{"id":200082,"date":"2017-02-23T17:07:58","date_gmt":"2017-02-23T15:07:58","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=200082"},"modified":"2017-02-23T17:09:34","modified_gmt":"2017-02-23T15:09:34","slug":"drop-what-youre-doing-and-remove-sha-1-from-all-your-apps","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/200082-drop-what-youre-doing-and-remove-sha-1-from-all-your-apps.html","title":{"rendered":"Drop what you&#8217;re doing and remove SHA-1 from all your apps"},"content":{"rendered":"<p>The cryptographic hashing function SHA-1 has fallen to a collision attack, after\u00a0being considered theoretically unsafe <strong><a href=\"https:\/\/mybroadband.co.za\/news\/security\/155272-paying-your-tv-licence-online-watch-out-for-this-security-flaw.html\">for years<\/a><\/strong>.<\/p>\n<p><strong><a href=\"https:\/\/shattered.io\" target=\"_blank\">SHAttered.io<\/a>\u00a0<\/strong>published details of the attack,\u00a0including a paper by\u00a0Marc Stevens and other researchers.<\/p>\n<p>The researchers were\u00a0able to execute an identity-prefix attack, which means they could generate two messages with the same\u00a0SHA-1 hash.<\/p>\n<p>&#8220;It is now possible to craft two colliding PDF files and obtain a SHA-1 digital signature on the first PDF file which can also be abused as a valid signature on the second PDF file,&#8221; they said.<\/p>\n<p>The attack comes after a two-year collaboration between researchers at\u00a0the Centrum Wiskunde &amp; Informatica in the Netherlands and Google&#8217;s\u00a0security, privacy, and anti-abuse research group.<\/p>\n<p>It is unlikely that\u00a0HTTPS-secure websites\u00a0are\u00a0affected, but the\u00a0Git version control system is. Email encryption\/signing programs may be, too.<\/p>\n<p>&#8220;Git strongly relies on SHA-1 for the identification and integrity checking of all file objects and commits.&#8221;<\/p>\n<p>&#8220;It is essentially possible to create two Git\u00a0repositories with the same head commit hash and different contents, say a benign source code and a backdoored one.&#8221;<\/p>\n<p>&#8220;An attacker could potentially serve either repository to targeted users. This will require attackers to compute their own collision.&#8221;<\/p>\n<p>To compute two colliding hashes\u00a0using\u00a0Amazon Web Services would cost around $110,000, said the researchers.<\/p>\n<h3 class=\"my-4\">Now read:\u00a0<a href=\"http:\/\/mybroadband.co.za\/news\/security\/191610-biggest-security-news-in-south-africa-in-2016.html\">Biggest security news in South Africa in 2016<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>The cryptographic hashing function SHA-1 has fallen to a collision attack, after being considered theoretically unsafe for years.<\/p>\n","protected":false},"author":23,"featured_media":145549,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[41554,41546,41550,167,41548,41552,41544,41556],"class_list":["post-200082","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-ange-albertini","tag-collision-attack","tag-elie-bursztein","tag-google","tag-marc-stevens","tag-pierre-karpman","tag-sha-1","tag-yarik-markov"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/200082"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=200082"}],"version-history":[{"count":2,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/200082\/revisions"}],"predecessor-version":[{"id":200096,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/200082\/revisions\/200096"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/145549"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=200082"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=200082"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=200082"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}