Re: trojans on ftp sites

[spaf () cs purdue edu (Gene Spafford)]

Simple checksums don't really help -- they are easy to duplicate in any
arbitrary file.  To be of any use, one would need to include a message
digest (a.k.a., secure hash) such as MD5 or Snefru.

That raises problems of standardization, portability, and cpu cycles.
Plus, what do you do it on?  The source file?  The compressed file?
The gzip'ed file?  Each would give a different value, and not every
site has all three.  If you want to uncompress each file, run Snefru
on it, then delete the decompressed version, we are talk serious CPU
load....

If you want more info, you can see some of the discussion of checksums
and message digests in the Tripwire design document, and the
references it cites.

--spaf