Verifying update hashes

[News]

Some of you may have noticed us improving our defense-in-depth practices for bulletins by supplying sha1 and sha2 hashes in the Knowledge Base (KB) articles. This has been most visible in the KB with the addition of the “File hash information” section, but it is also noted in the Frequently Asked Questions (FAQ) section of each bulletin for convenience.
Link Removed - Invalid URL
From PowerShell you can easily leverage the .Net Cryptographic Services to define a get-sha256 function like Link Removed has done here. And though it should go without saying, I will say it anyhow - you should not use script or code from untrusted sources.
function get-sha256 {param($file);[system.bitconverter]::tostring([System.Security.Cryptography.sha256]::create().computehash([system.io.file]:penread((resolve-path $file)))) -replace "-",""
}
Let’s verify the hashes for the MS12-071:
Link Removed - Invalid URL
After downloading the msu files we can simply iterate through the directory listing getting the sha2 hash for each file.
Link Removed - Invalid URL
If you prefer not to use the .Net Cryptographic Services you could also verify sha1 hashes with the Link Removed available in KB 841290.
Link Removed - Invalid URL
Though most people will not find the need to go to these lengths as automatic updates stream line the process of providing a secure means of distributing updates, we continually work to raise the bar as part of our ongoing drive to evaluate defense-in-depth efforts and provide improvements.

Thank you,
Dustin Childs
Group Manager
Microsoft Trustworthy Computing


Link Removed - Invalid URL

More...