Taking advantage of MD5 .. for real..

Recently, news about md5 being broken started circulating again, along with the news came along a lot of speculation and misinformation about what the new (and not so new) found attacks can really be used for.
Well, as always, gera (aka Gerardo Richarte) did something real and useful, he created very quickly a presentation he gave at pacsec. The presentation entitled "MD5 to be considered harmful today" can be found here.
It is a very cool presentation, the slides are not very descriptive if you are not familiar with
md5 and the issue in question (they're only slides after all, not a paper), but he did a lot of cool
things to understand and reproduce (most things he did I did not get :)) what the publicated paper with the new attack was actually saying; the paper was only a page long and only contained a table with some collisions and a very brief explanation.

He did something even better; he created a lot of collisions. For example, he created TWO EXECUTABLE FILES THAT HAVE THE SAME MD5 HASH BUT ARE TOTALLY DIFFERENT APPLICATIONS, that's useful, I say!.
You can take a look at the files here:

• Two executable files with the same MD5 hash, crc32, checksum32 and checksum16
  
• Two executable files with the same MD5 hash
  
• Eight files with the same MD5 hash

Attack Trees are .. mm.. fun...

This is a screenshot from the demo found on Amenaza.com, a company that builds a
software to create Attack trees.
Isn't it great what you can do with these tools?