5 ms·

Script to do instant MD5 collisions of any pair of PDFs

85 points by isp 8y ago

isp 8y ago
Announced by the author here: https://twitter.com/angealbertini/status/1075417521799528448 https://twitter.com/angealbertini/status/1075417521799528448 Commit: https://github.com/corkami/pocs/commit/3832f62d8aad64d541c5d1fee755f30c44535374 https://github.com/corkami/pocs/commit/3832f62d8aad64d541c5d... Readme: https://github.com/corkami/pocs/blob/master/collisions/README.md#pdf https://github.com/corkami/pocs/blob/master/collisions/READM... ("With this script, it takes less than a second to collide the 2 public PDF papers")
- simongr3dal 8y ago
  The author is also the person responsible for a lot of the polyglot files from the PoC||GTFO series: https://www.alchemistowl.org/pocorgtfo/ https://www.alchemistowl.org/pocorgtfo/
jgehrcke 8y ago
This has been possible for a long time, right? Is there anything particularly innovative about this approach which has not been done elsewhere?
- tyingq 8y ago
  It's been possible to create pairs of colliding PDF files. Taking any two existing PDFs and creating a colliding pair while keeping the same visible rendered output is probably what's new.
  - tialaramex 8y ago
    That's not difficult so I doubt it. For MD5 we have what's called a chosen prefix collision. Given a start of a file, you can get back two "next bits" of the file which are similar but slightly different, and both those files (the chosen prefix plus A or chosen prefix plus B) have the same MD5. Then because this is an MD family hash you can add any fixed suffix whatsoever to both and still get the same MD5. So you put A and B inside a part of the file that isn't visible but can influence a conditional test elsewhere. Then you use the conditional test to flow the two different outputs, all the rest of the file is the same. Some day this will definitely be possible with SHA1 and almost certainly (though it could be decades away) SHA256 too. SHA3 is different, despite the name, we might perhaps never find any way to collide it, and if we do it's not MD it's a sponge design, so you can't just add a suffix or the output diverges again.
  - diminoten 8y ago
    I don't think that's new either, I remember doing that in 2015, to demonstrate an issue.
    - tyingq 8y ago
      There's this, from 2015: https://news.ycombinator.com/item?id=8555079 https://news.ycombinator.com/item?id=8555079 And colliding SHA-1 in pdf form in 2017: https://news.ycombinator.com/item?id=13723892 https://news.ycombinator.com/item?id=13723892 Not saying you didn't, but I'm unable to find any earlier reference to making 2 arbitrary, existing pdf files collide with MD5.
      - diminoten 8y ago
        I must have done the first link's thing. But once you can do that, this isn't new. Assuming you can append garbage on a PDF, it's the same solution. Admittedly I know how easy it is to say, "That's obvious!" in hindsight, but... isn't it?!
        tyingq 8y ago
        It is more complex than just writing past the end of file with arbitrary garbage, as you can with a jpg. He explains the method here: https://github.com/corkami/pocs/blob/master/collisions/README.md#pdf https://github.com/corkami/pocs/blob/master/collisions/READM...
        krageon 8y ago
        The fact that he produced something easy to see helps cement in the mind of more people exactly how possible it is. It's a benefit not in the sense that it was impossible before, but rather a benefit in the sense that more people will really believe that it is possible.
        diminoten 8y ago
        I didn't say it wasn't a benefit, I said there is no new innovation here. I was kind of wrong, but only insofar as it uses a different way to embed arbitrary garbage in a PDF instead of directly at the end. The concept is still the same (as it has to be).
- mlindner 8y ago
  Yes it's been done for a long time and it's trivial to do so. It's a standard course project in many computer security courses.
saagarjha 8y ago
Also relevant, a PDF SHA-1 collider: https://github.com/nneonneo/sha1collider https://github.com/nneonneo/sha1collider
DoctorOetker 8y ago
sci-hub should really switch away from MD5 in their SQL dump if the future wants to be sure to be looking at the same (or same quality) article
femto113 8y ago
I note this script takes two existing PDFs as an input and produces two new PDFs that collide with each other as output, but they do not collide with either of the originals. Thus this does not enable the obvious attack of creating a PDF that contains different text but collides with an existing PDF that you do not control. It does enable some other forms of duplicity, but only if you are the source of both documents.

85 points by isp 8y ago

isp 8y ago

Announced by the author here: https://twitter.com/angealbertini/status/1075417521799528448 https://twitter.com/angealbertini/status/1075417521799528448 Commit: https://github.com/corkami/pocs/commit/3832f62d8aad64d541c5d1fee755f30c44535374 https://github.com/corkami/pocs/commit/3832f62d8aad64d541c5d... Readme: https://github.com/corkami/pocs/blob/master/collisions/README.md#pdf https://github.com/corkami/pocs/blob/master/collisions/READM... ("With this script, it takes less than a second to collide the 2 public PDF papers")

simongr3dal 8y ago
The author is also the person responsible for a lot of the polyglot files from the PoC||GTFO series: https://www.alchemistowl.org/pocorgtfo/ https://www.alchemistowl.org/pocorgtfo/

jgehrcke 8y ago

This has been possible for a long time, right? Is there anything particularly innovative about this approach which has not been done elsewhere?

tyingq 8y ago
It's been possible to create pairs of colliding PDF files. Taking any two existing PDFs and creating a colliding pair while keeping the same visible rendered output is probably what's new.
- tialaramex 8y ago
  That's not difficult so I doubt it. For MD5 we have what's called a chosen prefix collision. Given a start of a file, you can get back two "next bits" of the file which are similar but slightly different, and both those files (the chosen prefix plus A or chosen prefix plus B) have the same MD5. Then because this is an MD family hash you can add any fixed suffix whatsoever to both and still get the same MD5. So you put A and B inside a part of the file that isn't visible but can influence a conditional test elsewhere. Then you use the conditional test to flow the two different outputs, all the rest of the file is the same. Some day this will definitely be possible with SHA1 and almost certainly (though it could be decades away) SHA256 too. SHA3 is different, despite the name, we might perhaps never find any way to collide it, and if we do it's not MD it's a sponge design, so you can't just add a suffix or the output diverges again.
- diminoten 8y ago
  I don't think that's new either, I remember doing that in 2015, to demonstrate an issue.
  - tyingq 8y ago
    There's this, from 2015: https://news.ycombinator.com/item?id=8555079 https://news.ycombinator.com/item?id=8555079 And colliding SHA-1 in pdf form in 2017: https://news.ycombinator.com/item?id=13723892 https://news.ycombinator.com/item?id=13723892 Not saying you didn't, but I'm unable to find any earlier reference to making 2 arbitrary, existing pdf files collide with MD5.
    - diminoten 8y ago
      I must have done the first link's thing. But once you can do that, this isn't new. Assuming you can append garbage on a PDF, it's the same solution. Admittedly I know how easy it is to say, "That's obvious!" in hindsight, but... isn't it?!
      - tyingq 8y ago
        It is more complex than just writing past the end of file with arbitrary garbage, as you can with a jpg. He explains the method here: https://github.com/corkami/pocs/blob/master/collisions/README.md#pdf https://github.com/corkami/pocs/blob/master/collisions/READM...
      - krageon 8y ago
        The fact that he produced something easy to see helps cement in the mind of more people exactly how possible it is. It's a benefit not in the sense that it was impossible before, but rather a benefit in the sense that more people will really believe that it is possible.
        diminoten 8y ago
        I didn't say it wasn't a benefit, I said there is no new innovation here. I was kind of wrong, but only insofar as it uses a different way to embed arbitrary garbage in a PDF instead of directly at the end. The concept is still the same (as it has to be).
mlindner 8y ago
Yes it's been done for a long time and it's trivial to do so. It's a standard course project in many computer security courses.

saagarjha 8y ago

Also relevant, a PDF SHA-1 collider: https://github.com/nneonneo/sha1collider https://github.com/nneonneo/sha1collider

DoctorOetker 8y ago

sci-hub should really switch away from MD5 in their SQL dump if the future wants to be sure to be looking at the same (or same quality) article

femto113 8y ago

I note this script takes two existing PDFs as an input and produces two new PDFs that collide with each other as output, but they do not collide with either of the originals. Thus this does not enable the obvious attack of creating a PDF that contains different text but collides with an existing PDF that you do not control. It does enable some other forms of duplicity, but only if you are the source of both documents.