Slashdot Mirror
Finnish Firm Claims Fake P2P Hash Technology
An anonymous reader writes "As reported by The Inquirer, a Finnish company known as Viralg Oy claim to have developed software that can create a junk file with the same hash as a genuine p2p download. This, according to the company, can altogether stop the sharing of copywritten files by flooding p2p networks with corrupt/junk data, which then spreads through the network, causing less and less of the original file to be available. However, with the resolve of the p2p userbase, is this software really going to 'beat all Peer 2 Peer pirates at their own game,' or simply prove a minor annoyance?"
People will always creatively find a way around everything!
I highly doubt this would work - the object of a P2P network is to "peer-review" the files that get transferred. If you get a crappy copy of a file, most people delete it. Therefore, when one searches, the most popular results will most likely be the correct file and not the bad one.
Bullshit. "Virtual Algorithms" my ass.
... it only takes most pirates (at most) a week to find a work around and everything is back to (pirating) normal.
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
Indeed. In order for example to do this with
BitTorrent, they would need to be able to
generate colisions in sha1 hashes. The
implications of which would go well beyond p2p.
Their site is down so I can't get any real details, but I think this is smoke and mirrors in any case.
I want a new world. I think this one is broken.
Use 2 (or more) different hashing algorithms on the file, and check the file size.
I'm pretty sure that should reduce the collisions to some stupidly small value.
Update Watch - Automatic software update notification
Don't most P2P programs use MD5? I was also under the assumption that P2P programs do a checksum on each piece of the file they receive, and if it's inaccurate it automatically re-downloads that part of the file. I've had pieces of a bittorrent download fail due to corruption and the client has just downloaded that part again.
Seems like this company's setup would only work in very specific circumstances, meaning it won't have much of an effect at all.
You have enemies? Good. That means you've stood up for something, sometime in your life. --Winston Churchill
And the best:
You cracked SHA-1. Oh well, time to switch to SHA-256
+++ MELON MELON MELON +++ Out of Cheese Error +++ redo from start +++
I'm sure that they just found some P2P client that has a weak hash and managed to make a generator for that. Then they are either morons that don't know there's more than one hash algorithm, or they do and are just pimping it to try and get money.
Either way, I give it about a 0 chance they figured out how to quickly find collisions in a strong hash space. If they had, they'd be talking to the NSA, not the RIAA.
If I have one of these files and share the hell out of it, I better not be contacted by RIAA. If this spreads, not only will it make sharing difficult, it will make tracking legitimate (haha) piracy more difficult to detect. This (sort of) reminds me of a more high tech version of the time everyone started changing the name of their tracks to things like "Br1tn3y Sp34rs" to evade blocked searches.
Using multiple hashes is a hash algorithm itself. If someone found a general way to crack hashes, then they'd be able to crack this new 'super' hash just as easily. All you'd really be doing is creating a hash with more bits. Might as well use the "best" hashing algorithm and increase the width.
autopr0n is like, down and stuff.
Let's just concede they can actually produce a junk file which has the same hash. I'll even skip over which hash - let's also say it's one of the useful ones.
I'd be tempted to step up the credentials for a file, say one hash for the entire file, and another for the first 1kb, and so on. It should get significantly harder with each additional verification point.
Here is a tool specifically designed to cripple the flow of data, how can it be thought of as anything but a virus? Should it work I could see TV and Movie studios using it surreptitiously to cripple net-based fledgling media companies.
This should be outlawed just like another intentionally malevolent software. Why shouldn't everyone write viruses and malware when the big guys do it and the government sanctions it. This is just the kind of thing that keeps web commerce from taking off to its full potential.
Letter To Iran
Safe money bets that horse.
The Spoon
Updated 6/28/2011
The hash is generally generated on the client side of the original uploading system - and the validity of the file can only be checked once the file has been fully downloaded. So to break the system, just modify one of the open soure clients to report a particular hash for some random file of the same size as the original. There isn't any need to go to the effort that these guys have.
Agree, this is more like news for the marketing and general folk who don't know what hash is. From the news post the implication is that they can generate another file with the same hash as a given file. If they had indeed found a crack in all the hash algorithms (all SHAs and MDs) the news wouldn't be about P2P but about a major breakthrough in cryptography.
I suspect your hard drive is failing.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
Wouldn't it not be the same size, though? "Wow, this Britney Spears MP3 is 5 times the size yet it has the same hash!"
Sure, you can find a collision, but finding a collision which has a size close enough to the more popular real file is a lot more difficult, I'd think.
For context, click Parent.
P2P clients, when they search for files, receive alleged hashes from where? The peers that claim to have them. And since most of these protocols have been reverse-engineered by now, I suspect that this program just combines a random-data generator with a multi-network untrustworthy P2P client. It'll sit on a network and respond to searches, report the expected filename, filesize, and hash (whatever algorithm is used), and wait for people to bite.
There is no technological way of verifying that the other peer is telling the truth (or at least there won't be unless the whole world implements some sort of Orwellian "Trusted Computing" requirement), aside from downloading the whole file and verifying it against the expected hash. No hash algorithms need be broken. I mean, once the whole file is downloaded, what does it matter to them whether the hash really matches? Why would even an idiot keep a downloaded file just because the program says it's verified and the size matches, if he can clearly see that the file doesn't work?
Signature.
The "noise" messages will bounce, and spammer will identify all the fake addresses. Won't work.
> So you could end up with a song that is a half-song, half-static type of thing?
I think that's called "Nine Inch Nails".
Because the vast, vast majority of P2P users are trying to get stuff for free, not create an alternative-media-distribution free-expression utopia. They're not going to do anything on anyone else's behalf because it does not directly benefit them or immediately help them get more free stuff faster.
P2P is a technology. Yes it can be used for copyright violations, just like a photocopy machine or tape recorder. But it also has amazing possibilities in terms of creating a universal organic archive. Crippling like this -- and through using lawsuits -- is an unnecessary attack on a system in its infancy.
The copyright issues will work themselves out -- until the 20th century human art and ingenuity survived for thousands of years without the ability to make millions selling recorded music and video. If p2p has a major effect on the entertainment industry's ability to profit (and I'm still not convinced that it really will), human art and culture will survive. And people will continue to find ways to make a living creating art.
untrue
2 examples.
1. I had a HDD slowly die. It corrupted files randomly, in this case pictures, where by several files would be readable and the rest although being there (can copy has a file size etc) they did not open. Probably this was only a few bytes in the file that got messed.
2. a hard drive that spins erratically can produce random wait times for certain things. if it was a really delicate fail, something like heat just a few degrees above a threshold, you could definaltly notice weird artifacts in the mp3s.
I had some video files that would have little skips in them because of a bad codec. could be that as well.
I've wondered this myself. Theoretically, if you MD5 a file *and* SHA1 a file, the complexity of matching both hashes is 288 bits. Basically, given a standard distribution, 1 out of every 2^128 files will match the MD5 of your file... and 1 out of every 2^160 of those will match the SHA1. (1/2^128)/2^160 = 1/2^288.
I'd really like to know if this interpretation is flawed. Even when hash algorithms are broken, if you parallelise them, you can still get enough bits of security to work. It seems to me that you would have to MD5 the file, generate a collision, SHA1 the file, generate a collision, and then check to see if your MD5 still matches.
Microsoft cheerleader, blue flag waving, you got a problem with that?
The RIAA can put out "evil clients" that find good files and lie to the tracker telling the tracker it's a bad file.
Unless the tracker double-checks the file itself, or has some way to trust the clients it's getting reports from, it's vulnerable to being lied to.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I don't know how the search functions work in Kazaa etc. but can't you just send match to all querys with a fake client? Is there real data integrity check built into Kazaa clients?
Quidquid latine dictum sit, altum sonatur.
> (X) Countermeasures should not involve sabotage of public networks
What public network is being sabotaged here? So an admin puts pages of fake email addresses on his server... how is that sabotage?
I think this particular anti-spam solution is useful. Sure, spammers don't care about invalid addresses, but this kind of thing must make life a little harder for them.
Sorry, that level of doublethink is only alowed for corporate lawyers. Your lawyer will be smacked down for trying it, since it is not a defense permitted to second-class citizens (see earlier post).
Freedom: "I won't!"