4 ms·
SHA1 is only used for uniqueness. You still need to have write access to repo to perform attack. If you already have write access you do not need to make collis
by Chyzwar 10y ago
SHA1 is only used for uniqueness. You still need to have write access to repo to perform attack. If you already have write access you do not need to make collision...
- groestl 10y agoExactly. Why waste the time to fabricate a collision when all you have to do is "accidentally" commit exploitable code? At least then you got plausible deniability.
- azernik 10y agoFor this particular attack - what if you do not have write access, but have sufficient social capital to get a pull request merged with a benign-seeming file?
- joatmon-snoo 10y agoIf we're just talking about this particular attack, the two files don't even resolve to the same SHA-1 in Git: $ sha1sum shattered* 38762cf7f55934b34d179ae6a4c80cadccbb7f0a shattered-1.pdf 38762cf7f55934b34d179ae6a4c80cadccbb7f0a shattered-2.pdf $ git hash-object shattered* ba9aaa145ccd24ef760cf31c74d8f7ca1a2e47b0 b621eeccd5c7edac9b7dcba35a8d5afd075e24f2
- acqq 10y agoAs soon as somebody invests a few $100k there are going to be such files. Now it's known how much it takes. That much. Luckily, there is also a known solution to detect that kind of files.