-
-
Notifications
You must be signed in to change notification settings - Fork 427
Description
What would you like to add or change?:
To prevent a file (i.e. an executable on Windows) from gaining network access by replacing another legitimate file, the profile linked to a file should keep its fingerprint (e.g. a simple CRC-32 hash).
If the fingerprint of a file doesn't fit the stored one, Portmaster could warn the user of the situation and ask if the profile's rules needs to be reset, or the stored fingerprint to be updated.
Why do you and others need this?:
Beyond the fact that unusual behavior might be easier to detect when knowing a file has just been modified, the fact that a malicious file can replace a previously validated one is a security issue (on Windows in particular, both with regard to third-party programs and built-in services).