I have seen Dumitru Codreanu's presentation at the HITB 2010 in Amsterdam,
however, I can't find the PDF of his presentation right now.
He had some numbers what could he achieved on Graphics card and FPGA cards
to sign messages (brute-forcing the MD5 signatures until it looks like it
was signed by the originator). As far as I remember he said he was able to
produce couple of mails per hour, which does not seem to be a big number,
but then the malicious e-mail could be sent to as many targets as you
wanted to, so you could lure your victim to click on links and/or run the
executable attached to the e-mail. Also he only used a single card, whereas
if you have the fund you could use several in parallel to increase speed.
That was in 2010, not sure how far he went on this with the hardware boards
and knowledge.

http://conference.hitb.org/hitbsecconf2010ams/index.html%3Fpage_id=3D24.htm=
l

Some other interesting links I have just found:

http://research.microsoft.com/pubs/64588/hash_survey.pdf
http://www.youtube.com/watch?v=3DzEwWvVP_RU0
http://www.securitytube.net/video/419
http://www.md5decrypter.co.uk

Tamas




On 1 November 2013 18:04, Christopher Head <chead@chead.ca> wrote:

>
>
> Tamas Rudnai <tamas.rudnai@gmail.com> wrote:
> >Actually attackers are using MD5 weaknesses to modify and sign files
> >and
> >messages. Do not get me wrong, it is certainly much better than nothing
> >or
> >just a parity or CRC32 algorithm and definitely a good enough solution
> >to
> >check if the transmission or recovery of a file was successful.
> >However,
> >people are shifting from MD5 to SHA1 or even SHA256 for good reason.
> >MD5
> >can be generated on FPGAs or even on Graphics cards surprisingly fast,
> >and
> >that's what it makes it vulnerable to attack.
>
> I searched for information about preimage attacks on MD5, and all I could
> find was a 2009 theoretical paper with complexity 2^123, higher than
> practical AFAIK. I wasn't able to find anything about someone actually
> carrying out a serious MD5 preimage attack. Did you have an example in
> mind? I'm curious to read more now.
> --
> Christopher Head
> Sent from my phone; if you need a digital signature, ask for a resend.
>
> --
> http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
> View/change your membership options at
> http://mailman.mit.edu/mailman/listinfo/piclist
>



--=20
int main() { char *a,*s,*q; printf(s=3D"int main() { char *a,*s,*q;
printf(s=3D%s%s%s, q=3D%s%s%s%s,s,q,q,a=3D%s%s%s%s,q,q,q,a,a,q); }",
q=3D"\"",s,q,q,a=3D"\\",q,q,q,a,a,q); }
--=20
http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
View/change your membership options at
http://mailman.mit.edu/mailman/listinfo/piclist
.