Full Disclosure mailing list archives
Re: [Security Advisory] Backdoor Discovered inImmunity Debugger
From: monikerd <monikerd () gmail com>
Date: Fri, 10 Aug 2007 18:53:31 +0200
Valdis.Kletnieks () vt edu wrote:
On Fri, 10 Aug 2007 09:25:11 +0200, monikerd said:However off course the md5 hashes don't really say anything. Except that you would be able to verify that your copy is the one you obtained.If you are unsure if your copy is the one you obtained, you have bigger issues. ;) An MD5 hash *will* however verify (to a fair extent, modulo intended attacks) if the copy you have is identical to the copy that was originally shipped (if they don't match, it shows that the copy you obtained isn't the one originally shipped). Yes, I'm splitting hairs here - but in cryptography, such hairs are often the basis of the security. So it's important to keep straight which bits are which....
clearly that was a typo, which originated from restructuring the sentence a few times. the point is that md5 *is* broken, when used in this way. You can not verify that your copy is the one that was _originally_ shipped. You can't easily make a file with the same hash as a existing file. However you *can* manipulate and .exe into 2 executables that are different but hash to the same. One could be shipped to almost everybody, and be verified to be clean. The server could however serve up the evil .exe to certain IP addresses, and if they actually did spend time to check the MD5 it wouldn't make them any wiser Basically this is a slightly far fetched scenario. Still it's not impossible, an hence we should use other algorithms for this task. Or use several hashes. Md5 is broken in this way. I'm sorry I keep repeating myself, and i promise i will not do it again. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [Security Advisory] Backdoor Discovered in Immunity Debugger goudatr0n (Aug 09)
- Re: [Security Advisory] Backdoor Discovered inImmunity Debugger J. M. Seitz (Aug 09)
- Re: [Security Advisory] Backdoor Discovered in Immunity Debugger Jared DeMott (Aug 09)
- Re: [Security Advisory] Backdoor Discovered in Immunity Debugger nnp (Aug 09)
- Re: [Security Advisory] Backdoor Discovered inImmunity Debugger J. M. Seitz (Aug 09)
- Re: [Security Advisory] Backdoor Discovered inImmunity Debugger cocoruder . (Aug 09)
- Re: [Security Advisory] Backdoor Discovered inImmunity Debugger monikerd (Aug 10)
- Re: [Security Advisory] Backdoor Discovered inImmunity Debugger Valdis . Kletnieks (Aug 10)
- Re: [Security Advisory] Backdoor Discovered inImmunity Debugger monikerd (Aug 10)
- Re: [Security Advisory] Backdoor Discovered inImmunity Debugger monikerd (Aug 10)