I'm far from being an expert in the IT security and I have this maybe naive question. Many downloadable files are deployed on websites together with the corresponding hash numbers to ensure their integrity. If a bad guy hacks the website and replaces the original file with its modified version, this can be detected because the calculated hash will be different from the hash provided with the file, right? But if the bad guy can replace the original file, why he can't replace the original hash number? So, he modifies the file together with the hash, and everybody downloads the modified file and hash and the fraud cannot be detected, right? Where is the catch here?
merged by Graham Lee May 26 '11 at 8:44
this question was merged with Does hashing a file from an unsigned website give a false sense of security? because it is an exact duplicate of that question.