The “most sophisticated cyber-weapon yet unleashed” is how Kaspersky described “Flame” a malware it discovered that has been aimed at Middle Eastern Countries.
Flame is a ‘cyber-espionage worm’ designed to collect and delete sensitive information and had infected computers in Iran, Israel, the West Bank, Sudan, Syria, Lebanon, Saudi Arabia and Egypt:
On its blog, Kaspersky called Flame a “sophisticated attack toolkit,” adding that it was much more complex than Duqu, the vehicle used to deliver Stuxnet which was first discovered in June 2010 & targeted primarily Iranian computers.
According to the BBC, Kaspersky’s chief malware expert Vitaly Kamluk confirmed that that more than 600 specific targets had been hit by Flame, including computers owned by individuals, businesses, academic institutions and government systems.
The code is very complex, large in size and would have taken an average developer about a month to create and debug.
There are internally used local databases with nested SQL queries, multiple methods of encryption, various compression algorithms, usage of Windows Management Instrumentation scripting, batch scripting and more
Interestingly Flame was developed specifically to steal data. This includes the ability to record voice via the microphone. It also has the ability to target any Bluetooth connected devices too.
The malware has the ability to regularly take screenshots but only when certain “interesting” applications are run, for instance, IM’s.
Audio & Screenshots are stored in compressed format and are regularly sent to the Command and Control server on a scheduled basis.
It seems that there is no doubt that this malware is not the work of script kiddies or hacktivists but rather “state sponsored” :
Currently there are three known classes of players who develop malware and spyware: hacktivists, cybercriminals and nation states. Flame is not designed to steal money from bank accounts. It is also different from rather simple hack tools and malware used by the hacktivists. So by excluding cybercriminals and hacktivists, we come to conclusion that it most likely belongs to the third group. In addition, the geography of the targets (certain states are in the Middle East) and also the complexity of the threat leaves no doubt about it being a nation state that sponsored the research that went into it.
The virus seems to infect via two modules designed for infecting USB sticks, called “Autorun Infector” and “Euphoria”.
In addition to these, Flame has the ability to replicate through local networks. It does so using the following:
- The printer vulnerability MS10-061 exploited by Stuxnet – using a special MOF file, executed on the attacked system using WMI.
- Remote jobs tasks.
- When Flame is executed by a user who has administrative rights to the domain controller, it is also able to attack other machines in the network: it creates backdoor user accounts with a pre-defined password that is then used to copy itself to these machines.
If you do think you have been infected, you asked to contact: stopduqu@kaspersky.com
Some more techie bits:
According to Peter Szor and Guilherme Venere from McAfee:
Skywiper is a modular, extendable and updateable threat. It is capable, but not limited to the following key espionage functions:
- Scanning network resources
- Stealing information as specified
- Communicate to C&C Servers over SSH and HTTPS protocols
- Detect the presence of over 100 security products (AV, Anti-Spyware, FW, etc)
- Both kernel and user mode logic is used
- Complex internal functionality utilizing Windows APC calls and and threads start manipulation, and code injections to key processes
- It loads as part of Winlogon.exe then injects to Explorer and Services
- Conceals its present as ~ named temp files, just like Stuxnet and Duqu
- Capable of attacking new systems over USB Flash Memory and local network (slowly spreads)
- Creates screen captures
- Records voice conversations
- Runs on Windows XP, Windows Vista and Windows 7 systems
- Contains known exploits, such as the Print Spooler and lnk exploit found in Stuxnet
- Uses SQLite Database to store collected information
- Uses custom DB for attack modules (This is very unusual, but shows the modularity and extendibility of the malware)
- Often located on nearby systems: a local network for both C&C and target infection cases
- Utilizes PE encrypted resources
To summarize, the threat shows great similarity to Stuxnet and Duqu in some of its ways of operation yet its code base and implementation are very different, and much more complex, and robust in its basic structure.
Skywiper’s main executable files
Windows\System32\mssecmgr.ocx – Main module
Windows\System32\msglu32.ocx
Windows\System32\nteps32.ocx
Windows\System32\advnetcfg.ocx
Windows\System32\soapr32.ocx
For the rest of the report and more info check out McAfee’s report: Skywiper – Fanning the “flames” of cyber warfare
*images from the Kaspersky website
Like this:
Be the first to like this post.
If you looks around the LIKE button and Twitter birds are now symbols that can be seen everywhere. From a restaurant menu to a bookshop poster to a music concert to airlines. 
The most impressive feature in this update is that now with Version 2.6 of Google+ for Android you can starts a Hangout directly from the phone and not have to use the long way like you had to do in previous versions via the Messenger App.
Recent Comments