Hacker News Reader

Comment by grovegames | Hacker News Reader

To put that in perspective, that's roughly the loaded rate of a salaried ~80k employee; roughly. So we're talking a single hire in a nice city.

View on HN

For a single PDF document, once

"For a single malicious C file in the linux kernel, once"

(My understanding of the method is it might be extendable to modifying a comment mid-file and then introducing later code, instead of modifying a JPG inside a PDF)

It cannot. The Google implementation must effectively be done on a blob as the result would not be usable in a structure specific document. What is more, things that require a block chain (like git) are NOT covered with this current attack as both the source and resulting have to be worked on.

Currently the attack vector only works when you can get both documents to "work towards each other" to produce a valid identical SHA1 value.

This was a fixed prefix collision attack. That means they can make two documents (P | A | anything) and (P | B | anything) for a fixed P, and they can find A, B, such that A and B are different but

SHA1(P | A | anything) = SHA1(P | B anything)

The Merkle-Damgård construction (used in MD4, MD5, SHA1 and SHA2 but not in SHA3 and some other modern hashes) invariably means length extension is possible, if you can collide two documents then you can add a suffix to both and also get a collision.

This is how there's already a web site where you feed it images and it makes a "different" colliding PDF, it's just using Google's result with a different suffix after the 128-byte collision near the start.

Reply on news.ycombinator.com