Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

github.com

Post reply on HN
Print view View original

31–40 of 363 posts

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#31

Post by d0100 »

dannyw wrote: post #19
Scaevolus wrote: post #17

NeuralHash collisions are interesting, but the way Apple is implementing their scanner it's impossible to extract the banned hashes directly from the local database. There are other ways to guess what the hashes are, but I can't think of legal ones. > Matching-Database Setup. The system begins by setting up the matching database using the known CSAM image hashes provided by NCMEC and other child-safety organizations.…

You can extract the hashes with a few hours spent on the darknet. Doing that is certainly illegal and not to mention VERY morally wrong, but criminals exist and criminals won't hesitate to abuse this as a mechanism for framing, extortion, or ransom. It's also possible for someone (Attacker A) to go on the darknet and get a list of 96-bit neural hashes, and then publish or sell this list somewhere to another party, At…

> If Apple's reviewers see 30 CSAM matches and the visual derivatives look like porn

Even worse, just get a "teen" porn screengrab, pass it through the collider and you have pretty much a smoking gun

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#32

Post by jchw »

only_as_i_fall wrote: post #26
jchw wrote: post #13

I am strongly against Apple’s decision to do on-device CSAM detection, but: wasn’t there a secondary hash whose database is not shared? In theory you need to collide with both to truly defeat the design, right?

I don't see how. They're hashing on feature space (so trivial cropping and such doesn't defeat this) but they have two totally separate methods of matching those hashes? Doesn't sound right to me...

Apparently the images in question would get sent to the server, and all calculation happens there.

> In a call with reporters regarding the new findings, Apple said its CSAM-scanning system had been built with collisions in mind, given the known limitations of perceptual hashing algorithms. In particular, the company emphasized a secondary server-side hashing algorithm, separate from NeuralHash, the specifics of which are not public. If an image that produced a NeuralHash collision were flagged by the system, it would be checked against the secondary system and identified as an error before reaching human moderators.

https://www.theverge.com/2021/8/18/22630439/apple-csam-neura...

For one reason or another Apple really wants to create this precedent, so it’s only natural they’re doing every last thing to make the feature hard to defeat.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#33

Post by Scaevolus »

dannyw wrote: post #19
Scaevolus wrote: post #17

NeuralHash collisions are interesting, but the way Apple is implementing their scanner it's impossible to extract the banned hashes directly from the local database. There are other ways to guess what the hashes are, but I can't think of legal ones. > Matching-Database Setup. The system begins by setting up the matching database using the known CSAM image hashes provided by NCMEC and other child-safety organizations.…

You can extract the hashes with a few hours spent on the darknet. Doing that is certainly illegal and not to mention VERY morally wrong, but criminals exist and criminals won't hesitate to abuse this as a mechanism for framing, extortion, or ransom. It's also possible for someone (Attacker A) to go on the darknet and get a list of 96-bit neural hashes, and then publish or sell this list somewhere to another party, At…

One of the grosser clean room designs.

It's certainly possible, but I posit that the exploit chain necessary to get the capability to inject photos onto an arbitrary user's iPhone is valuable enough that it's more likely to be used for spying by repressive regimes than straight up blackmail-- and if you had such a capability, why bother with hash-colliding permutations of legal pornography? Why not plant CSAM directly onto the user's device?

Nearly all cloud storage services implement a scanner like this, and permit the same level of blackmail with a simpler attack chain, such as phishing Dropbox credentials to inject illegal material.

I think the more interesting attacks are governments colluding to add politically motivated non-CSAM material to the lists and then requiring Apple allow them to perform the human review to discover dissidents.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#34

Post by onepunchedman »

dannyw wrote: post #30
onepunchedman wrote: post #25

This is just getting wilder and wilder by the day, how spectacularly this move has backfired. As others have commented, at this point all you need is someone willing to sell you the CSAM hashes on the darknet, and this system is transparently broken. Until that day, just send known CSAM to any person you'd like to get in trouble (make sure they have icloud sync enabled), be it your neighbour or a political figure, an…

The "send known CSAM" attack has existed for a while but never made sense. However, this technology enables a new class of attacks: "send legal porn, collided to match CSAM perceptual hashes". With the previous status quo: 1. The attacker faces charges of possessing and distributing child pornography 2. The victim may be investigated and charged with child pornography if LEO is somehow alerted (which requires work, a…

Somehow this didn't solidify my trust in Apple! By this standard you can probably mount a half decent defence off "ignorance" if you are even caught sending the colliding material. Add this whole debacle on top of what's going on in the EU parliament and 2021 has been WILD for privacy.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#35

Post by Alupis »

So, what does Apple get out of all this, except negative attention, erosion of their image, possible privacy lawsuits, etc?

I just don't understand what Apple's motivation would have been here. Surely this fallout could have been anticipated?

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#36

Post by robertoandred »

onepunchedman wrote: post #25

This is just getting wilder and wilder by the day, how spectacularly this move has backfired. As others have commented, at this point all you need is someone willing to sell you the CSAM hashes on the darknet, and this system is transparently broken. Until that day, just send known CSAM to any person you'd like to get in trouble (make sure they have icloud sync enabled), be it your neighbour or a political figure, an…

Why would anyone save CSAM to their photo library?

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#37

Post by vermilingua »

The integrity of this entire system now relies on the security of the CSAM hash database, which has just dramatically increased in value to potential attackers.

All it would take now, is for one CSAM hash to be known to the public, then uploading collided iPhone wallpapers to wallpaper download sites. That many false positives will overload whatever administrative capacity there is to review reports in a matter of days.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#38

Post by robertoandred »

dannyw wrote: post #30
onepunchedman wrote: post #25

This is just getting wilder and wilder by the day, how spectacularly this move has backfired. As others have commented, at this point all you need is someone willing to sell you the CSAM hashes on the darknet, and this system is transparently broken. Until that day, just send known CSAM to any person you'd like to get in trouble (make sure they have icloud sync enabled), be it your neighbour or a political figure, an…

The "send known CSAM" attack has existed for a while but never made sense. However, this technology enables a new class of attacks: "send legal porn, collided to match CSAM perceptual hashes". With the previous status quo: 1. The attacker faces charges of possessing and distributing child pornography 2. The victim may be investigated and charged with child pornography if LEO is somehow alerted (which requires work, a…

LEO is not alerted automatically, where’d you get that idea?

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#39

Post by dannyw »

robertoandred wrote: post #36
onepunchedman wrote: post #25

This is just getting wilder and wilder by the day, how spectacularly this move has backfired. As others have commented, at this point all you need is someone willing to sell you the CSAM hashes on the darknet, and this system is transparently broken. Until that day, just send known CSAM to any person you'd like to get in trouble (make sure they have icloud sync enabled), be it your neighbour or a political figure, an…

Why would anyone save CSAM to their photo library?

A hash collision allows you to create material that matches CSAM signatures, without being CSAM. This opens up a new class of attacks.

Specifically, many criminal actors don't touch CSAM because it's wrong. But some of these criminal actors will happily abuse legal systems, e.g. SWATTing.

Post reply on HN