Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

github.com

Post reply on HN
Print view View original

91–100 of 363 posts

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#91

Post by robertoandred »

arsome wrote: post #71
robertoandred wrote: post #20

Earlier quoted context omitted.

Where would you get the CSAM hashes?

The client has to be able to check for them in some way - just run that algorithm against every image you can scrape from Tor/Freenet and I suspect you'll have results rather quickly. Or you can probably just wait a minute and pay an... enterprising individual to sell you such a list on a darknet market though, or perhaps even find one posted on the clearnet soon enough.

No, the client doesn’t have access to the CSAM hashes. And matches are verified on the server, not on the client.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#92

Post by Dylan16807 »

dragonwriter wrote: post #64
dannyw wrote: post #53

Earlier quoted context omitted.

Apple's reviewers, by law, cannot look at the target. No one except NCMEC is allowed to possess the target (CSAM material). So Apple will be looking at a low-res grayscale image of whatever the collided image is, which could be legal adult pornography (let's say: a screengrab of legal "teen" 18+ porn), but the CSAM filter tells it that it's abuse material! What would you do as the Apple reviewer? (Hint: You only have…

> Apple's reviewers, by law, cannot look at the target This is false. > No one except NCMEC is allowed to possess the target (CSAM material). False. No one is allowed to knowingly possess it, without taking certain actions forthwith when they become aware of it. Obviously, prior to it being reviewed as it is , neither the reviewer nor Apple has knowledge that it is actual or even particularly likely CSAM.

I think you misread what was meant by "target".

Yeah, Apple might be able to look at the uploaded image. But the reviewers don't have a copy of the original image added to the database, which is the "target".

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#93

Post by robertoandred »

onepunchedman wrote: post #74
robertoandred wrote: post #61

Earlier quoted context omitted.

What exactly would you be charged with? Why would law enforcement even be involved in a case of false positives?

The sender would of course be charged with wasting police efforts, defamation attempts+++. In the case of false positives the receiver of course wouldn't be charged, it's more about the fact that this system can be manipulated with too much ease. Even if you're not charged, an investigation takes time away from already limited law enforcement resources. I'm also not interested in buying products from a company that b…

Do you mean charging the sender of the trick images or the receiver?

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#94

Post by copperx »

onepunchedman wrote: post #89
copperx wrote: post #68

Earlier quoted context omitted.

It seems like I'm not going to sleep tonight. Sure, there is hyperbole in OP's comment (CSAM ransomware and automated law enforcement aren't a thing yet), but we're a few steps from that reality. Even worse, how long will it take until other cloud storage services such as Dropbox, Amazon S3, Google Drive et al implement the same features? Or worse, required by law to do so? This sounds like the start of an exodus fro…

Yeh I was talking in hyperbole, but the possible attack vectors this system enables are so powerful I felt it warranted. Under this system you are able to artificially ddos organizations that verify if CP is sent by sending legitimate, low-res porn whose hash has been modified. You can trigger legitimate investigations by sending CSAM through WhatsApp or through social engineering. You can also fuck with Apple by sen…

And this is just one step away from Apple and Microsoft building this scanning into the OS itself (into the kernel/filesystem code, why not?!). This is beyond insane. Stallman was right. Our devices aren't ours anymore.

Now, to be fair, there would be a secondary private hash algorithm running on Apple's servers to minimize the impact of hash collisions, but what's important is that once a file matches a hash locally, the file isn't yours anymore -- it will be uploaded unencrypted to Apple's servers and examined. How easy would it be to shift focus from CSAM into piracy to "protect intellectual property"? Or some other matter?

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#95

Post by Dylan16807 »

dannyw wrote: post #57
robertoandred wrote: post #20

Earlier quoted context omitted.

Where would you get the CSAM hashes?

Give it a few days, and you'll probably find someone selling a list of CSAM neural hashes on darknet marketplaces.

Or tweeting out a bunch of them. They're just 12 byte numbers.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#96

Post by seph-reed »

dannyw wrote: post #39
robertoandred wrote: post #36

Earlier quoted context omitted.

Why would anyone save CSAM to their photo library?

A hash collision allows you to create material that matches CSAM signatures, without being CSAM. This opens up a new class of attacks. Specifically, many criminal actors don't touch CSAM because it's wrong. But some of these criminal actors will happily abuse legal systems, e.g. SWATTing.

I would gladly have a mobile phone full of memes that have been modified to match, just for the lulz. I honestly think every meme should be put through just to have "illegal memes"

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#97

Post by heavyset_go »

robertoandred wrote: post #55
systemvoltage wrote: post #42

Earlier quoted context omitted.

I posted another comment that was misunderstood as well. Folks, no one is proposing to download actual CSAM images to your photo lib. You could be duped thinking you downloaded an image of a beautiful sunset which was carefully manipulated to match the hash of an actual CSAM image.

The parent was proposing to “just send known CSAM”. But OK, say someone sends you a sunset that fools the hasher. Then what? Of course one match won’t do anything, so you’d need to download however many matching sunsets. Then what? The Apple reviewer would see they’re sunsets and you’d challenge the flag saying they’re sunsets. And if somehow NCMEC got involved, they’d see they’re just sunsets. And if law enforcement…

> But OK, say someone sends you a sunset that fools the hasher. Then what? Of course one match won’t do anything, so you’d need to download however many matching sunsets. Then what?

A real attack would be to take legal porn images and make them collide with illegal images, so when a human goes to review the scaled down derivative images, those images very well look like they could be CSAM. Since there are many of them, they'd get sent to law enforcement. Then law enforcement would raid the victim's home and take all of their electronic devices in order to determine if they can be charged with a crime or not.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#98

Post by godelski »

bArray wrote: post #48
Scaevolus wrote: post #17

NeuralHash collisions are interesting, but the way Apple is implementing their scanner it's impossible to extract the banned hashes directly from the local database. There are other ways to guess what the hashes are, but I can't think of legal ones. > Matching-Database Setup. The system begins by setting up the matching database using the known CSAM image hashes provided by NCMEC and other child-safety organizations.…

To defeat this, all you need to be is a state actor with a database of child porn at your disposal (which is stored for exactly the purpose of training detection systems). Then you run the hashing algorithm against images you know are in the database (Apple suggested that they would accept suggestions by some kind of multi-Country vote). Then you can pull out the hashes and figure out how to trigger false positives o…

There's already a problem that Apple can't verify the hashes. Say a government wants to investigate a certain set of people. Those people probably share specific memes and photos. Add those hashes to the list and now you have reasonable cause to investigate these people.

Honestly this even adds to the danger of hash collisions because now you can get someone on a terrorist watch list as well as the kiddy porn list.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#99

Post by blintz »

I don't see how this is fixable on their end.

Several people have suggested simply layering several different perceptual hash systems, with the assumption that it's difficult to find a colliding image in all of them. This is pretty suspect - there's a reason we hold a decades-long competition to select secure hash functions. Basically, a function can't generally achieve cryptographic properties (like collision-resistance, or difficulty of preimage computation) without being specifically designed for it. By it's nature, any perceptual hash function is trivially not collision resistant, and any set of neural models are highly unlikely to be preimage-resistant.

The really tough thing to swallow for me is the "It was never supposed to be a cryptographic hash function! It was always going to be easy to make a collision!" line. If this was such an obvious attack, why wasn't it mentioned in any of the 6+ security analyses? Why wasn't it mentioned as a risk in the threat model?

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#100

Post by 63 »

iaw wrote: post #82

Really naive question. What's to stop apple from using two distinct and separate visual hashing algorithms? Wouldn't the collision likelihood decrease drastically in that scenario? Again, really naive but it seems like if you have two distinct multi-dimensional hashes it would be much harder to solve the gradient descent problem.

I'm fairly sure they do, actually. It was in one of the articles earlier today that Apple has a distinct, secret algorithm they perform on suspected CSAM server side after it gets flagged by the client side neural hash. Then only after 30 such images from a single user are identified as CSAM by both algorithms will they be sent to a human reviewer who will confirm their contents. Then, finally, law enforcement will be alerted.

There has been a lot of hyperbole going around and the original premise that this is a breach of privacy is still true, but in my opinion the actual repercussions of attacks and collisions are being grossly exaggerated. One would have to create a collision with known CSAM for both algorithms (one of which is secret) which also overlaps with a legal porn image that could be misconstrued as CSAM by a human reviewer, or at the very least create and distribute hundreds of double collisions to DOS the reviewers.

Post reply on HN