Re: [Revctrl] colliding md5 hashes of human-meaningful

linux@horizon.com wrote:

quoted

So the problem is totally different from the way git uses a hash. In the 
git model, an attacker by definition cannot control both versions of a 
file, since if he controls just _one_ version, he doesn't need to do the 
attack in the first place!
   

You are insufficiently paranoid, Grasshopper.

The basic attack goes like this:

- I construct two .c files with identical hashes.  One is something
 useful; perhaps a device driver for some piece of hardware that my
 desired target has.  The other is similar, but includes a remote
 root explot.

 (With an n-bit hash and an automated way to make harmless changes
 to source files, I can generate 2^(n/2) variants of each and expect to
 get a match, even in the absence of a better attack.)

 

And you get lots of nonsense in the new file.

- I submit the first one to the Linux kernel.  It's valid and gets
 merged.

 

And funny as it is, when the hole is found you're busted. Or at least
the first person responsible.
You probably couldn't shadow yourself enough not to get caught.

- A kernel release, including the "interesting" driver, gets made and
 sprinkled with holy penguin pee.  Signatures, hashes, and all that.

 

Which mean that you can't change your name on the project. See above.

- Through various means (possibly just running a kernel download mirror,
 or possibly by splicing into my target's upstream Internet connection),
 I substitute the malware file for the real source code.

 

If you can splice into the connection, you can put there anything you want,
including another kernel and any amount of exploits. Even with SSH.
Ever heard of man-in-the-middle attacks?

With high-grade security you won't be able to splice into the connection,
as it'll be fully encrypted (with HTH key exchange) and/or randomised using things like EFF's Tor.
Then they can check with kernel.org or any other mirror.

- My target verifies all the hashes and signatures, decides that this "Linus"
 person signing it is trustworthy, and compiles and installs the kernel.
 

And they're so unforseeing that they don't check the sources of the
drivers they use.
Funny. And if they don't use it, you'll have a problem with enabling
your exploit.
Your best target would be a scheduler, but that's heavily scrutinised.

- I walk in my back door and do suitable rude things.

 

Like going to jail.

The point is, it *is* possible for an attacker to control both versions of
a file.  The reason he needs to do the attack is that one version looks
legitimate and the other includes a Nasty Surprise.
 

It is in theory. Tell someone when you mount such an attack on anybody.

AstralStorm