Why do repeated downloads for Google Chrome setup have each time different hashes?

3

I've tried downloading the setup files for a standalone offline installation version several times in rapid succession. Each next file has an identical size but a different hash. Why is that?

Do they embed some sort of a user identifier into each next download?

The same happens for both EXE and MSI standalone installers.

P.S. I've also noticed that the files have a digital signature with a past date (6 days ago). That means they are generating files on the fly on a machine that is simulated to have a past date. In my book this qualifies as fraud.

guest

Posted 2014-09-05T08:55:43.087

Reputation: 47

How are you calculating hashes? What about other browsers? Where are you downloading from? – gronostaj – 2014-09-05T09:05:28.980

Different browsers (IE, Firefox), downloading directly from google.com, using a popular tool md5deep to calculate SHA1 hashes. There are never two identical files. – guest – 2014-09-05T09:15:07.727

2I've found an installer I have downloaded on August 26 and it has a signature from June 2. We don't know if they are generating these files on the fly, maybe they have a bunch of files and are serving them sequentially. That would explain signatures from the past. – gronostaj – 2014-09-05T09:56:04.507

1It wouldn't surprise me at all to find [licenced] software that might include some dynamic payload -- such as for licencing, or for anti-piracy. A 6-day age on in the signature might indicate the pre-signing of a number of files, as a way of keeping a low-water level on the number of available downloads that are ready-to-go. I wouldn't say that would be a fraudulant action, though I would perhaps hope [wishfully] that they have some manually signed package before unsigning, modifying and re-signing automatically. Its something of a requirement for software installers to be signed these days. – Cameron Kerr – 2014-09-05T10:45:57.300

2What? Fraud of what exactly? – Ramhound – 2014-09-05T11:33:19.677

Have you performed an exact binary comparison? What is different each time? – Sun – 2014-09-15T04:38:28.793

Answers

3

I can not reproduce your claim. Can you provide more details, especially steps on how to reproduce it on my end?

I went to the link to download Chrome Standalone.

I compared three installers I downloaded for the one user version:

Chrome Standalone One User

All three installers were bit-for-bit exact copies of each other

C:\>fc chromestandalonesetup.exe "chromestandalonesetup (1).exe"
Comparing files ChromeStandaloneSetup.exe and CHROMESTANDALONESETUP (1).EXE
FC: no differences encountered

C:\>fc "chromestandalonesetup (1).exe" "chromestandalonesetup (2).exe"
Comparing files ChromeStandaloneSetup (1).exe and CHROMESTANDALONESETUP (2).EXE
FC: no differences encountered

Sun

Posted 2014-09-05T08:55:43.087

Reputation: 5 198

Asked: 2014-09-05T08:55:43.087

Viewed: 1 193 times

Active: 2015-05-11T08:09:12.043