Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 4 replies
  • Subscribers 19 subscribers
  • Views 12719 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Checksums of software downloads

Neil-J

Where can I find checksums (MD5, SHA1, etc.) for Sophos software downloads?

I've had a good look on the download pages, tried searching the knowledge base and forums for an answer and tried a general internet search but I have had no luck (and wasted too much time!).

In this particular instance I'm looking for a checksum for Anti-Virus for VMware vShield (ssvm_sfx_1_1_8.exe) and Sophos Enterprise Console (sec_522_sfx.exe) but I would expect to find them for all enterprise software downloads.

Thanks.

:52092


This thread was automatically locked due to age.
  • 0

    Hello Neil-J,

    what are your concerns? That you might download a hacked version or ...?

    Christian

    :52176
  • 0

    A checksum provides a number of assurances to an organisation (or individual), including confirmation that the software did not get corrupted during the download and that it has not been modified or substituted in some way due to nefarious activities.

    Both of these should concern the security-conscious.

    :52178
  • 0

    Hello Neil-J,

    undetected corruption during download (i.e. seemingly successful download) should be rare and will, due to the downloaded file's structure, be noticed when one tries to use it (arguably this takes less time than calculating the checksum). Apart from this the parts are signed.

    As to nefarious activities, the downloads are not provided by arbitrary and perhaps dubious sources. Not that they are completely immune against substitution. Last but not least, the checksum has to be genuine - as you are likely obtaining it through the same channels as the download a dedicated attacker can easily modify it as well.

    Christian 

    :52190
  • 0

    Sophos only provides checksums for some of the downloads - not all.  Many of the downloads have a signature for security. 

    Example:

    2014-07-28_13-08-34.png

    :52241

     - - - - - - - - - - - -

    Communities Moderator, SOPHOS
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Unfiltered HTML