Please excuse me if I don't use proper terminology, I'm a lawyer and trying to get more information about something my son has pointed out to me.

In Germany, law enforcement agencies use enhanced versions of Emule to search for kiddyporn uploaders. Basically, they're looking for the IPs of people offering files having file sizes and hashes that correspond to known illegal movies, and if they find those, they have the provider match the IP address to the customer to conduct house searches etc. They say the probability of a different file having the same hash is very much lower than the probability of two fingerprints being identical, so it's unnecessary to download the whole file and check if it is indeed the correct one.

(Please note that this alone isn't sufficient for a conviction if the house search results in nothing, but the search, seizure of computers and other hardware etc. along with the psychological pressure is still not something you'd want to experience.)

When I discussed this with my son to understand the details, he told me this line of thought was flawed. He said that Emule uses MD4 hashes, which are considered insecure. So, to stay in the fingerprint analogy, just like you can craft a latex glove having the fingerprints you want/need, you could easily take a harmless file (think cute cat picture), inflate its size in a way that the additional bytes cause it to have a specific MD4 hash, give it to the neighbor you hate, and if the neighbor shares that file on Emule, he'd be in for a very nasty surprise.

Googling for "MD4 insecure" yields a lot of answers which I honestly don't understand, that's why I'm asking here.

  • Is it possible at all to create a fake file in the way described above?
  • Are there tools out there that would allow a non-technical person to create such a file without much effort?
  • If there are no such tools, how long would it take a dedicated, skilled person to create one?
  • Are there any records that this has, ever, been attempted, successfully or unsuccessfully?
  • "the probability of a different file having the same hash is very much lower than the probability of two fingerprints being identical" is only true if you do not have control over file creation or modification. To further the analogy, if we try to breed people to have the same fingerprint, it might take many generations, but when talking about computers, the time between generations is tiny. To defeat this detection mechanism, all someone has to do is to make the tiniest edit to the file, and the hashes will not match. – schroeder Mar 14 '18 at 9:25

There are different levels of insecurity in hashes.

The first is a collision attack where you can create two different files that result in the same hash. In order to use this in the attack you describe, the attacker would need to create two files which share the same hash: one which contains the illegal content and another which contains harmless content. The attacker could then somehow distribute the file with the illegal content in the hope that it will be tracked by law enforcement and then distribute the innocent file to the neighbor in the hope that he shares it and then get blamed by law enforcement.

Creating a collision for MD4 can be done very fast according to Wikipedia.

The other and harder attack is a pre-image attack. In this case, the attacker only knows the hash (or maybe has a file with the hash) and then tries to create a new file which results in the same hash. This is much harder than creating a collision (where the resulting hash value does not matter, it only needs to be the same for both inputs) but it is still feasible with MD4 as shown already in 2008. But the computation power needed for this is not trivial and an attack shown in 2010 has a complexity of about 295 which is not in reach of the average attacker.

Apart from that the attacker is further limited since the MD4 is for a fixed-size chunk of the file so the attacker must stay within this limit when creating the attack.

Because of this, I don't think that a preimage attack can be used to blame an innocent neighbor since it is too costly for the attacker to execute. But it is probably doable in theory. A hash collision attack is more likely but in this case, the attacker needs to "seed" law enforcement with some specifically prepared illegal content first.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.