They were a big deal on other networks using for example MD5, due to collisions malicious clients would just send you garbage parts. You wouldn't notice until finishing the complete download just to see that the file was corrupted.

It isn't? Is it not possible to be tricked into downloading a malicious binary that you then execute on your computer?

Unlike the Photoshop 2020 WareZ Cracked Unlocked 2020 Xvid Torrentz WZ FUN.torrent, that I just downloaded

Yes, because warez is the only valid use of bittorrent.

Most Linux distros offer an installation iso via torrent, large files with many blocks. If you can change just a small part of those files, you’ve got compromised machines before the install even begins.

Most of the practical hash attacks we've seen allow one to create two chunks of data that hash to the same thing, not to collide with an arbitrary other block. This greatly limits the attack scenarios we need to worry about.

(That is, we've got practical collision attacks emerging for SHA1, not pre-image attacks).

You would need to create a colliding pair (because the single existing one is so well known), itself not a simple thing, and create the two executables specifically with additional code discriminating between the two pairs to do two different things. You can't replace existing files with this attack, which means you'd have to create your own Linux distro with this extra "feature" and can't attack existing ones.

I don't think so.

1. The user trusts the source of the .torrent file.

2. A malicious peer makes a preimage attack in some block in an executable file with contents containing some malicious executable payload.

3. The executable wasn't signed, or the targeted block must include executable headers.

4. Some peers get the malicious exe, some don't.

The (2) step is still hard — preimage attacks on SHA1 are still expensive.

And it is probably much easier to bypass SHA1/SHA256 entirely by just uploading a malicious torrent directly and hoping (1) still applies.

Remember that for cryptographers, "practical" or "broken" doesn't really mean "everyone can do it", and AFAIK there has only been one publicly released collision pair for SHA1, which also took an enormous amount of time and money to find.

Even MD5, for which you can generate colliding blocks in seconds on an average PC, is still quite resistant to preimage attacks.

In other words, even after spending the resources to find a colliding block, you'd also need to create both files with the same hash, and can't simply collide existing torrents' files and replace them with malicious ones.

You're assuming a malicious peer, but what about a malicious seeder? One could take an existing unsigned executable, add in NOPs and no one would notice (same thing for certain noises in audio/video files).

Since there's some control over the original hash value, executing step (4) is not exactly a preimage attack, it should be a bit easier.

If the seeder is malicious, there's no need to attack SHA1 at all. The seeder can't control which peers get which versions of any identical-SHA blocks — your target peer may share the bad block — so it seems easier to just upload the malicious content to everyone.

They aren’t? So someone can craft a payload that contains a rootkit or similar and has the same name and hash as the thing you wanted, and this is okay? (Disclaimer: I don’t know all that much about how hashes are used internal to the protocol)

The weakness is a collision, not a pre-image attack. That means that a pair of payloads can be crafted together, one innocent and one malicious, that have the same hash. But it is not feasible to take a given file and make a new malicious payload with a matching hash.

So if you get your hash from whoever made the original binary, you can know that any binary with a matching hash is fine. But it could be a problem if someone creates a new pair of binaries and uploads the hash to TPB. You might see lots of good reviews from people who got the innocent version, but then the peers you connect to send you a malicious version with a matching hash.

The vast majority of data shared over bittorrent is not executable.

So your scenario becomes an issue if you're downloading executable data that you deem :trusted: without any additional verification besides the hash itself. If that's the case, you have bigger worries than the hash.

Or if there's a vulnerability in a popular media player.