[p2p-hackers] SHA1 broken?

[Nick Lothian]

> > Dan Kaminsky runs over a number of potential attacks that 
> are relevant 
> > to P2P -- see:
> >
> >   http://paketto.doxpara.com
> > ...
> > Here's another example from the cryptography list that convinced a  
> > doubter...
> 
> 	Certainly looks cute. Now correct me if I'm not getting 
> something here - but isn't it true that in order to mount an 
> attack one has to replace the "good" code (content, whatever) 
> by the "bad" code, and the absolutely necessary condition is 
> that the "good" code also has to be created by an attacker? 
> So an attacker creates "good" code, gives it to security 
> experts for verification, and then after they are done, 
> replaces it with "bad code", right? 
> 
> 	Isn't it a bit far-fetched? Do we have a somewhat more 
> realistic attack scenario? I just cannot imagine all this 
> happening in real life. Real-life breakdowns always tend to 
> be way simpler than their theoretical scenarios (and totally 
> unexpected, too).
> 

According to some reports some anti-spyware tools currently use MD5
hashes to find known-bad software (See
http://malektips.com/microsoft_antispyware_0007.html). It's not hard to
imagine spyware manufactures modifying common opensource applications
(eg: p2p software) so they include spyware and yet still have the same
hash.

Nick


IMPORTANT: This e-mail, including any attachments, may contain private or confidential information. If you think you may not be the intended recipient, or if you have received this e-mail in error, please contact the sender immediately and delete all copies of this e-mail. If you are not the intended recipient, you must not reproduce any part of this e-mail or disclose its contents to any other party.

This email represents the views of the individual sender, which does not necessarily reflect those of education.au limited except where the sender expressly states otherwise.

It is your responsibility to scan this email and any files transmitted with it for viruses or any other defects.

education.au limited will not be liable for any loss, damage or consequence caused directly or indirectly by this e-mail.