[homedog]

Basically, they use CBC-MAC to verify the integrity of their script sources. This is pretty bad because a MAC is not resistant to collisions, and given the original key, it's trivial to generate alternate data that gives the same output. A better approach would be an HMAC, using something like SHA1. Doing so makes it much more difficult to perform this type of attack.

[pjscott]

Wait, what? An HMAC is a MAC -- just one that happens to be constructed from a hash function in a particular way.

[homedog]

This is just nitpicking. I did not say HMACs were not MACs anywhere in my comment.

[muyuu]

In a particular way that happens to solve the problem at hand.