21–30 of 128 posts
"Flame could only have been developed by a wealthy nation-state" While I do agree that it was indeed developed by one, I'm not sure how it could only have been developed by one. Would it truly take massive levels of money to do or simply some smart, determined people?
it's always unsettling seeing a governmental or otherwise undisclosed institution developing such cryptographic breakthroughs in secrecy. this leaves me as a developer with inferior tools to protect my data against any kind of intrusion. it’s understandable from a national perspective but unfortunate for the programming community at large. so far we still have bcrypt or scrypt - but who knows, maybe someday we'll hav…
Earlier quoted context omitted.
Smart determined people don't come for cheap, and you don't get world class cryptanalysts and mathematicians working on such a specific endeavor out of "determination". Plus, we can all guess what wealthy nation-state developed the software and similar things in the past, let's not be hypocritical here...
Would one smart, determined person, working in his spare time and for his own satisfaction, be capable of doing it? I mean, if I had the capability to screw up Iran's nuclear program in my spare time I probably would, because, y'know, fuck Iran.
Several smart, determined people capable of it together would be easier to find, and well within the reach of many nations and large organizations.
Earlier quoted context omitted.
I think the point was more that the amount of money it would take would not necessarily come from a "wealthy nation-state." I'm not arguing over who actually did it; but I agree with the above that it's a pretty big leap to include that only . There are a lot of organizations in the world, corporate, criminal, and otherwise, that can muster say $25 million (which, I admit is a number I just pulled out of my ass) to a…
That was basically my thinking. The purpose of Flame seems to be clear intelligence gathering, so most likely it is a state actor that wanted it; I wonder however if it was indeed developed by a state or a private group on behalf of a state. Plausible deniability is useful after all.
I realize something like that is totally conjecture; but, I don't see it as any further conjecture than, "it must be the US and / or Israel"
[Edit] Since somehow this didn't come across in my post; throwing up conjecture at another possible source of Flame outside of US / Israel doesn't mean I believe any of these explanations--my point was merely that both ideas are pure conjecture with little (at least that I'm aware of) evidence to support the claim.
Earlier quoted context omitted.
Smart determined people don't come for cheap, and you don't get world class cryptanalysts and mathematicians working on such a specific endeavor out of "determination". Plus, we can all guess what wealthy nation-state developed the software and similar things in the past, let's not be hypocritical here...
you don't get world class cryptanalysts and mathematicians working on such a specific endeavor out of "determination" In World War II, you had such in Poland: http://en.wikipedia.org/wiki/Marian_Rejewski (Who deserves some of the credit for cracking Enigma and thus for the outcome of World War II.) What you can get for lots of money, you can also get for patriotism and somewhat less money. There are over 30 countries…
Plus, the rest of the context is the target of the attack and precedence. Given those constraints, one can only thing of 2 such states. And it's not like those "30 countries with populations over 40 million" are not spied to death already, or that they had foreign policy autonomy on the level of making such attacks without asking consent from a certain power.
"Flame could only have been developed by a wealthy nation-state" While I do agree that it was indeed developed by one, I'm not sure how it could only have been developed by one. Would it truly take massive levels of money to do or simply some smart, determined people?
Edit: The breakthrough that Flame introduced can be read here[8, 9]
SHA-1 is not yet broken, as MD5 is, but fortunately we are having the SHA-3[6] competition (like we had for AES[7]).
[1] http://www.springerlink.com/content/d7pm142n58853467/?MUD=MP
[2] http://www.computer.org/portal/web/csdl/doi/10.1109/CIS.2009...
[3] http://eprint.iacr.org/2010/643
[4] http://stackoverflow.com/questions/1999824/whats-the-shortes...
[5] http://code.google.com/p/hashclash/
[6] http://en.wikipedia.org/wiki/Sha3
[7] http://en.wikipedia.org/wiki/Advanced_Encryption_Standard
[8] http://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-c...
Hmm... if only there was some sort of National Security Agency that employed cryptographers so we'd know about these things first and could protect us from these attacks.
Earlier quoted context omitted.
That was basically my thinking. The purpose of Flame seems to be clear intelligence gathering, so most likely it is a state actor that wanted it; I wonder however if it was indeed developed by a state or a private group on behalf of a state. Plausible deniability is useful after all.
Absolutely. I have very little doubt that it was indeed a nation-state who developed it; but, my main issue is with the distinction of it being a "wealthy" one. Couldn't Flame, perhaps, have been developed by Iran and released on themselves as a means for drumming up anti-Israeli or anti-American sentiment? I realize something like that is totally conjecture; but, I don't see it as any further conjecture than, "it mu…
Hmm... if only there was some sort of National Security Agency that employed cryptographers so we'd know about these things first and could protect us from these attacks.