Wikileaks releases copies of FinFisher surveillance software
1–10 of 33 posts
Re: Wikileaks releases copies of FinFisher surveillance software
#2See yesterday's discussion https://news.ycombinator.com/item?id=8317358
Re: Wikileaks releases copies of FinFisher surveillance software
#3I wonder why they use MD5 hashes and not something more collision attack resistant.
Re: Wikileaks releases copies of FinFisher surveillance software
#4I wonder why they use MD5 hashes and not something more collision attack resistant.
Because it would be very hard to find a collision of a file that behaves exactly like a ZipFile.
To make a collision work, you would need to inject the payload into the program, and find a specific blob to put into the zip file, that once compressed and hashed would cause a collision. This isn't computationally efficient.
Re: Wikileaks releases copies of FinFisher surveillance software
#5I wonder why they use MD5 hashes and not something more collision attack resistant.
Because it would be very hard to find a collision of a file that behaves exactly like a ZipFile. To make a collision work, you would need to inject the payload into the program, and find a specific blob to put into the zip file, that once compressed and hashed would cause a collision. This isn't computationally efficient.
I am not familiar with zip file format, but if zip files allow comments or other meta-data (in uncompressed form) then it is an easier path. I suspect even file-names could be an opportunity.
Re: Wikileaks releases copies of FinFisher surveillance software
#6I wonder why they use MD5 hashes and not something more collision attack resistant.
Because it would be very hard to find a collision of a file that behaves exactly like a ZipFile. To make a collision work, you would need to inject the payload into the program, and find a specific blob to put into the zip file, that once compressed and hashed would cause a collision. This isn't computationally efficient.
This is the type of assumption that can get you in trouble. Zip files can contain uncompressed files.
Re: Wikileaks releases copies of FinFisher surveillance software
#7I wonder why they use MD5 hashes and not something more collision attack resistant.
Because it would be very hard to find a collision of a file that behaves exactly like a ZipFile. To make a collision work, you would need to inject the payload into the program, and find a specific blob to put into the zip file, that once compressed and hashed would cause a collision. This isn't computationally efficient.
That's not true. What people do is take a zip file and then append files to the end till you get desired md5. It would behave like a zip file.
Re: Wikileaks releases copies of FinFisher surveillance software
#8Earlier quoted context omitted.
Because it would be very hard to find a collision of a file that behaves exactly like a ZipFile. To make a collision work, you would need to inject the payload into the program, and find a specific blob to put into the zip file, that once compressed and hashed would cause a collision. This isn't computationally efficient.
I am not familiar with zip file format, but if zip files allow comments or other meta-data (in uncompressed form) then it is an easier path. I suspect even file-names could be an opportunity.
Zip even allows individual file members to be not-compressed. So it's extremely trivial.
Re: Wikileaks releases copies of FinFisher surveillance software
#9So, anyone planning to install it?
Re: Wikileaks releases copies of FinFisher surveillance software
#10So, anyone planning to install it?
Now that it's publicly released, it seems like a good idea to install it just to make sure your own systems aren't vulnerable to it.