It's not so difficult to produce two md5-collided exe files

[BlackWhite]

Originally Posted by foosaa

For another example and a detailed walk-through which you could try, see the following link:
http://www.win.tue.nl/hashclash/SoftIntCodeSign/

Authors
Marc Stevens, CWI, Amsterdam, The Netherlands
Arjen K. Lenstra, EPFL, Lausanne, Switzerland, and Bell Labs, Murray Hill, USA
Benne de Weger, TU/e, Eindhoven, The Netherlands

are the pioneers in producing MD5 collisions across a variety of things!

and if you want to deep dive into more specifics, then visit

http://www.win.tue.nl/hashclash/ChosenPrefixCollisions/

Hope it helps someone!

Terrific!
pow(2,50) calls to md5(), costing 6 months.

[Mkz]

While this involves computing power not accessible to all of us, I had already read some of this stuff and the article on the practical case of creating a rogue CA, compromising the entire https security.
http://www.win.tue.nl/hashclash/rogue-ca/

They describe the process in detail, which includes interesting stuff not only to learn some of the md5 details but also the https / PKI workings, for those who haven't explored it before.
Using 200 PS3 machines, they could generate during one weekend 3 or 4 collisions, and after some tries reportedly succeeded in creating a certificate that any browser would accept as a legitimate CA
A fun read indeed.