61–70 of 128 posts
Earlier quoted context omitted.
You have repeated this multiple times on this thread. Would you like to explain what you mean?
If you don't know what a term means, why the fuck are you using it? http://www.wisegeek.com/what-is-a-nation-state.htm You people are fucking ignorant.
Earlier quoted context omitted.
> And submarines and cell phone networks are pretty standard technologies, well understood,... But what about, well, drugs? Don't drug cartels employ chemists to refine old drugs and develop "better" ones?
Are you comparing developing Flame to cooking meth or freebasing coke?
No, of course not :). The point was about crime organizations hiring elite specialists to do high-tech research for them.
Earlier quoted context omitted.
> And submarines and cell phone networks are pretty standard technologies, well understood,... But what about, well, drugs? Don't drug cartels employ chemists to refine old drugs and develop "better" ones?
Well understood also. It's not like they're doing cutting edge pharmaceutical drug research that takes mega scientists and billions in funding and very precise enzyme targeting, etc. They mostly iterate on known drugs to make their making cheaper / more addictive. And they can easily test on junkies (I presume).
Earlier quoted context omitted.
Who says they didn't know? The attack was non-destructive and primarily targeted at Iran, which is something the NSA is probably not too upset about. http://en.wikipedia.org/wiki/Flame_(malware)
http://en.wikipedia.org/wiki/Sarcasm ;)
Hmm... if only there was some sort of National Security Agency that employed cryptographers so we'd know about these things first and could protect us from these attacks.
What's more interesting to me, though, isn't that they had this technique, it's that they let it out for ... what? It seems like this is a garden variety public worm. One would think that if the NSA had the ability to forge windows code signatures like this, they would have used it more selectively. Some spook is in deep trouble about this.
Earlier quoted context omitted.
They did, but it seems that those certificates had some extensions that made the code-signing attack difficult to carry out on some versions of Windows, so the collisions were used to generate certs without those extensions. (I read this at http://blog.cryptographyengineering.com/2012/06/flame-certif... )
I see; on Vista and above, certain fields in the certificate prevent it from being accepted for code signature. So they did a collision attack to create a slightly twisted certificate where all those fields are tucked away in a useless segment and ignored. Are there any details on what's new with this particular attack, compared to the known previously published ones? Why wouldn't earlier public research (such as tha…
We don't yet have details on the differences. I've looked at the evil colliding cert and, AFAICT, the "MD5 Considered Harmful" technique would probably have been sufficient to pull this off.
Well, MD5 attacks are actually quite old news[1,2,3,4]. There even are some open source projects to help you find them[5]. Would love to hear more details on what was the breakthrough that Flame introduced. Edit: The breakthrough that Flame introduced can be read here[8, 9] SHA-1 is not yet broken , as MD5 is, but fortunately we are having the SHA-3[6] competition (like we had for AES[7]). [1] http://www.springerlink…
More interestingly, the results have shown that not our published chosen-prefix collision attack was used, but an entirely new and unknown variant. Therefore it is not unreasonable to assume that the particular chosen-prefix collision attack variant underlying Flame had already been in development before June 2009. This has led to our conclusion that the design of Flame is partly based on world-class cryptanalysis.
[1] http://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-c...
Earlier quoted context omitted.
The "programming community's" threat model in cyberspace is no different than anyone's threat model in meatspace. If a well funded government decides you are an enemy of the state they can harm you in meatspace or cyberspace. Are you staying up at night worried about a hellfire missile coming in your window?
His fear stems from the fact that most people believe they have a right to the Internet and are essentially anonymous. To respond to your hellfire missile analogy, if I am in Canada or the US, I'm not worrying about it but if I'm in the middle east, it's a different story.
But if it's something that can evade detection for years, you have no idea you're being spied on. That's slightly unsettling, no?
it's always unsettling seeing a governmental or otherwise undisclosed institution developing such cryptographic breakthroughs in secrecy. this leaves me as a developer with inferior tools to protect my data against any kind of intrusion. it’s understandable from a national perspective but unfortunate for the programming community at large. so far we still have bcrypt or scrypt - but who knows, maybe someday we'll hav…
The "programming community's" threat model in cyberspace is no different than anyone's threat model in meatspace. If a well funded government decides you are an enemy of the state they can harm you in meatspace or cyberspace. Are you staying up at night worried about a hellfire missile coming in your window?