mjhjmtu

I have a dataset from a malware detection project that others want to use. Part of that dataset is system binaries that I had retrieved from my PC by searching for *.exe files (to serve as a benign dataset). Is it safe to share these files or can they contain sensitive information about accounts/identity etc.?

Everybody's (me included) reflex answer to such a question will normally be: Huh huh huh (falls off chair). No! How would you think this could even work? Executables are signed nowadays, which prevents them from being modified!

However, if you consider "exe" files in general, not just those from a fresh naked Windows install, the answer must be: Careful!.

Some executables (an increasing number) are specially crafted for you. And yeah, they're signed, doesn't make a difference.

This includes at least some, but more likely most executables you downloaded from one of those modern software-as-a-service or online shop or whatever you call them things. Adobe, Steam, Office360, you name it.

I don't know the technical details about each and every of these, they're just examples that came to my mind as possible candidates. It is however certain, that among other methods, custom-signed executables exist (not just on PC, for example the Nintendo shop definitively works that way).

So, if your Windows system is not just a Windows system, but one that includes custom-signed (or what would one call it? custom-branded?) executables, then you may give out sensitive information.

Also, not all executables are the same version, and not all executables are present on every computer. Unless one also considers file creation dates, it is probably a bit far fetched to say that they provide a unique fingerprint, but this information could certainly be used to more or less identify your system, with a little error margin.

While in theory, there's probably enough combinations of features and versions to identify every atom in every computer, in practice most installs will have mostly the same features, and mostly the same versions. Which amounts to maybe a few dozen million real permutations. But still, if it's a problem that someone might tell that's this-and-that combination points to your specific computer with, say, 85-90% likelihood, then... be aware.

Mind you, it's not so much different with genetic analysis, although of course numbers are much bigger in that case. Folklore tells us that siblings are 50% genetically identical, but in reality, complete strangers are 98% genetically identical. That's because, well, they need these genes in that particular composition to even exist (you will be surprised how much you have in common with, say, a rat or a bunny!). But even if people are mostly identical in almost everything, there's enough in the small, remaining bit to tell quite a lot about someone.

Windows system executables do not contain any sensitive information. They may reveal the version of the operating system you are using, but personal information is not stored in executables. Instead, it is stored in configuration files or databases kept throughout the system. While it would be theoretically possible to store sensitive information in executables, I can't think of any reason it would be done.

They can contain file paths from the system they were compiled on, which may be sensitive if these are programs you compiled on your own system.

Internal / company specific applications may well contain sensitive algorithms (eg pricing/discounting rules, fraud detection). They might be analysed by hostile parties for security flaws.

Revealing which versions of Commercial / third party applications are actively used (especially if not fully up-to-date with security patches) may also allow hostile parties to target your company using known vulnerabilities in those versions.