Drop what you’re doing and remove SHA-1 from all your apps
The cryptographic hashing function SHA-1 has fallen to a collision attack, after being considered theoretically unsafe for years.
SHAttered.io published details of the attack, including a paper by Marc Stevens and other researchers.
The researchers were able to execute an identity-prefix attack, which means they could generate two messages with the same SHA-1 hash.
“It is now possible to craft two colliding PDF files and obtain a SHA-1 digital signature on the first PDF file which can also be abused as a valid signature on the second PDF file,” they said.
The attack comes after a two-year collaboration between researchers at the Centrum Wiskunde & Informatica in the Netherlands and Google’s security, privacy, and anti-abuse research group.
It is unlikely that HTTPS-secure websites are affected, but the Git version control system is. Email encryption/signing programs may be, too.
“Git strongly relies on SHA-1 for the identification and integrity checking of all file objects and commits.”
“It is essentially possible to create two Git repositories with the same head commit hash and different contents, say a benign source code and a backdoored one.”
“An attacker could potentially serve either repository to targeted users. This will require attackers to compute their own collision.”
To compute two colliding hashes using Amazon Web Services would cost around $110,000, said the researchers.
Now read: Biggest security news in South Africa in 2016
Loading ...