Flame worm one of the most complex threats ever discovered

Posted by   Virus Bulletin on   May 30, 2012

Malware possibly used for cyber-espionage.

The jury is out on whether 'Flame' (also known as 'Flamer' or 'Skywiper') is 'the most lethal cyberweapon to date' as some have claimed, or just a highly complex and sophisticated piece of malware. But simply from looking at the volume of security vendors' blog posts dedicated to the malware since its discovery this week, it is clear that Flame is far from ordinary.

One thing we do know is that there is a lot that isn't known yet. Because of both its size - when fully deployed, it is almost 20MB - and its complexity, researchers expect the full analysis to take several months at least.

What is known is that Flame is a modular piece of malware that has worm-like features, which allows it to spread on a local network. The use of modules is not unique to Flame: prevalent trojans such as ZeuS and SpyEye allow for the use of modules or plug-ins. However, whereas the latter kinds of malware are used to target the masses (stealing online banking details, sending spam), Flame's capabilities, which include network-sniffing, taking screenshots and recording audio conversations, suggest it is being used for cyber-espionage purposes.

So far, a few hundred infections are known, with victims varying from individuals to state-related organisations. Most of the victims are located in the Middle East: of the few hundred known infections, Iran features most prominently as a location, followed by Israel and Sudan.

The complexity of the malware, the prevalence of infections in Iran, as well as a number of technical features (such as the use of the Lua scripting language), suggest similarities with Stuxnet and Duqu. However, there are many differences too: unlike Stuxnet it does not appear to target SCADAs and the number of infections is probably significantly larger than that of Duqu. It is currently unclear whether the malware uses any zero-day exploits.

It is possible that Flame was developed by the same group that developed Stuxnet and Duqu, though likely as a parallel project. Given the location of the infections and the fact that developing something like Flame would require huge resources, many believe the governments of one or more rich Western nations are behind the malware. However, as with Duqu and Stuxnet, noone has been able to prove such claims.

While it has been discovered only recently, it is believed that Flame has been around for some time, possibly going back as far as March 2010. Writing about the malware, F-Secure's Mikko Hyppönen said that this is a case where the anti-virus industry has failed.

Virus Bulletin will continue to follow the developments around Flame and report about it on www.virusbtn.com and on our Twitter feed. While complacency is rarely a good idea when it comes to cybercrime, it is worth pointing out that the vast majority of users and organisations are unlikely to be affected by the malware.

Possibly the best introduction to Flame is this set of FAQs at Kaspersky's Securelist blog. Flame was first reported by MAHER, the Iranian CERT, whose report can be found here. A thorough analysis was performed in a report by the Hungarian CrySys lab here (PDF).

Posted on 30 May 2012 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Test your technical and mental limits in the VB2017 foosball tournament

As has become tradition, VB2017 will once again see a security industry table football tournament. Register your team now for some great fun and adrenaline-filled matches in between sessions in Madrid!

The case against running Windows XP is more subtle than we think it is

Greater Manchester Police is one of many organizations still running Windows XP on some of its systems. This is bad practice, but the case against running XP is far more subtle than we often pretend it is.

Hot FinSpy research completes VB2017 programme

Researchers from ESET have found a new way in which the FinSpy/FinFisher 'government spyware' can infect users, details of which they will present at VB2017 in Madrid.

Transparency is essential when monitoring your users' activities

Activity monitoring by security products in general, and HTTPS traffic inspection in particular, are sensitive issues in the security community. There is a time and a place for them, VB's Martijn Grooten argues, but only when they are done right.

VB2017 preview: Android reverse engineering tools: not the usual suspects

We preview the VB2017 paper by Fortinet researcher Axelle Apvrille, in which she looks at some less obvious tools for reverse engineering Android malware.