Underscoring how weak the widely used MD5 hashing algorithm is , a software engineer has managed to replicate an attack that a powerful nation-state used in 2012 to intercept Microsoft's Windows Update mechanism.
Nathaniel McHugh ran open-source software known as HashClash to modify two separate images—one of funk legend James Brown and the other of R&B singer/songwriter Barry White—to produce the exact same MD5 hash (e06723d4961a0a3f950e7786f3766338). The exercise—known in cryptography circles as a hash collision —took just 10 hours and cost just 65 cents plus tax to complete, using an Amazon Web Services GPU instance. In 2007, cryptography expert and HashClashMarc Stevensestimated that it would take about a day to complete an MD5 collision using a cluster of PlayStation 3.
