6 ms·

It isn't? Is it not possible to be tricked into downloading a malicious binary that you then execute on your computer?

by frenchman99 6y ago

calvinmorrison 6y ago
Unlike the Photoshop 2020 WareZ Cracked Unlocked 2020 Xvid Torrentz WZ FUN.torrent, that I just downloaded
- vermilingua 6y ago
  Yes, because warez is the only valid use of bittorrent. Most Linux distros offer an installation iso via torrent, large files with many blocks. If you can change just a small part of those files, you’ve got compromised machines before the install even begins.
  - mlyle 6y ago
    Most of the practical hash attacks we've seen allow one to create two chunks of data that hash to the same thing, not to collide with an arbitrary other block. This greatly limits the attack scenarios we need to worry about. (That is, we've got practical collision attacks emerging for SHA1, not pre-image attacks).
  - userbinator 6y ago
    You would need to create a colliding pair (because the single existing one is so well known), itself not a simple thing, and create the two executables specifically with additional code discriminating between the two pairs to do two different things. You can't replace existing files with this attack, which means you'd have to create your own Linux distro with this extra "feature" and can't attack existing ones.
loeg 6y ago
I don't think so. 1. The user trusts the source of the .torrent file. 2. A malicious peer makes a preimage attack in some block in an executable file with contents containing some malicious executable payload. 3. The executable wasn't signed, or the targeted block must include executable headers. 4. Some peers get the malicious exe, some don't. The (2) step is still hard — preimage attacks on SHA1 are still expensive. And it is probably much easier to bypass SHA1/SHA256 entirely by just uploading a malicious torrent directly and hoping (1) still applies.
- userbinator 6y ago
  Remember that for cryptographers, "practical" or "broken" doesn't really mean "everyone can do it", and AFAIK there has only been one publicly released collision pair for SHA1, which also took an enormous amount of time and money to find. Even MD5, for which you can generate colliding blocks in seconds on an average PC, is still quite resistant to preimage attacks. In other words, even after spending the resources to find a colliding block, you'd also need to create both files with the same hash, and can't simply collide existing torrents' files and replace them with malicious ones.
- yyyk 6y ago
  You're assuming a malicious peer, but what about a malicious seeder? One could take an existing unsigned executable, add in NOPs and no one would notice (same thing for certain noises in audio/video files). Since there's some control over the original hash value, executing step (4) is not exactly a preimage attack, it should be a bit easier.
  - loeg 6y ago
    If the seeder is malicious, there's no need to attack SHA1 at all. The seeder can't control which peers get which versions of any identical-SHA blocks — your target peer may share the bad block — so it seems easier to just upload the malicious content to everyone.

It isn't? Is it not possible to be tricked into downloading a malicious binary that you then execute on your computer?

calvinmorrison 6y ago

Unlike the Photoshop 2020 WareZ Cracked Unlocked 2020 Xvid Torrentz WZ FUN.torrent, that I just downloaded

vermilingua 6y ago
Yes, because warez is the only valid use of bittorrent. Most Linux distros offer an installation iso via torrent, large files with many blocks. If you can change just a small part of those files, you’ve got compromised machines before the install even begins.
- mlyle 6y ago
  Most of the practical hash attacks we've seen allow one to create two chunks of data that hash to the same thing, not to collide with an arbitrary other block. This greatly limits the attack scenarios we need to worry about. (That is, we've got practical collision attacks emerging for SHA1, not pre-image attacks).
- userbinator 6y ago
  You would need to create a colliding pair (because the single existing one is so well known), itself not a simple thing, and create the two executables specifically with additional code discriminating between the two pairs to do two different things. You can't replace existing files with this attack, which means you'd have to create your own Linux distro with this extra "feature" and can't attack existing ones.

loeg 6y ago

I don't think so. 1. The user trusts the source of the .torrent file. 2. A malicious peer makes a preimage attack in some block in an executable file with contents containing some malicious executable payload. 3. The executable wasn't signed, or the targeted block must include executable headers. 4. Some peers get the malicious exe, some don't. The (2) step is still hard — preimage attacks on SHA1 are still expensive. And it is probably much easier to bypass SHA1/SHA256 entirely by just uploading a malicious torrent directly and hoping (1) still applies.

userbinator 6y ago
Remember that for cryptographers, "practical" or "broken" doesn't really mean "everyone can do it", and AFAIK there has only been one publicly released collision pair for SHA1, which also took an enormous amount of time and money to find. Even MD5, for which you can generate colliding blocks in seconds on an average PC, is still quite resistant to preimage attacks. In other words, even after spending the resources to find a colliding block, you'd also need to create both files with the same hash, and can't simply collide existing torrents' files and replace them with malicious ones.
yyyk 6y ago
You're assuming a malicious peer, but what about a malicious seeder? One could take an existing unsigned executable, add in NOPs and no one would notice (same thing for certain noises in audio/video files). Since there's some control over the original hash value, executing step (4) is not exactly a preimage attack, it should be a bit easier.
- loeg 6y ago
  If the seeder is malicious, there's no need to attack SHA1 at all. The seeder can't control which peers get which versions of any identical-SHA blocks — your target peer may share the bad block — so it seems easier to just upload the malicious content to everyone.