3 ms·
Could someone explain what exactly the attack vectors would be here? I always assumed the hashes were there just for collision resistance. It would seem that an
by c7b 4y ago
Could someone explain what exactly the attack vectors would be here? I always assumed the hashes were there just for collision resistance. It would seem that any attacks involving an attacker introducing malicious code through a collision would require a level of system access that would enable more dangerous attacks with less effort and/or less detectability. Curious to learn.
- ilyt 4y agoWell, various variants of spectre attacks were also thought as theoretical decades ago. That's the problem, you never can predict how crafty attacker might abuse the vector of attack.
- Dylan16807 4y agoA basic attack idea is getting someone to accept a patch, while poisoning other servers with an evil version of the patch with the same hash. Then some of the people updating will get the evil version, maybe almost everyone or maybe very specific targets. Poisoning servers, in the most worrying case, just requires the ability to get your evil file into any commit on any branch, and possibly in any repo on the server if they have certain optimizations.