Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crypto breakthrough shows Flame was designed by world-class scientists

arstechnica.com

Post reply on HN
Print view View original

81–90 of 128 posts

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#81

Post by eli »

Achshar wrote: post #77

I think it makes sense that a well funded government was behind flame, but it makes me wonder, there is nothing that explicitly calls for huge funding. Nothing is very costly other than talent. So just a hypothetical situation here but why can't a hypothetical real life Tony Stark make it? (not rich like Stark but intelligent like Stark) Just a one or two people in a garage on their PC. What makes it impossible for t…

It's also the timing. The assumption is that since this is a novel attack and apparently not based on Marc Stevens' attack which was published in 2009, that it therefore was likely developed prior to 2009.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#82

Post by dkarl »

Intelligence agencies and criminal hackers use the same techniques that white hat security researchers do, so every time I read about an attack like this, I wonder who else discovered it and reverse-engineered it, when, and how they used the knowledge. Imagine the irony (assuming Flame is an American product) if China had discovered Flame first and used its technology to conduct industrial espionage against U.S. companies. In fact, getting first crack at advanced technology is great incentive for rival powers or criminals to cooperate with targeted nations. Our next target might solicit the help of Chinese or Russian hackers, government-affiliated or not, who might be very happy to help so they could reverse-engineer the attack and replicate it themselves.

Even worse -- and this is off-topic so I'll keep it brief -- I don't know if the intelligence gleaned from this operation would produce any benefit at all. Theoretically, if we discovered that Iran's nuclear program wasn't a threat, we could save ourselves a lot of worry. It might save a lot of time and money, and possibly even save lives if it prevented military action. But after Iraq who can be confident that an accurate assessment of the threat from Iran would have any effect on policy? We might be disseminating dangerous knowledge for nothing.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#83

Post by Achshar »

ertdfgcb wrote: post #78
Achshar wrote: post #77

I think it makes sense that a well funded government was behind flame, but it makes me wonder, there is nothing that explicitly calls for huge funding. Nothing is very costly other than talent. So just a hypothetical situation here but why can't a hypothetical real life Tony Stark make it? (not rich like Stark but intelligent like Stark) Just a one or two people in a garage on their PC. What makes it impossible for t…

Time? But besides that, I can't really think of anything. Some guy on NPR was talking about how it might be some professional developers who did this in their free time, so that would kind of make sense.

If someone is capable of doing stuff that flame is doing, he/she might as well do it in 2 months time. The thing is we are unaware of the exact capabilities of the author of the code, so it can be a very intelligent person doing it in a few weeks or a group of smart people doing in a few years.

But the problem with later is that the more people know about it and the longer it takes to make such malware, the higher are the chances of a pre release leak, or some double agent doing his work. So one or two very intelligent people doing it in very small time make more practical sense for a covert mission.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#85

Post by its_so_on »

stupid.

"There were mathematicians doing new science to make Flame work."

the government thinks that this is just like normal weapons research.

what they don't realize is that "secure-enough" crypto is far more important to the world economy than their small use in breaking it.

if a government could spend $800B and prove/create a machine that makes asymmetric cryptography impossible - and will be reverse-engineered and known to the world within 3 years of when they start using it, they probably would.

meanwhile, the world loses a lot more than $800B if you can't do anything secure over the public Internet anymore, or have to have previously exchanged a one-time pad to anyone you want a secure connection with.

this isn't just another weapon. mathematics is a public good. Of course, if you can spend $800B on new math and then break it, then in some sense it was "always broken." In another sense, however, that's not true at all. Quit messing it up for everyone.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#86

Post by InclinedPlane »

its_so_on wrote: post #85

stupid. "There were mathematicians doing new science to make Flame work." the government thinks that this is just like normal weapons research. what they don't realize is that "secure-enough" crypto is far more important to the world economy than their small use in breaking it. if a government could spend $800B and prove/create a machine that makes asymmetric cryptography impossible - and will be reverse-engineered a…

Can't say I don't disagree.

It seems as though the governments of western democracies are spending a lot more effort on digital swords to stab at our enemies than on digital shields to protect their citizens.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#87

Post by snowwrestler »

fleitz wrote: post #19

Hmm... if only there was some sort of National Security Agency that employed cryptographers so we'd know about these things first and could protect us from these attacks.

One of the provisions in CISPA is that the NSA will have to set up a way to share classified threat data with network operators.

Now, would the NSA have shared this particular attack? I'm guessing no, since they probably wrote it to begin with.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#88

Post by snowwrestler »

its_so_on wrote: post #85

stupid. "There were mathematicians doing new science to make Flame work." the government thinks that this is just like normal weapons research. what they don't realize is that "secure-enough" crypto is far more important to the world economy than their small use in breaking it. if a government could spend $800B and prove/create a machine that makes asymmetric cryptography impossible - and will be reverse-engineered a…

To put this in perspective, it is an attack against MD5, which we have known for years now is not secure anymore.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#89

Post by yk »

kposehn wrote: post #2

"Flame could only have been developed by a wealthy nation-state" While I do agree that it was indeed developed by one, I'm not sure how it could only have been developed by one. Would it truly take massive levels of money to do or simply some smart, determined people?

Probably something like flame does need much money for development. The clearest sign is of course the MD5 collision. For this you need not only the genius who actually devises the attack, but also an entire infrastructure of people who check proofs and chat during coffee breaks on a useful level. So essentially an secret institute for applied cryptography. Atop of this you need to write the rest of the code, which is not at the same level, but still you need at least several programmers. So probably not all suspects are nation-states, but I believe all suspects are rather large organizations.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#90

Post by _b8r0 »

ajross wrote: post #66
fleitz wrote: post #19

Hmm... if only there was some sort of National Security Agency that employed cryptographers so we'd know about these things first and could protect us from these attacks.

Clearly posters aren't getting the sarcasm, so I'll spell it out: the NSA is clearly suspect number one. What's more interesting to me, though, isn't that they had this technique, it's that they let it out for ... what? It seems like this is a garden variety public worm. One would think that if the NSA had the ability to forge windows code signatures like this, they would have used it more selectively. Some spook is…

The NSA is not suspect number one. The Russians have had superb cryptographers for decades, heck GCHQ invented public key cryptography years before Diffie Helmann and denied it's very existence within for decades.

Attribution is a bitch. It's not a slam dunk to suggest that a particular agency is at fault without supporting evidence.

Post reply on HN