Skip to main content
Blog

Identifying Quantum-Vulnerable Algorithms in Windows and Linux Executables: A Comprehensive Guide – Parts 5-6 of 8

By October 17, 2024November 7th, 2024No Comments

Welcome to the fifth and sixth installments of our comprehensive 8-part series on discovering cryptographic usage in your organization and cataloging it according to risk. This combined guide focuses on validating the discovery of quantum-vulnerable algorithms in executable files on both Windows 11 clients and Linux systems (specifically Ubuntu 22.04 Server Edition).

Introduction

As quantum computing technology advances, the threat to traditional cryptographic algorithms like RSA and ECC grows more significant. The National Institute of Standards and Technology (NIST) has developed a series of discovery test scenarios for Post-Quantum Cryptography (PQC) preparedness. This guide demonstrates how to satisfy Tests 5 and 6 from these scenarios, focusing on executable files in both Windows and Linux environments.

Target Software Packages

We’ll be examining the following software packages:

Windows 11:

  • Google Chrome
  • Java Runtime Environment (JRE)
  • VLC Media Player
  • OpenVPN Connect
  • GRR Rapid Response
  • Slack

Linux (Ubuntu 22.04):

  1. Apache HTTP Server (Apache2)
  2. OpenSSH
  3. MySQL Server
  4. OpenVPN
  5. Postfix
  6. GRR Rapid Response

These applications represent a cross-section of essential enterprise services, encompassing web browsing, media playback, secure remote access, database management, and incident response functionalities.

Step-by-Step Guide to Validate Quantum Vulnerability

1. Identify and Locate Executable Files

Windows 11:

Use the following PowerShell script to locate executable files:

$softwarePaths = @(
    "C:\Program Files\Google\Chrome\Application\chrome.exe",
    "C:\Program Files\Java\jre*\bin\java.exe",
    "C:\Program Files\VideoLAN\VLC\vlc.exe",
    "C:\Program Files\OpenVPN Connect\OpenVPNConnect.exe",
    "C:\Program Files\GRR Rapid Response\grr-client.exe",
    "C:\Program Files\Slack\slack.exe"
)

$softwarePaths | ForEach-Object {
    if (Test-Path $_) {
        Write-Host "Found: $_"
    } else {
        Write-Host "Not Found: $_"
    }
}

Linux (Ubuntu 22.04):

Use the following command to locate executable files:

which apache2 sshd mysqld openvpn postfix grr_client

2. Analyze Executable Files for Quantum-Vulnerable Algorithms

Windows 11:

  1. Use sigcheck to inspect digital signatures:

    .\sigcheck64.exe -i "C:\Program Files\Google\Chrome\Application\chrome.exe"

  2. Use strings to extract plaintext information:

    .\strings64.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" > chrome_strings.txt

  3. Use static analysis tools like Ghidra, IDA Pro, or Binary Ninja for deeper inspection.

Linux (Ubuntu 22.04):

  1. Use objdump for binary inspection:

    objdump -d /usr/sbin/apache2 | grep -i -E "rsa|dsa|ecc|sha1|openssl"

  2. Use strings for plaintext extraction:

    strings /usr/sbin/sshd | grep -i -E "rsa|dsa|ecc|sha1|openssl"

  3. Use ldd for shared library dependency analysis:

    ldd /usr/bin/mysql | grep -i "libssl"

  4. For advanced analysis, use tools like Ghidra or radare2.

3. Automate the Process

Windows 11 (PowerShell):

$softwarePaths = @(
    "C:\Program Files\Google\Chrome\Application\chrome.exe",
    "C:\Program Files\Java\jre*\bin\java.exe",
    "C:\Program Files\VideoLAN\VLC\vlc.exe",
    "C:\Program Files\OpenVPN Connect\OpenVPNConnect.exe",
    "C:\Program Files\GRR Rapid Response\grr-client.exe",
    "C:\Program Files\Slack\slack.exe"
)

foreach ($path in $softwarePaths) {
    if (Test-Path $path) {
        Write-Host "Inspecting $path..."
        
        # Run sigcheck
        .\sigcheck64.exe -i $path
        
        # Run strings and output to a file
        .\strings64.exe $path > "$($path).strings.txt"
        
        Write-Host "Analysis complete for $path."
    } else {
        Write-Host "File not found: $path"
    }
}

Linux (Ubuntu 22.04) (Bash):

#!/bin/bash

softwarePaths=(
    "/usr/sbin/apache2"
    "/usr/sbin/sshd"
    "/usr/sbin/mysqld"
    "/usr/sbin/openvpn"
    "/usr/sbin/postfix"
    "/usr/sbin/grr_client"
)

for path in "${softwarePaths[@]}"; do
    if [[ -f $path ]]; then
        echo "Inspecting $path..."
        objdump -d "$path" | grep -i -E "rsa|dsa|ecc|sha1|openssl"
        strings "$path" | grep -i -E "rsa|dsa|ecc|sha1|openssl"
        ldd "$path" | grep -i "libssl"
        echo "Analysis complete for $path."
    else
        echo "Executable not found: $path"
    fi
done

4. Review and Mitigate Identified Vulnerabilities

After analysis, review the output for any quantum-vulnerable algorithms. If identified, consider these mitigation strategies:

  • Update to quantum-resistant algorithms like lattice-based cryptography (e.g., Kyber, Dilithium).
  • Apply the latest security patches and updates from vendors.
  • For applications heavily reliant on quantum-vulnerable algorithms without a clear upgrade path, consider alternative solutions that better support post-quantum cryptography.

Conclusion

Validating the discovery of quantum-vulnerable algorithms in executable files is a critical step in preparing for the post-quantum era. By following the steps outlined in this article, you can effectively assess the quantum readiness of both your Windows and Linux environments and take proactive measures to secure them against future quantum threats.

While the process we’ve outlined is thorough, it can be time-consuming and complex, especially for large organizations. This is where Automated Cryptography Discovery and Inventory (ACDI) tools can significantly simplify these tasks while adding substantial value. ACDI solutions like the TYCHON Quantum Readiness Module offer several advantages:

  1. Risk Classification: These tools can automatically classify the risk level of identified vulnerabilities, helping prioritize mitigation efforts.

  2. Continuous Monitoring: Unlike manual processes, automated tools can run continuously, providing real-time updates on your organization’s cryptographic posture.

  3. Adaptability: As new applications are added or existing ones are updated, automated tools can adjust their analysis accordingly without manual intervention.

  4. Remediation Action: Some advanced tools can even take automatic remediation actions, further streamlining the security process.

By leveraging such automated solutions, organizations can stay ahead of the quantum threat, ensuring their cryptographic systems remain robust and secure in the face of advancing quantum computing capabilities.

As quantum computing continues to advance, the importance of such analysis will only increase. Regular application of these techniques, coupled with staying informed about developments in quantum-resistant cryptography, is essential for maintaining robust security in the face of emerging quantum threats.

Stay tuned for our next installment, where we’ll explore the integration of cryptographic discovery techniques into the software development lifecycle, focusing on IDE-based tools for early detection of quantum vulnerabilities. This approach will enable organizations to address potential issues at the earliest stages of software development, further enhancing their overall quantum readiness posture.

Learn More