Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm far from being an expert in the IT security and I have this maybe naive question. Many downloadable files are deployed on websites together with the corresponding hash numbers to ensure their integrity. If a bad guy hacks the website and replaces the original file with its modified version, this can be detected because the calculated hash will be different from the hash provided with the file, right? But if the bad guy can replace the original file, why he can't replace the original hash number? So, he modifies the file together with the hash, and everybody downloads the modified file and hash and the fraud cannot be detected, right? Where is the catch here?


merged May 26 '11 at 8:44

This question was merged with Does hashing a file from an unsigned website give a false sense of security? because it is an exact duplicate of that question.