6 ms·

"Flame could only have been developed by a wealthy nation-state" While I do agree that it was indeed developed by one, I'm not sure how it could only have been

by kposehn 14y ago

"Flame could only have been developed by a wealthy nation-state" While I do agree that it was indeed developed by one, I'm not sure how it could only have been developed by one. Would it truly take massive levels of money to do or simply some smart, determined people?

josephagoss 14y ago
Its actually a shame, in the pursuit of blaming the USA and/or Israel people lose common sense. Look, It seems that it was certainly USA/Israel, but throwing common sense out the window just so we can make this point is not a good idea. What these people are saying, essentially is that very few countries have lots of smart people in different industry's, which is wrong. The zero days can come from all over, the PLC and SCADA system knowledge is all over the world. meh, I'm rambling now, I agree with you kposehn. Its more obvious that this is the work of USA/Israel simply because they are the ones desperate enough to try anything. I might be wrong but who else is threatening war with Iran?
- johnlepson 14y ago
  ...but the US is not a nation-state.
  - archgoon 14y ago
    You have repeated this multiple times on this thread. Would you like to explain what you mean?
    - choppyeloo 14y ago
      If you don't know what a term means, why the fuck are you using it? http://www.wisegeek.com/what-is-a-nation-state.htm http://www.wisegeek.com/what-is-a-nation-state.htm You people are fucking ignorant.
      - Symmetry 14y ago
        The author of that is wrong to conflate nationality and ethnicity. A nationality is a much more general concept. Because most people in the US would list "American" as their primary group identity, and because the people who don't aren't off in their own geographical areas, the US is more of a nation state than it is anything else. Now, you shouldn't throw around the term nation state unless you deliberately mean to exclude, say, Kenya or the old USSR - but that's a different matter. EDIT: Or compare the US and the EU. The typical New Yorker regards people in Florida as the same sort of person as them, so the permanent fiscal transfers from New York to Florida don't spark the sort of outrage in the US that permanent transfers from Germany to Greece do.
        fnulp 14y ago
        http://en.wikipedia.org/wiki/Nation_state http://en.wikipedia.org/wiki/Nation_state notice how a.) it's not even desirable to be a nation state, so untwist your knickers everybody: "The most obvious impact of the nation state, as compared to its non-national predecessors, is the creation of a uniform national culture, through state policy. The model of the nation state implies that its population constitutes a nation, united by a common descent, a common language and many forms of shared culture. When the implied unity was absent, the nation state often tried to create it. It promoted a uniform national language, through language policy. The creation of national systems of compulsory primary education and a relatively uniform curriculum in secondary schools, was the most effective instrument in the spread of the national languages. The schools also taught the national history, often in a propagandistic and mythologised version, and (especially during conflicts) some nation states still teach this kind of history.[10] Language and cultural policy was sometimes negative, aimed at the suppression of non-national elements. Language prohibitions were sometimes used to accelerate the adoption of national languages and the decline of minority languages (see Germanisation)." Sure, when America was by and for white upper class males, it was a nation state, or something. Good for you, can we move to today now? The clincher is the list of examples of nation states on that page. Read it. Notice how the USA isn't on the list. So you can blah blah blah all you want, the downvoted poster is correct, the rest is not. What a surprise ^^
      - 14y ago
  - dfc 14y ago
    I'm afraid to ask...but why do you say that?
  - eli 14y ago
    I don't think that's true, but either way it is not helpful to the discussion.
- stcredzero 14y ago
  The zero days can come from all over, the PLC and SCADA system knowledge is all over the world. From what I've read, SCADA leaves an aspect of its system wide open and insecure, to make development easier.
0x0 14y ago
Presumably, if you are not employed by a three-letter agency, and you manage to invent a breakthrough crypto technique, there's more value in publishing it, than sitting on it until you just blow it all away on one exploit anonymously. At least, you would _hope_ criminal enterprises don't actually have the means to fund and recruit their own secret, cutting-edge math research labs/networks :)
- munin 14y ago
  drug cartels can recruit people to build their own submarines and cell phone networks, so ...
  - batista 14y ago
    Those submarines are crude, has you seen pictures? And submarines and cell phone networks are pretty standard technologies, well understood, that any competent engineer can build off of off the shelve components. It's not like drug cartels are Dr. No like enterprises...
    - TeMPOraL 14y ago
      > And submarines and cell phone networks are pretty standard technologies, well understood,... But what about, well, drugs? Don't drug cartels employ chemists to refine old drugs and develop "better" ones?
      - dfc 14y ago
        Are you comparing developing Flame to cooking meth or freebasing coke?
        TeMPOraL 14y ago
        > Are you comparing developing Flame to cooking meth or freebasing coke? No, of course not :). The point was about crime organizations hiring elite specialists to do high-tech research for them.
excuse-me 14y ago
Well the TPS reports alone would have taken an army of programmers
batista 14y ago
Smart determined people don't come for cheap, and you don't get world class cryptanalysts and mathematicians working on such a specific endeavor out of "determination". Plus, we can all guess what wealthy nation-state developed the software and similar things in the past, let's not be hypocritical here...
- bcrescimanno 14y ago
  I think the point was more that the amount of money it would take would not necessarily come from a "wealthy nation-state." I'm not arguing over who actually did it; but I agree with the above that it's a pretty big leap to include that only. There are a lot of organizations in the world, corporate, criminal, and otherwise, that can muster say $25 million (which, I admit is a number I just pulled out of my ass) to accomplish a monumental task. I'm just not sure that I'm ready to believe that the money amounts we're talking here are restricted only to the wealthiest of nation states. Is the claim that you would need literally billions of dollars to get the smart people and equipment?
  - kposehn 14y ago
    That was basically my thinking. The purpose of Flame seems to be clear intelligence gathering, so most likely it is a state actor that wanted it; I wonder however if it was indeed developed by a state or a private group on behalf of a state. Plausible deniability is useful after all.
    - bcrescimanno 14y ago
      Absolutely. I have very little doubt that it was indeed a nation-state who developed it; but, my main issue is with the distinction of it being a "wealthy" one. Couldn't Flame, perhaps, have been developed by Iran and released on themselves as a means for drumming up anti-Israeli or anti-American sentiment? I realize something like that is totally conjecture; but, I don't see it as any further conjecture than, "it must be the US and / or Israel" [Edit] Since somehow this didn't come across in my post; throwing up conjecture at another possible source of Flame outside of US / Israel doesn't mean I believe any of these explanations--my point was merely that both ideas are pure conjecture with little (at least that I'm aware of) evidence to support the claim.
johnlepson 14y ago
I don't get why he thinks it must have been a nation-state either. Why a nation-state rather than any large country?
- vutekst 14y ago
  Perhaps I just don't understand the terminology here, but which large countries are not considered nation-states?
  - choppyeloo 14y ago
    The US is not a nation state. http://www.wisegeek.com/what-is-a-nation-state.htm http://www.wisegeek.com/what-is-a-nation-state.htm If you don't know what the term means, maybe it's best to avoid using it? Or read a fucking book once in a while.
  - barrkel 14y ago
    I think the OP used the term nation state when he meant sovereign state; it was just a mistake of language. johnlepson, on the other hand, seems to have a bee in his bonnet about the US not being a nation state. Whether the US is a nation state or not depends on how multicultural you think it is; it's a political disagreement.
dfc 14y ago
I think the amount of OPSEC that went into this project is sufficient to exclude any group but a wealthy nation state.
yk 14y ago
Probably something like flame does need much money for development. The clearest sign is of course the MD5 collision. For this you need not only the genius who actually devises the attack, but also an entire infrastructure of people who check proofs and chat during coffee breaks on a useful level. So essentially an secret institute for applied cryptography. Atop of this you need to write the rest of the code, which is not at the same level, but still you need at least several programmers. So probably not all suspects are nation-states, but I believe all suspects are rather large organizations.
acdha 14y ago
There's also the combination of goals and benefits: it's easy to hypothesize a drug cartel or the Russian mafia having enough money to fund something - complicated by the percentage of top-notch crypto people who wouldn't work for an illegal organization - but it's hard to come up with a scenario where they'd be going after Iran rather than, say, compromising a few million credit cards. Industrial espionage would be similar: hard to keep secret, fairly high risk and in most cases it'd be easier and more reliable just to take your megabucks and pay someone for whatever data you want. Why spend millions funding a big R&D team when you could just pay one of your target's sysadmins a million or two to get the data for sure?

by kposehn 14y ago

josephagoss 14y ago

Its actually a shame, in the pursuit of blaming the USA and/or Israel people lose common sense. Look, It seems that it was certainly USA/Israel, but throwing common sense out the window just so we can make this point is not a good idea. What these people are saying, essentially is that very few countries have lots of smart people in different industry's, which is wrong. The zero days can come from all over, the PLC and SCADA system knowledge is all over the world. meh, I'm rambling now, I agree with you kposehn. Its more obvious that this is the work of USA/Israel simply because they are the ones desperate enough to try anything. I might be wrong but who else is threatening war with Iran?

johnlepson 14y ago
...but the US is not a nation-state.
- archgoon 14y ago
  You have repeated this multiple times on this thread. Would you like to explain what you mean?
  - choppyeloo 14y ago
    If you don't know what a term means, why the fuck are you using it? http://www.wisegeek.com/what-is-a-nation-state.htm http://www.wisegeek.com/what-is-a-nation-state.htm You people are fucking ignorant.
    - Symmetry 14y ago
      The author of that is wrong to conflate nationality and ethnicity. A nationality is a much more general concept. Because most people in the US would list "American" as their primary group identity, and because the people who don't aren't off in their own geographical areas, the US is more of a nation state than it is anything else. Now, you shouldn't throw around the term nation state unless you deliberately mean to exclude, say, Kenya or the old USSR - but that's a different matter. EDIT: Or compare the US and the EU. The typical New Yorker regards people in Florida as the same sort of person as them, so the permanent fiscal transfers from New York to Florida don't spark the sort of outrage in the US that permanent transfers from Germany to Greece do.
      - fnulp 14y ago
        http://en.wikipedia.org/wiki/Nation_state http://en.wikipedia.org/wiki/Nation_state notice how a.) it's not even desirable to be a nation state, so untwist your knickers everybody: "The most obvious impact of the nation state, as compared to its non-national predecessors, is the creation of a uniform national culture, through state policy. The model of the nation state implies that its population constitutes a nation, united by a common descent, a common language and many forms of shared culture. When the implied unity was absent, the nation state often tried to create it. It promoted a uniform national language, through language policy. The creation of national systems of compulsory primary education and a relatively uniform curriculum in secondary schools, was the most effective instrument in the spread of the national languages. The schools also taught the national history, often in a propagandistic and mythologised version, and (especially during conflicts) some nation states still teach this kind of history.[10] Language and cultural policy was sometimes negative, aimed at the suppression of non-national elements. Language prohibitions were sometimes used to accelerate the adoption of national languages and the decline of minority languages (see Germanisation)." Sure, when America was by and for white upper class males, it was a nation state, or something. Good for you, can we move to today now? The clincher is the list of examples of nation states on that page. Read it. Notice how the USA isn't on the list. So you can blah blah blah all you want, the downvoted poster is correct, the rest is not. What a surprise ^^
    - 14y ago
- dfc 14y ago
  I'm afraid to ask...but why do you say that?
- eli 14y ago
  I don't think that's true, but either way it is not helpful to the discussion.
stcredzero 14y ago
The zero days can come from all over, the PLC and SCADA system knowledge is all over the world. From what I've read, SCADA leaves an aspect of its system wide open and insecure, to make development easier.

0x0 14y ago

Presumably, if you are not employed by a three-letter agency, and you manage to invent a breakthrough crypto technique, there's more value in publishing it, than sitting on it until you just blow it all away on one exploit anonymously. At least, you would _hope_ criminal enterprises don't actually have the means to fund and recruit their own secret, cutting-edge math research labs/networks :)

munin 14y ago
drug cartels can recruit people to build their own submarines and cell phone networks, so ...
- batista 14y ago
  Those submarines are crude, has you seen pictures? And submarines and cell phone networks are pretty standard technologies, well understood, that any competent engineer can build off of off the shelve components. It's not like drug cartels are Dr. No like enterprises...
  - TeMPOraL 14y ago
    > And submarines and cell phone networks are pretty standard technologies, well understood,... But what about, well, drugs? Don't drug cartels employ chemists to refine old drugs and develop "better" ones?
    - dfc 14y ago
      Are you comparing developing Flame to cooking meth or freebasing coke?
      - TeMPOraL 14y ago
        > Are you comparing developing Flame to cooking meth or freebasing coke? No, of course not :). The point was about crime organizations hiring elite specialists to do high-tech research for them.

excuse-me 14y ago

Well the TPS reports alone would have taken an army of programmers

batista 14y ago

Smart determined people don't come for cheap, and you don't get world class cryptanalysts and mathematicians working on such a specific endeavor out of "determination". Plus, we can all guess what wealthy nation-state developed the software and similar things in the past, let's not be hypocritical here...

bcrescimanno 14y ago
I think the point was more that the amount of money it would take would not necessarily come from a "wealthy nation-state." I'm not arguing over who actually did it; but I agree with the above that it's a pretty big leap to include that only. There are a lot of organizations in the world, corporate, criminal, and otherwise, that can muster say $25 million (which, I admit is a number I just pulled out of my ass) to accomplish a monumental task. I'm just not sure that I'm ready to believe that the money amounts we're talking here are restricted only to the wealthiest of nation states. Is the claim that you would need literally billions of dollars to get the smart people and equipment?
- kposehn 14y ago
  That was basically my thinking. The purpose of Flame seems to be clear intelligence gathering, so most likely it is a state actor that wanted it; I wonder however if it was indeed developed by a state or a private group on behalf of a state. Plausible deniability is useful after all.
  - bcrescimanno 14y ago
    Absolutely. I have very little doubt that it was indeed a nation-state who developed it; but, my main issue is with the distinction of it being a "wealthy" one. Couldn't Flame, perhaps, have been developed by Iran and released on themselves as a means for drumming up anti-Israeli or anti-American sentiment? I realize something like that is totally conjecture; but, I don't see it as any further conjecture than, "it must be the US and / or Israel" [Edit] Since somehow this didn't come across in my post; throwing up conjecture at another possible source of Flame outside of US / Israel doesn't mean I believe any of these explanations--my point was merely that both ideas are pure conjecture with little (at least that I'm aware of) evidence to support the claim.

johnlepson 14y ago

I don't get why he thinks it must have been a nation-state either. Why a nation-state rather than any large country?

vutekst 14y ago
Perhaps I just don't understand the terminology here, but which large countries are not considered nation-states?
- choppyeloo 14y ago
  The US is not a nation state. http://www.wisegeek.com/what-is-a-nation-state.htm http://www.wisegeek.com/what-is-a-nation-state.htm If you don't know what the term means, maybe it's best to avoid using it? Or read a fucking book once in a while.
- barrkel 14y ago
  I think the OP used the term nation state when he meant sovereign state; it was just a mistake of language. johnlepson, on the other hand, seems to have a bee in his bonnet about the US not being a nation state. Whether the US is a nation state or not depends on how multicultural you think it is; it's a political disagreement.

dfc 14y ago

I think the amount of OPSEC that went into this project is sufficient to exclude any group but a wealthy nation state.

yk 14y ago

Probably something like flame does need much money for development. The clearest sign is of course the MD5 collision. For this you need not only the genius who actually devises the attack, but also an entire infrastructure of people who check proofs and chat during coffee breaks on a useful level. So essentially an secret institute for applied cryptography. Atop of this you need to write the rest of the code, which is not at the same level, but still you need at least several programmers. So probably not all suspects are nation-states, but I believe all suspects are rather large organizations.

acdha 14y ago

There's also the combination of goals and benefits: it's easy to hypothesize a drug cartel or the Russian mafia having enough money to fund something - complicated by the percentage of top-notch crypto people who wouldn't work for an illegal organization - but it's hard to come up with a scenario where they'd be going after Iran rather than, say, compromising a few million credit cards. Industrial espionage would be similar: hard to keep secret, fairly high risk and in most cases it'd be easier and more reliable just to take your megabucks and pay someone for whatever data you want. Why spend millions funding a big R&D team when you could just pay one of your target's sysadmins a million or two to get the data for sure?