This is what confuses me. How would an attacker use these results against a target? Wouldn't they need to get the modified SHA-1 library onto the target's systems?