2 ms·
For this particular attack - what if you do not have write access, but have sufficient social capital to get a pull request merged with a benign-seeming file?
by azernik 10y ago
For this particular attack - what if you do not have write access, but have sufficient social capital to get a pull request merged with a benign-seeming file?
- joatmon-snoo 10y agoIf we're just talking about this particular attack, the two files don't even resolve to the same SHA-1 in Git: $ sha1sum shattered* 38762cf7f55934b34d179ae6a4c80cadccbb7f0a shattered-1.pdf 38762cf7f55934b34d179ae6a4c80cadccbb7f0a shattered-2.pdf $ git hash-object shattered* ba9aaa145ccd24ef760cf31c74d8f7ca1a2e47b0 b621eeccd5c7edac9b7dcba35a8d5afd075e24f2
- acqq 10y agoAs soon as somebody invests a few $100k there are going to be such files. Now it's known how much it takes. That much. Luckily, there is also a known solution to detect that kind of files.