Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

For this particular attack - what if you do not have write access, but have sufficient social capital to get a pull request merged with a benign-seeming file?


If we're just talking about this particular attack, the two files don't even resolve to the same SHA-1 in Git:

    $ sha1sum shattered*
    38762cf7f55934b34d179ae6a4c80cadccbb7f0a  shattered-1.pdf
    38762cf7f55934b34d179ae6a4c80cadccbb7f0a  shattered-2.pdf

    $ git hash-object shattered*
    ba9aaa145ccd24ef760cf31c74d8f7ca1a2e47b0
    b621eeccd5c7edac9b7dcba35a8d5afd075e24f2


As soon as somebody invests a few $100k there are going to be such files. Now it's known how much it takes. That much.

Luckily, there is also a known solution to detect that kind of files.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: