From murdoch.duncan at gmail.com  Mon May 11 15:53:30 2015
From: murdoch.duncan at gmail.com (Duncan Murdoch)
Date: Mon, 11 May 2015 09:53:30 -0400
Subject: [Rd] Wrongly checked MD5 checksums in R 3.2.0's windows binary
In-Reply-To: <CANdJ3dWSaYQJ3avnwNaoduc08wBKzpNGBga=gkMy7MsrSiyX8Q@mail.gmail.com>
References: <CANdJ3dU=D8qriq2wO7tZb+UYWi3oiLxmC+TdV1yLQBJAOdf5Tg@mail.gmail.com>
	<21840.24595.738590.906123@stat.math.ethz.ch>
	<70B6F453-1F65-4C23-89CB-52597D3476E4@gmail.com>
	<55507125.20100@gmail.com>
	<CANdJ3dXCh7-BxF6Xii3Wa1UuHeUCoGJOdNepEzrwzRDBRcEB6A@mail.gmail.com>
	<5550AC18.6080706@gmail.com>
	<CANdJ3dWSaYQJ3avnwNaoduc08wBKzpNGBga=gkMy7MsrSiyX8Q@mail.gmail.com>
Message-ID: <5550B45A.7040504@gmail.com>

On 11/05/2015 9:35 AM, Tal Galili wrote:
> Hi Duncan,
> Thank you for the clarification. :)
>
> I ended up removing these files from being scanned in the updated 
> version of installr. I would rather focus on supporting an MD5 scan 
> that is based on what is listed in MD5 file itself (ignoring 
> exceptions that are not clearly stated in the file).
>

I'm not sure what the purpose is of your test, but if it is to detect 
modified files, that might not be a good strategy.  A malicious agent 
could install fake bin/R.exe or bin/Rscript.exe and not be caught.

Of course, if they knew to modify those two files but not any others, 
they would know enough to also install a fake MD5 file, and then there's 
basically nothing you could do.

Duncan



[Rd] Wrongly checked MD5 checksums in R 3.2.0's windows binary
Duncan Murdoch