Verifying checksums
Last updated
Last updated
As a best practice, we should always verify the checksum of all downloaded binary and zipped files. This ensures that the downloaded files are indeed the ones we intended to download - i.e. have not been corrupted or tampered with since it was originally created.
Network and device level security are powerless against this attack vector because you are basically inviting these tampered files into your system if you do not perform checksum verification before running these files.
Each downloadable file comes with it's own checksum (see below).
Verify its checksum after downloading the file.
Breakdown:
<checksum> refers to the long hexadecimal string in the screenshot above
<checksum_method> refers to the the hashing algorithm used (in lower case) - e.g. MD5, SHA256, SHA512
Example:
Expected output: Verify output of the checksum verification