Question

If an online security company distributed a game they made via their website and allowed users to verify the game they were downloading from their website was the official version by using an MD5 hash on it. When one day they discovered that their game had been replaced by an imposter game with the same hash.

How was this possible?

Also, what would be 3 recommendations to that same company to improve its method of software distribution?

And finally, what would the technical risk be for users who downloaded the imposter game?

Answer 1

This is the major problem faced by everyone who are trying to get new implementations.

As the above problem states,

It is possible that the other company/companies can use the same hash you are using. It's better you can go against if you have any copyrights on your hash.

If there are no copy rights then you can go to another hash which would work more efficient than your old hash and try to aquire copy rights for the new hash.