How to check integrity of Microsoft Supported downloads like IIS URL Rewrite 2.1?

Question

Dear all,

I want to install IIS URL Rewrite 2.1, but also to check the installer integrity before, as our company policies requested. I didn't found any MD5 or SHA256 checksum in the download page, how can I do to perform this checking?

Regards,

M.

Answer 1

English x64 installer

rewrite_amd64_en-US.msi

Algorithm Hash

SHA256 37342FF2F585F263F34F48E9DE59EB1051D61015A8E967DBDE4075716230A32A

English x86 installer

rewrite_x86_en-US.msi

Algorithm Hash

SHA256 B8EDF7A7695751C4F15D32954E8B517D7F5EBAF554D92DEF5378FB77860C53A9

You can use third-party sites like Virus Total as a form of Community verification. Sites like that will display a history of the checksum of the file loaded and whether any other virus software currently detects the file as malicious.

Answer 2

Hello Techfreak_,

Thanks for your reply, it seems you retrieved the hash from this report.

I see that VirusTotal is a service provided by Google. Does Microsoft endorse VirusTotal reports?

Regards,

M.

Answer 3

No, I did not receive the hash from that report. Many websites do not provide a hash for every one of their downloads. I find it strange that a company would require solely a hash to be posted on a website as the only form of file integrity confirmation. When that is not posted, alternate company procedures should be put in place that meet the requirements of the security administrator. Posted file hashes have never been a requirement for software I have validated. Where the software was downloaded from, verified its validity from a security and legal standpoint. If the file were downloaded from some random site that would question its validity and it may not be verified even with a proper hash.

There are 2 main reasons to confirm a download.

1. To ensure the download was not corrupted when downloaded.
2. To ensure the download was not corrupted by malicious software.
3. When you execute the file and the file is corrupt, the file will probably not execute properly. You can always download the file from multiple locations, read the hashes, and compare them. If you get different hashes and some consistent hashes, suspect something in your Intenet connection corrupted the download. The consistent file hash is probably the correct one.
4. As long as you download the file from the original website-hosted link on a clean networked computer, you should assume the file to be untampered. Websites that offer mirror downloads not hosted locally tend to provide hashes as they cannot fully ensure the security of the file. I can understand these might not be trusted. However, the primary hosted download on a Microsoft website like iis.net should meet any security administrator's requirement. Along with the security measures already in place in the company (i.e. scans of all downloaded software before entrance into the environment or execution).

VirusTotal was just given as an example website that you can use as a generic third party to verify your information further. If a file with the same hash was already submitted countless times, it is probably not corrupted. If that hash comes back clean, it is probably not infected with anything.

Once you have that hash captured you can record it in any of your security documentation to compare it against any future corruption (for that same version).

Get-FileHash (Microsoft.PowerShell.Utility)