{"id":10278,"date":"2015-10-19T11:11:58","date_gmt":"2015-10-19T15:11:58","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=10278"},"modified":"2021-03-01T12:11:59","modified_gmt":"2021-03-01T17:11:59","slug":"security-week-42","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/security-week-42\/10278\/","title":{"rendered":"Security Week 42: SHA-1 collisions, a real hack for routers, Android\/Security\/Gloom"},"content":{"rendered":"

When find yourself caught in the eye of the storm, you might have problems understanding what has really happened. While stuck in a traffic jam, you would never know it happened because of an accident, until you reach the spot seeing two jet pilots whose wreckage occupied three lanes. Until then, you simply don\u2019t have enough information to make a correct assumption.<\/p>\n

It happens all the time in the infosec industry: this topic is complex and contains lots of details and peculiarities, and due to this complexity the results of certain research might have real leverage years in the future.<\/p>\n

This week, our three top pieces of security news have nothing in common, besides meaningful sub-context. When you have no experience in the industry, you cannot properly evaluate the importance of some of the security events or might miss some critical details.<\/p>\n

I will try, as hard as I can, to explain this importance with apprehensible examples, as sub-context is vague and flexible, so that anyone could see something different when assessing it. So, sit back and relax with this week\u2019s edition of Security Week, titled Breaking Covers. As always, our Threatpost<\/a> editorial staff handpicks the three most important news items of the week, which I ruthlessly comment. All the previous editions are available here<\/a>.<\/p>\n

The search for SHA-1 collisions got immensely cheaper<\/h3>\n

News<\/a>. Predictions<\/a> by Jesse Walker made three years ago. The new research<\/a> which changed the take on the security of this algorithm.<\/p>\n

Those who advanced in their Linux exploration a bit further than automatically setting up Ubuntu know that the system prompts one to carefully read instructions. I mean, I would, of course, first try to Google a doc with a sequence of commands, but in some cases everything would fail to work properly and then would totally break down.<\/p>\n

This news is similar: without an at least short orientation, the topic is not that easy to apprehend. Whereas it is, by far, the most complex topic in our Security Week series to date, I would dare to explain what it means in simple words.<\/p>\n

\"cat<\/a>

Well, I\u2019ll try something like this<\/p><\/div>\n

SHA-1 is a cryptographic hashing algorithm. This algorithm could be fed an unlimited sequence and produce a 160-bit piece of data, which then can be used to identify the initial data array. This is impossible if you don\u2019t have that initial data array \u2013 otherwise you cannot simply restore the information from the hash, as you cannot turn minced meat into a whole steak.<\/p>\n

More precisely, it SHOULD be impossible, even if you have a password like \u2018123456\u2019. There are two requirements to any of such algorithms: the impossibility of getting the initial data if you only have the hash, and the impossibility of getting a match to the data array so they both have the same hash.<\/p>\n

To be precise, there IS a possibility to do both. The thing is that it means so much heavy lifting computing that it\u2019s not even worth a try. So, you might buy a supercomputer and entrust it with the task of breaking the cipher. Then, 240 years later, it says the answer is 42, but at the moment you wouldn\u2019t care less.<\/p>\n

Yet, there\u2019s the rub. First, PCs continue to gain more and more computing power. Second, researchers are constantly seeking bypasses to break cryptographic algorithms. It\u2019s way simpler to find a collision to an encryption algorithm rather than decrypt the initial data array.<\/p>\n

\n

Practical SHA-1 Collision Months, Not Years, Away via @threatpost<\/a> https:\/\/t.co\/fU5VQUjLI4<\/a><\/p>\n

\u2014 Kaspersky (@kaspersky) October 9, 2015<\/a><\/p><\/blockquote>\n