Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikileaks releases copies of FinFisher surveillance software

wikileaks.org

Post reply on HN
Print view View original

21–30 of 33 posts

Re: Wikileaks releases copies of FinFisher surveillance software

#21

Post by tptacek »

EthanHeilman wrote: post #18
markvdb wrote: post #3

I wonder why they use MD5 hashes and not something more collision attack resistant.

They should definitely not being using MD5 for anything. Even if the people in this thread saying that finding MD5 collisions is hard were correct, and they aren't, why take the risk? The performance benefits aren't large for MD5 over competing hash functions that don't have know systemic weaknesses and MD5 attacks will only get better. Use SHA256, SHA-3 or MD6 (I like MD6, others may disagree. Disclaimer I worked on…

MD6 is an idiosyncratic recommendation.

Re: Wikileaks releases copies of FinFisher surveillance software

#22

Post by Someone1234 »

EthanHeilman wrote: post #19
Someone1234 wrote: post #17

Earlier quoted context omitted.

Collisions aren't a major risk with MD5 when you also give someone the file size (even approximate). Finding a collision in MD5 is costly, finding a collision in MD5 which is within -+10% of the actual size is extremely costly (technically possible, but maybe not in your lifetime). As to the other reply "because it is zip something something" I disagree. Zip is an extremely good format for crafting fake files which m…

>Finding a collision in MD5 is costly, finding a collision in MD5 which is within -+10% of the actual size is extremely costly (technically possible, but maybe not in your lifetime). MD5 collisions with 10% of the size of the file can be found in seconds on a old laptop computer. I've done it, we assign it as HW in class. Read this http://www.mathstat.dal.ca/~selinger/md5collision/ Notice that the two colliding exe a…

> Notice that the two colliding exe are exactly the same file size. These attacks have only gotten better.

They're also 6, not 200+ KB. They have been specially crafted to be as small as possible to make the problem set as easy as possible.

> The example I gave uses windows and linux executables. No zip files in sight. These attacks are from 2009.

That's a really strange reply. What is it you think I said..? I said and to quote you quoting me: "'Really any format which can take arbitrary metadata (which is MOST) is pretty easy.'"

So why you felt the need to point out that it is an executable not a zip file is uhh strange to say the least...

Re: Wikileaks releases copies of FinFisher surveillance software

#23

Post by Someone1234 »

userbinator wrote: post #20
Someone1234 wrote: post #17

Earlier quoted context omitted.

Collisions aren't a major risk with MD5 when you also give someone the file size (even approximate). Finding a collision in MD5 is costly, finding a collision in MD5 which is within -+10% of the actual size is extremely costly (technically possible, but maybe not in your lifetime). As to the other reply "because it is zip something something" I disagree. Zip is an extremely good format for crafting fake files which m…

Finding a collision in MD5 is costly Not at all; look up "md5coll" and "fastcoll", released nearly 10 years ago, could generate a pair of colliding blocks in under an hour. Testing them now on my machine (which is already a few years old) it generated them in under a second(!) This has been used to create executables that behave differently but that's because they can inspect themselves; on the other hand I think gen…

You're ignoring half of my post (on purpose?): Now generate the collisions matching file sizes. Even that "under a second" concept relies in tiny files.

As files get larger matching both the MD5 and file size becomes more costly.

Re: Wikileaks releases copies of FinFisher surveillance software

#24

Post by sp332 »

EthanHeilman wrote: post #19
Someone1234 wrote: post #17

Earlier quoted context omitted.

Collisions aren't a major risk with MD5 when you also give someone the file size (even approximate). Finding a collision in MD5 is costly, finding a collision in MD5 which is within -+10% of the actual size is extremely costly (technically possible, but maybe not in your lifetime). As to the other reply "because it is zip something something" I disagree. Zip is an extremely good format for crafting fake files which m…

>Finding a collision in MD5 is costly, finding a collision in MD5 which is within -+10% of the actual size is extremely costly (technically possible, but maybe not in your lifetime). MD5 collisions with 10% of the size of the file can be found in seconds on a old laptop computer. I've done it, we assign it as HW in class. Read this http://www.mathstat.dal.ca/~selinger/md5collision/ Notice that the two colliding exe a…

That's if you're generating both sides. If someone has a file and I want to generate a new file with a matching MD5, that's a lot harder.

Re: Wikileaks releases copies of FinFisher surveillance software

#25

Post by EthanHeilman »

Someone1234 wrote: post #22
EthanHeilman wrote: post #19

Earlier quoted context omitted.

>Finding a collision in MD5 is costly, finding a collision in MD5 which is within -+10% of the actual size is extremely costly (technically possible, but maybe not in your lifetime). MD5 collisions with 10% of the size of the file can be found in seconds on a old laptop computer. I've done it, we assign it as HW in class. Read this http://www.mathstat.dal.ca/~selinger/md5collision/ Notice that the two colliding exe a…

> Notice that the two colliding exe are exactly the same file size. These attacks have only gotten better. They're also 6, not 200+ KB. They have been specially crafted to be as small as possible to make the problem set as easy as possible. > The example I gave uses windows and linux executables. No zip files in sight. These attacks are from 2009. That's a really strange reply. What is it you think I said..? I said a…

>They're also 6, not 200+ KB. They have been specially crafted to be as small as possible to make the problem set as easy as possible.

That is not how it works, MD5 is vulnerable to length extension attacks[0]. Once you collide part of an MD5 hash, if everything that follows that collision is the same, it can be as long as you want. Colliding large files is just as easy as colliding small files. You could perform the same exercise with 1GB executables.

[0]: http://en.wikipedia.org/wiki/Length_extension_attack

Re: Wikileaks releases copies of FinFisher surveillance software

#26

Post by EthanHeilman »

tptacek wrote: post #21
EthanHeilman wrote: post #18

Earlier quoted context omitted.

They should definitely not being using MD5 for anything. Even if the people in this thread saying that finding MD5 collisions is hard were correct, and they aren't, why take the risk? The performance benefits aren't large for MD5 over competing hash functions that don't have know systemic weaknesses and MD5 attacks will only get better. Use SHA256, SHA-3 or MD6 (I like MD6, others may disagree. Disclaimer I worked on…

MD6 is an idiosyncratic recommendation.

Fixed.

Re: Wikileaks releases copies of FinFisher surveillance software

#27

Post by EthanHeilman »

sp332 wrote: post #24
EthanHeilman wrote: post #19

Earlier quoted context omitted.

>Finding a collision in MD5 is costly, finding a collision in MD5 which is within -+10% of the actual size is extremely costly (technically possible, but maybe not in your lifetime). MD5 collisions with 10% of the size of the file can be found in seconds on a old laptop computer. I've done it, we assign it as HW in class. Read this http://www.mathstat.dal.ca/~selinger/md5collision/ Notice that the two colliding exe a…

That's if you're generating both sides. If someone has a file and I want to generate a new file with a matching MD5, that's a lot harder.

MD5 is both vulnerable to collision attacks and targeted collision attacks. We can imagine both in the wikileaks case. You are correct that Target collision attacks are more difficult but they have been done in research for many years now[0](2006) and they are showing up in the wild as well[1](2012).

[0]: http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.140....

[1]: http://blogs.technet.com/b/srd/archive/2012/06/06/more-infor...

Re: Wikileaks releases copies of FinFisher surveillance software

#28

Post by Someone1234 »

EthanHeilman wrote: post #25
Someone1234 wrote: post #22

Earlier quoted context omitted.

> Notice that the two colliding exe are exactly the same file size. These attacks have only gotten better. They're also 6, not 200+ KB. They have been specially crafted to be as small as possible to make the problem set as easy as possible. > The example I gave uses windows and linux executables. No zip files in sight. These attacks are from 2009. That's a really strange reply. What is it you think I said..? I said a…

>They're also 6, not 200+ KB. They have been specially crafted to be as small as possible to make the problem set as easy as possible. That is not how it works, MD5 is vulnerable to length extension attacks[0]. Once you collide part of an MD5 hash, if everything that follows that collision is the same, it can be as long as you want. Colliding large files is just as easy as colliding small files. You could perform the…

> Once you collide part of an MD5 hash, if everything that follows that collision is the same, it can be as long as you want. Colliding large files is just as easy as colliding small files.

I've read that three times, still don't follow what you're getting at. That isn't how length extension attacks work/can be utilised.

Please go ahead and generate a file that collides with any of the linked files and is the same file size. The content doesn't have to be valid or readable, junk/binary is fine. If you can do this in a reasonable period of time (e.g. 24 hrs) then your point would have been proven.

The smallest is 224K with a hash of 180caf23dd71383921e368128fb6db52.

Re: Wikileaks releases copies of FinFisher surveillance software

#29

Post by codeflo »

Someone1234 wrote: post #28
EthanHeilman wrote: post #25

Earlier quoted context omitted.

>They're also 6, not 200+ KB. They have been specially crafted to be as small as possible to make the problem set as easy as possible. That is not how it works, MD5 is vulnerable to length extension attacks[0]. Once you collide part of an MD5 hash, if everything that follows that collision is the same, it can be as long as you want. Colliding large files is just as easy as colliding small files. You could perform the…

> Once you collide part of an MD5 hash, if everything that follows that collision is the same, it can be as long as you want. Colliding large files is just as easy as colliding small files. I've read that three times, still don't follow what you're getting at. That isn't how length extension attacks work/can be utilised. Please go ahead and generate a file that collides with any of the linked files and is the same fi…

That's not what a collision attack[1] is. You're probably thinking of a pre-image attack[2].

[1] http://en.wikipedia.org/wiki/Collision_attack

[2] http://en.wikipedia.org/wiki/Preimage_attack

Re: Wikileaks releases copies of FinFisher surveillance software

#30

Post by Someone1234 »

codeflo wrote: post #29
Someone1234 wrote: post #28

Earlier quoted context omitted.

> Once you collide part of an MD5 hash, if everything that follows that collision is the same, it can be as long as you want. Colliding large files is just as easy as colliding small files. I've read that three times, still don't follow what you're getting at. That isn't how length extension attacks work/can be utilised. Please go ahead and generate a file that collides with any of the linked files and is the same fi…

That's not what a collision attack[1] is. You're probably thinking of a pre-image attack[2]. [1] http://en.wikipedia.org/wiki/Collision_attack [2] http://en.wikipedia.org/wiki/Preimage_attack

I didn't use the expression "collision attack" ever in this thread. I quoted someone else who used that term however (and the context of the whole discussion is clearly related to preimage attacks, not collision attacks).
Post reply on HN