3 ms·

From what I've heard it's as simple as injecting the necessary garbage into a comment to fit the required hash for modified code.

• jandrese 4y ago
  The comment full of random garbage will probably look weird to a human, but by the time a person is looking at the code it will probably be too late. But you could also hide it as a fake lookup table or inline XPM or something like that.
• prepend 4y ago
  > as simple as injecting the necessary garbage into a comment to fit the required hash for modified code. This seems true yet there are no demos or documented attacks using this method. I think practically speaking it’s kind of a pain to do.
• bawolff 4y ago
  There is a big difference between having 2 file with the same garbage comment but different content that have the same hash and creating a new file that had a garbage comment and has the same hash as some other file not chosen by the attacker. (preimage vs collision). Sha1 has a collision attack. We are far away from a preimage attack
  • layer8 4y ago
    There is a middle course: You could get a pull request accepted with good content, but including a sensible comment whose exact wording you can choose, so later you can replace the contents of that commit with malicious code and a garbage comment. Such a collision is easier to create than a preimage attack (because you have some control over the preimage), but harder than if you could choose the preimage arbitrarily (which wouldn’t be accepted in the pull request). I admit that I have no idea how to quantify the difference in difficulty.