what you can do is right click on a file and go to properties. And then if it's signed at all,
you'll see a Digital Signatures tab. And then you can click on the signature and hit details.
And if you see that it says the digital signature is okay, then it's probably okay. That means that
it was signed by a certificate that's at least in your computer's root store, which does include all
the root authorities, though there is one caveat I'll get to in a second. But if it
does say something like this with a red X, then that means it's not signed by something trusted.
Now, that doesn't necessarily mean it's a virus. It could just be self-signed by like
an independent developer that didn't want to pay the hundreds of dollars to get signed by a root
authority. But in that case, if the website lists signature information for a certificate,
it might do that too. You definitely at least want to check that the signature
in the file matches what's on the website if it's available.
And there you want to make sure that the fingerprint, also called the thumbprint, matches.
Though it might be in a slightly different format. Another thing you can easily look for is if you
see that the digital signature says that it was signed by Microsoft or some other big company, but
then you see that it's not trusted, that likely means that it could be malicious and whoever
created the file was trying to make it look like it was signed by Microsoft, but it wasn't.
So I would definitely not open that. Now one caveat that I mentioned before is if a signature
does show as trusted, then that just means again, that it's in your computer's root signature store,
but you can actually add those yourself. So theoretically, it's possible that a virus
could maybe add its own root certificate and then anything it creates would be trusted.
Probably unlikely, but if you do want to be ultra secure and be a hundred percent sure,
what you could do is upload the file to VirusTotal and that will also check against
its own signature store, which won't be infected, obviously. So to do that, after you upload it,
you can just go to the details tab and then look for signature verification,
and it'll say "signed file valid signature" with a little green check mark.
And that means it was signed by something trusted. Also in the case where it was signed, but not by
something trusted, it'll still show that here. So it'll say "a certificate chain processed,
but terminated in a root certificate, which is not trusted by the provider." Like this example,
I just self-signed this file with a certificate I created myself, which is obviously not going
to be showing up in any trusted things because I just created it right there.
So you can do the same thing. You can maybe check to see if it matches the signature on a website,
like I said before. Also don't worry about where it says counter signatures. I believe that's just
for stuff like the timestamp and doesn't have anything to do with security. Alright finally
I want to address a caveat I mentioned at the beginning of the video which is that,
will every single file in existence have a unique hash no matter what? But obviously that's not
possible because how could you store all the info about a huge file in a tiny little string?
You simply can't. So theoretically yes, it is possible for two completely different files to
have the same exact hash. This is called a hashing collision, but with modern hashes,
this is extremely unlikely. For example in 2017,
it was announced that the first ever SHA-1 file collision was found and it was announced
by Google and Google had to actually really work to create this collision on purpose.
It's not like it just accidentally was found in the wild. So yeah,
after many many years of being in use and only one was found in 2017,
you can see that this doesn't exactly happen every day. However, because one was found,
SHA-1 is now considered not secure for like critical stuff because theoretically, you know,
as computing power increases, then an attacker might be able to do the process in reverse and
create a malicious file such that it has the same hash as a file it's supposed to be impersonating.
Now at the moment, even with SHA-1, that would probably take an enormous amount
of computing power. But to be safe, you just want to use something like SHA-256,
which is basically the current standard. MD5 is another hashing algorithm that's pretty common,
but also considered broken for the same reason. But if you do just need to do a
quick casual check that's not for security purposes, then it's still kind of fine.
But ideally you do want to use SHA-256 if you can. And I should emphasize that
the concern with file hash collisions is not that you'll just happen to download a
corrupted file that has the exact same hash as the intended file by chance,
which is virtually impossible. Again, like I mentioned, the concern is an attacker could figure
out how to purposefully create a collision, which obviously would not be acceptable.
So hopefully now you know something that you didn't before. I'll put all the links
I mentioned in the description if you want to check those out. And if you did enjoy the video,
definitely give me a comment and let me know what you think and give the video a thumbs up as well.
If you want to keep watching, the next video I'd recommend is a pretty cool one where I show you
how you can actually change the main Windows drive letter from C to any letter you want, even A.
I'll put that tutorial right here. It's just kind of for fun, but either way,
thanks so much for watching and I'll see you in the next one.