4 ms·
this isn't quite true, bittorrent have checksums for each piece in the torrent, I not saying its impossible to do but its significantly harder than just finding
by chaosfox 10y ago
this isn't quite true, bittorrent have checksums for each piece in the torrent, I not saying its impossible to do but its significantly harder than just finding 2 files with the same hash.
- deleted 10y ago[deleted]
- cesarb 10y agoWouldn't that make the attack easier, since you just have to manufacture a pair of pieces with the same hash, instead of having to make the whole file have the same hash?
- chaosfox 10y agothat depends on the attacker objective, if you just want to trash the file you can just search for any piece that have a hash collision, but if you want to turn the file into a malware you will need to modify the file in a specific way, possibly spanning multiple pieces, and there's less room for fuzzing the hash.
- heinrich5991 10y agoPeople do exploits by changing 1 bit! I'm sure you can distribute malware using just one chunk, given some cleverness.
- rocqua 10y agoAs mentioned else were in this thread, you can put a lot of the payload outside the single collision piece. People are unlikely to go looking for executable code inside a video. All you need for the colliding pieces is for one to trigger the payload and the other not to trigger the payload.
- andai 10y agoDoes bt have checksums for pieces and files? I thought it was only pieces.
- chaosfox 10y agoit is only pieces. pieces can potentially span multiple files.
- mabbo 10y agoOkay, so the challenge gets broken down into creating a single piece that hides the malware. Even better really, I can join the network with a fleet of hosts all sharing that particular piece at a very high rate- but it's my bad version of it. Those hosts can focus on just distributing the malware, rather than the whole file.