New ISC Tool: Whitelist Hash Database（情報元のブックマーク数）
NISTがホワイトリストハッシュデータベースを公開しているそうです。これはすごい！
NIST is publishing a regularly updated set of CDs with hashes for a number of software packages. The "National Software Reference Library" (NSRL) [1] is frequently used for forensics to eliminate unaltered standard files from an investigation. However, I feel that this database also has a lot of use for malware analysis. Anti-malware software usually takes an "enumerate badness" approach in attempting to come up with signatures for all known malware. With the current flood of new malware variants, this approach does not work well anymore.
InfoSec Handlers Diary Blog - New ISC Tool: Whitelist Hash Database
One problem with the NIST NSRL was that there was no easy way to look up a single hash or file. You could order the CD set or download them, but there was no simple way to just lookup just one hash which is particular useful for malware analysis. Not anymore. We downloaded the database for you, and it is now available to be queried here: http://isc.sans.org/tools/hashsearch.html .
The plan is to add our own hash collections to it. I may also offer a DNS based lookup if there is interest. In order to provide some malware information, I added a lookup against the Team Cymru malware hash database.
