Ha! Everybody knows that this virus was hand-written by our Great Leader and Horse Rider King Jong Ill, right before he decided to exchange his earthly existence for another greater one.
Crypto breakthrough shows Flame was designed by world-class scientists
11–20 of 128 posts
Re: Crypto breakthrough shows Flame was designed by world-class scientists
#12"Flame could only have been developed by a wealthy nation-state" While I do agree that it was indeed developed by one, I'm not sure how it could only have been developed by one. Would it truly take massive levels of money to do or simply some smart, determined people?
Smart determined people don't come for cheap, and you don't get world class cryptanalysts and mathematicians working on such a specific endeavor out of "determination". Plus, we can all guess what wealthy nation-state developed the software and similar things in the past, let's not be hypocritical here...
I think the point was more that the amount of money it would take would not necessarily come from a "wealthy nation-state." I'm not arguing over who actually did it; but I agree with the above that it's a pretty big leap to include that only.
There are a lot of organizations in the world, corporate, criminal, and otherwise, that can muster say $25 million (which, I admit is a number I just pulled out of my ass) to accomplish a monumental task. I'm just not sure that I'm ready to believe that the money amounts we're talking here are restricted only to the wealthiest of nation states. Is the claim that you would need literally billions of dollars to get the smart people and equipment?
Re: Crypto breakthrough shows Flame was designed by world-class scientists
#13"Flame could only have been developed by a wealthy nation-state" While I do agree that it was indeed developed by one, I'm not sure how it could only have been developed by one. Would it truly take massive levels of money to do or simply some smart, determined people?
Smart determined people don't come for cheap, and you don't get world class cryptanalysts and mathematicians working on such a specific endeavor out of "determination". Plus, we can all guess what wealthy nation-state developed the software and similar things in the past, let's not be hypocritical here...
Would one smart, determined person, working in his spare time and for his own satisfaction, be capable of doing it?
I mean, if I had the capability to screw up Iran's nuclear program in my spare time I probably would, because, y'know, fuck Iran.
Re: Crypto breakthrough shows Flame was designed by world-class scientists
#14it's always unsettling seeing a governmental or otherwise undisclosed institution developing such cryptographic breakthroughs in secrecy. this leaves me as a developer with inferior tools to protect my data against any kind of intrusion. it’s understandable from a national perspective but unfortunate for the programming community at large. so far we still have bcrypt or scrypt - but who knows, maybe someday we'll have an efficient collision attack there as well...
Re: Crypto breakthrough shows Flame was designed by world-class scientists
#15Earlier quoted context omitted.
Smart determined people don't come for cheap, and you don't get world class cryptanalysts and mathematicians working on such a specific endeavor out of "determination". Plus, we can all guess what wealthy nation-state developed the software and similar things in the past, let's not be hypocritical here...
I think the point was more that the amount of money it would take would not necessarily come from a "wealthy nation-state." I'm not arguing over who actually did it; but I agree with the above that it's a pretty big leap to include that only . There are a lot of organizations in the world, corporate, criminal, and otherwise, that can muster say $25 million (which, I admit is a number I just pulled out of my ass) to a…
That was basically my thinking. The purpose of Flame seems to be clear intelligence gathering, so most likely it is a state actor that wanted it; I wonder however if it was indeed developed by a state or a private group on behalf of a state.
Plausible deniability is useful after all.
Re: Crypto breakthrough shows Flame was designed by world-class scientists
#16"Flame could only have been developed by a wealthy nation-state" While I do agree that it was indeed developed by one, I'm not sure how it could only have been developed by one. Would it truly take massive levels of money to do or simply some smart, determined people?
Smart determined people don't come for cheap, and you don't get world class cryptanalysts and mathematicians working on such a specific endeavor out of "determination". Plus, we can all guess what wealthy nation-state developed the software and similar things in the past, let's not be hypocritical here...
you don't get world class cryptanalysts and mathematicians working on such a specific endeavor out of "determination"
In World War II, you had such in Poland: http://en.wikipedia.org/wiki/Marian_Rejewski (Who deserves some of the credit for cracking Enigma and thus for the outcome of World War II.)
What you can get for lots of money, you can also get for patriotism and somewhat less money. There are over 30 countries with populations over 40 million. Most of these are industrialized. The odds are that they've produced the requisite mathematical talent. The only question is if they've been able to retain and apply it.
Re: Crypto breakthrough shows Flame was designed by world-class scientists
#17What exactly was the requirement for a "0day" MD5 collision attack here; I thought the Terminal Server Licensing thing at Microsoft spat out good-for-code-signing certificates by itself?
They did, but it seems that those certificates had some extensions that made the code-signing attack difficult to carry out on some versions of Windows, so the collisions were used to generate certs without those extensions. (I read this at http://blog.cryptographyengineering.com/2012/06/flame-certif... )
I see; on Vista and above, certain fields in the certificate prevent it from being accepted for code signature. So they did a collision attack to create a slightly twisted certificate where all those fields are tucked away in a useless segment and ignored.
Are there any details on what's new with this particular attack, compared to the known previously published ones? Why wouldn't earlier public research (such as that ps3 fake SSL CA stunt) suffice?
Re: Crypto breakthrough shows Flame was designed by world-class scientists
#18it's always unsettling seeing a governmental or otherwise undisclosed institution developing such cryptographic breakthroughs in secrecy. this leaves me as a developer with inferior tools to protect my data against any kind of intrusion. it’s understandable from a national perspective but unfortunate for the programming community at large. so far we still have bcrypt or scrypt - but who knows, maybe someday we'll hav…
The "programming community's" threat model in cyberspace is no different than anyone's threat model in meatspace. If a well funded government decides you are an enemy of the state they can harm you in meatspace or cyberspace. Are you staying up at night worried about a hellfire missile coming in your window?
Re: Crypto breakthrough shows Flame was designed by world-class scientists
#19Hmm... if only there was some sort of National Security Agency that employed cryptographers so we'd know about these things first and could protect us from these attacks.
Re: Crypto breakthrough shows Flame was designed by world-class scientists
#20"Flame could only have been developed by a wealthy nation-state" While I do agree that it was indeed developed by one, I'm not sure how it could only have been developed by one. Would it truly take massive levels of money to do or simply some smart, determined people?
Its actually a shame, in the pursuit of blaming the USA and/or Israel people lose common sense. Look, It seems that it was certainly USA/Israel, but throwing common sense out the window just so we can make this point is not a good idea. What these people are saying, essentially is that very few countries have lots of smart people in different industry's, which is wrong. The zero days can come from all over, the PLC a…
...but the US is not a nation-state.