Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crypto breakthrough shows Flame was designed by world-class scientists

arstechnica.com

Post reply on HN
Print view View original

101–110 of 128 posts

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#101

Post by niels_olson »

batista wrote: post #73
keithpeter wrote: post #50

Earlier quoted context omitted.

I understand your position here, but, please make contact with some Iranian refugees/dissidents near you for the full picture. Its bad. Worse than I understand Texas to be, by several ball parks.

> I understand your position here, but, please make contact with some Iranian refugees/dissidents near you for the full picture. Its bad. Worse than I understand Texas to be, by several ball parks. Sure, but those are "refugees/dissidents", of course they would think that. It's not like the great Iranian masses are held there by force or hate their culture. In general, dissidents are also overplayed for political gai…

http://en.wikipedia.org/wiki/Death_of_Neda_Agha-Soltan

You are arguing a very weak position.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#102

Post by at-fates-hands »

_b8r0 wrote: post #90
ajross wrote: post #66

Earlier quoted context omitted.

Clearly posters aren't getting the sarcasm, so I'll spell it out: the NSA is clearly suspect number one. What's more interesting to me, though, isn't that they had this technique, it's that they let it out for ... what? It seems like this is a garden variety public worm. One would think that if the NSA had the ability to forge windows code signatures like this, they would have used it more selectively. Some spook is…

The NSA is not suspect number one. The Russians have had superb cryptographers for decades, heck GCHQ invented public key cryptography years before Diffie Helmann and denied it's very existence within for decades. Attribution is a bitch. It's not a slam dunk to suggest that a particular agency is at fault without supporting evidence.

The Russians have far more of an economic risk to set something like this off in the middle east. Their huge investments in oil infrastructure could go up in flames if this was traced back to them. And this is just the stuff that's somewhat above the table.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#103

Post by eli »

commandar wrote: post #53
jcfrei wrote: post #14

it's always unsettling seeing a governmental or otherwise undisclosed institution developing such cryptographic breakthroughs in secrecy. this leaves me as a developer with inferior tools to protect my data against any kind of intrusion. it’s understandable from a national perspective but unfortunate for the programming community at large. so far we still have bcrypt or scrypt - but who knows, maybe someday we'll hav…

The fascinating thing is that strong commercial/public cryptography has only really become a "thing" in the past couple of decades; it used to be nearly exclusively the domain of governments, which is why even today there are still residual export controls on strong cryptography.[1] [1] http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_U...

Indeed, the days of "This T-Shirt Is a Munition" weren't that long ago.

http://www.loundy.com/Roadside_T-Shirt.html

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#104

Post by rhplus »

batista wrote: post #9
kposehn wrote: post #2

"Flame could only have been developed by a wealthy nation-state" While I do agree that it was indeed developed by one, I'm not sure how it could only have been developed by one. Would it truly take massive levels of money to do or simply some smart, determined people?

Smart determined people don't come for cheap, and you don't get world class cryptanalysts and mathematicians working on such a specific endeavor out of "determination". Plus, we can all guess what wealthy nation-state developed the software and similar things in the past, let's not be hypocritical here...

According to their careers page[1], the NSA is offering $42K - $97K for mathematicians and $72K - $134K for computer scientists. I'm guessing that's on par with many academic and industrial research positions, especially for the locations they have offices (i.e. not Silicon Valley or New York).

[1] http://www.nsa.gov

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#105

Post by com4 »

niels_olson wrote: post #100
rdl wrote: post #75

Earlier quoted context omitted.

The "research chemical" community, out of China, SE Asia, Israel, and Europe, is pretty much doing cutting edge pharmaceutical drug research -- the point being to produce "interesting" club drugs while staying ahead of regulation. Not spending billions, but doing fairly reasonable drug discovery, synthesis, and testing. Of course, sometimes they get it wrong, and you end up with face flesh eating humans in Florida.

> flesh eating humans in florida Citation?

Seriously?

http://www.miamiherald.com/2012/05/29/2822971/new-video-show...

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#106

Post by petitmiam »

niels_olson wrote: post #100
rdl wrote: post #75

Earlier quoted context omitted.

The "research chemical" community, out of China, SE Asia, Israel, and Europe, is pretty much doing cutting edge pharmaceutical drug research -- the point being to produce "interesting" club drugs while staying ahead of regulation. Not spending billions, but doing fairly reasonable drug discovery, synthesis, and testing. Of course, sometimes they get it wrong, and you end up with face flesh eating humans in Florida.

> flesh eating humans in florida Citation?

http://en.wikipedia.org/wiki/Miami_cannibal_attack

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#107

Post by ajross »

_b8r0 wrote: post #90
ajross wrote: post #66

Earlier quoted context omitted.

Clearly posters aren't getting the sarcasm, so I'll spell it out: the NSA is clearly suspect number one. What's more interesting to me, though, isn't that they had this technique, it's that they let it out for ... what? It seems like this is a garden variety public worm. One would think that if the NSA had the ability to forge windows code signatures like this, they would have used it more selectively. Some spook is…

The NSA is not suspect number one. The Russians have had superb cryptographers for decades, heck GCHQ invented public key cryptography years before Diffie Helmann and denied it's very existence within for decades. Attribution is a bitch. It's not a slam dunk to suggest that a particular agency is at fault without supporting evidence.

The NSA is the largest such organization, surely there are others. But just to correct: the GCHQ beat DH by three years and RSA by four, not decades.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#108

Post by eli »

dkarl wrote: post #82

Intelligence agencies and criminal hackers use the same techniques that white hat security researchers do, so every time I read about an attack like this, I wonder who else discovered it and reverse-engineered it, when, and how they used the knowledge. Imagine the irony (assuming Flame is an American product) if China had discovered Flame first and used its technology to conduct industrial espionage against U.S. comp…

I really don't think that the failure of accurate intelligence to drive policy in the past suggests we should give up on trying to have policies driven by facts.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#109

Post by zaroth »

News from a few days ago made it sounds like MS left their cert wide open to using it to sign code and make it look like it came from Microsoft.

Now this news comes out that they used a pretty powerful crypto attack to essentially create their own trusted root to be able to sign their code to make it look like it came from Microsoft.

Why would you need both vectors? It seemed (yesterday) that the Microsoft bug alone was enough to trick Windows Update into installing your code.

Re: Crypto breakthrough shows Flame was designed by world-class scientists

#110

Post by fennecfoxen »

Earlier information linked to from this site suggested that Flame was able to spread by some quirk involving using Terminal Services licenses as signing keys (instead of just licenses) and continuing up a trust chain. Was that information accurate? Is this an additional technique Flame uses for its attack? Or is it the only attack?
Post reply on HN