8 ms·

Flame Malware Makers Send 'Suicide' Code

202 points by ytNumbers 14y ago

bobsy 14y ago
Flame sounds awesome. I am always fascinated by clever bits of kit like this. I read a piece about conficker a while ago. I thought it was super cool that it patched the security vulnerability on infected conputers to protect itself. Its just really clever. Now you have Flame which has done what it has done and is now trying to kill itself to make it look like it never existed. Obviously though it is also deeply concerning. States are investing more and more into cyber warfare. If anything more money needs to be spent hardening computer networks and systems to protect from exactly these kind of threats.
- Pewpewarrows 14y ago
  Self-destruct codes and patching up the hole you came in through are both pretty par for the course when it comes to non-trivial malware.
  - adgar 14y ago
    It's par for the course, but it's still a spectacle to see a malware so big/important/advanced self-destruct in front of our eyes, in the news.
- thirdsun 14y ago
  Maybe you already did as it was very popular back then, but you should read the detailed story on stuxnet that was featured in Wired a while ago: http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/all/1 http://www.wired.com/threatlevel/2011/07/how-digital-detecti... Very fascinating.
  - aparadja 14y ago
    Fantastic read. Thank you!
hartleybrody 14y ago
Not sure I follow the logic of "The design of this new variant required world-class cryptanalysis" to "The finding gives support to claims that Flame must have been built by a nation state rather than cybercriminals." Doesn't that assume world-class cryptographers only work for governments? Are there are other reasons people are assuming this was state-sponsored?
- JoachimSchipper 14y ago
  There are lots of academic crypto researchers, there are some state-sponsored (i.e. secret-service) crypto researchers, and there are even a scant few commercial crypto researchers; the academics and commercial entities are usually reasonably open about their work, so that leaves state-sponsored cryptographers. (Of course, they could be criminals. But there are other reasons to suspect that that is unlikely, most importantly the fact that Flame doesn't appear to steal credit cards.)
- gahahaha 14y ago
  There is also the little fact that Flame seems to have been targeting Iran, Syria, and the West Bank. Not proof that a nation state was involved, but surely there are more profitable targets for a criminal master mind capable of inventing new cryptographic methods.
- noodle 14y ago
  From the other articles I've read, its my understanding that they're basically saying Flame is so sophisticated, it was probably developed by a team of really, really smart people with time and resources at their disposal. It doesn't necessarily rule out criminals, but its much more likely that its state-sponsored.
- ajays 14y ago
  It depends on what the malware is designed to do. Cui bono, as they say. If the malware is designed to grab bank passwords or steal money, then you can assume there's a criminal enterprise behind it. But if the malware is specifically targeting certain "problem" countries; and stealing documents and other things of non-monetary value, then it's very likely that there's a government behind it. Which criminal mastermind will say, "tomorrow, I'll steal Word documents of all Syrians" ? What will he do with them anyways? Given the abundance of low-hanging fruit, why would a criminal jump through all these hoops?
losethos 14y ago
10 i = i + 1 20 PRINT i 30 IF i > 100000 THEN i = 0: GOTO 10 40 IF INKEY$ = "" THEN 10 50 PRINT "Bible, Line:", i God says... reprobates. 13:8 For we can do nothing against the truth, but for the truth. 13:9 For we are glad, when we are weak, and ye are strong: and this also we wish, even your perfection. 13:10 Therefore I write these things being absent, lest being present I should use sharpness, according to the power which the Lord hath given me to edification, and not to destruction. 13:11 Finally, brethren, farewell. Be perfect, be of good comfort, be of one mind, live in peace; and the God of love and peace shall be with you. 13:12 Greet one another with an holy kiss. 13:13 All the saints salute you.
fibertbh 14y ago
Since a nation state is supposedly behind this, wouldn't they have secured their command & control hosts better?
- ajross 14y ago
  Surely they're not actually maintaining those hosts themselves (imagine the embarassment of doing a RDNS lookup and getting "flame-cc1.nsa.gov"). They are almost certainly compromised machines owned by someone else, which makes "securing" them in the classic sense pretty much impossible.
  - runn1ng 14y ago
    I know it was a joke comment, but names like "Flame", "Duqu" or "Stuxnet" are not names in which those viruses were developed, but those were attributed to them later through security community
  - Splines 14y ago
    How far down the rabbit hole would you have to go before you find a connection from a .gov machine? Or do nation-state malware programmers maintain a strict no-contact policy to keep the government's hands clean? I suppose we'll never know the answer.
    - ceejayoz 14y ago
      I'd imagine the folks doing this have a windowless van parked outside a Starbucks. I'm fairly certain you'd never be able to trace it back to a .gov computer without physically finding the computers themselves.
    - Kadrith 14y ago
      Did you ever read about Titan Rain? http://www.time.com/time/magazine/article/0,9171,1098961,00.html http://www.time.com/time/magazine/article/0,9171,1098961,00.... It talks a bit about how one person tracked attacks through multiple countries back to China.
timaelliott 14y ago
Symantec is just jealous these guys can remove viruses from a machine so damn efficiently.
- stcredzero 14y ago
  It helps if you know where it is ahead of time.
- philbarr 14y ago
  Yeah, it's much harder to fully remove, say, Norton Antivirus from your computer.
  - X-Istence 14y ago
    I've been nuking my computers from orbit, has anyone found an alternate that works better?
  - moron 14y ago
    I'm not sure it's even possible to do. I take a more creative approach involving "deny" file permissions everywhere and deliberately writing over various .exe files with gibberish.
jorgeleo 14y ago
But... Did the first officer concurr???
ascendant 14y ago
The cat can never be put back into the bag.
- eevilspock 14y ago
  It could never have been kept in the bag. State-sponsored viruses and other Internet hacking are inevitable.
  - leot 14y ago
    That's not obviously true. That one worm was discovered does not mean that every state-designed worm will be (or has been).
- guelo 14y ago
  Obama has been careless when it comes to giving the military free rein with new weapons without considering the consequences or legal precedent.
  - drivebyacct2 14y ago
    Well that's a whole boat-load of assumptions and accusations. And some rather funny/naive ones at that.
    - guelo 14y ago
      How about telling me what it is you think instead of condescendingly calling me funny and naive. Besides the use of weaponized computer viruses, which the NY Times confirmed was done by Obama in the Stuxnet case, I am also thinking of the massive increase in drone strike assassinations, including of American citizens, in countries we are not at war with, namely Pakistan and Yemen. The only assumption I made is that Flame was also done by Obama but I don't think that is a big leap.
- AsylumWarden 14y ago
  Meow. Who says they would want to put the cat back in the bag. Part of war is showing the other side that your guns are bigger and meaner. If the US is responsible, and like others I am reasonably confident we are, then the US just flashed a really nice show of what we are capable of in a real cyberwar.
haberman 14y ago
As someone who doesn't keep up with the crypto/security communities, one thing that has surprised me is how the cutting-edge news on this Flame story has been coming from antivirus vendors like Kaspersky Lab and Symantec. General sentiment seems to be that AV vendors are low-tech operations that don't have the best people when it comes to security. Other comments even on this very thread reflect this sentiment "timaelliott: Symantec is just jealous these guys can remove viruses from a machine so damn efficiently." Do these guys deserve more respect than we give them?
- ahsteele 14y ago
  Symantec is gobbling up headlines specifically to make you believe they are a high-tech operation. There are many other private firms and state operations which you will never hear about, running rings around Symantec.
  - cldrope 14y ago
    As per normal. Anyone in the antivirus/virus community knows how much of a slow and often incompetent operation Symantec & Co are.
- roc 14y ago
  I'm not sure where the cutting edge work is being done in this case, but generally speaking we 'hear' from Kaspersky/Symantec in these sorts of press stories primarily because they have notable press/marketing operations with tight relationships to mainstream news organizations. Even if they were doing little more than independently confirming the cutting edge work of other firms, their voice is massively 'louder' and today's mass media landscape is tilted away from the independent investigation that we could rely upon to properly attribute the work being done in such technical situations.
  - deleted 14y ago
    [deleted]
    - 14y ago
joshuahedlund 14y ago
> Flame targeted countries such as Iran and Israel and sought to steal large amounts of sensitive data. I had heard that Flame targeted Iran, which was one of the reasons people suspected US and/or Israel. This says Israel was targeted. Am I misinterpreting something here? If other evidence supposedly points to a nation-state, what nation-state dislikes both Iran and Israel? Something's not adding up. Edit: Thanks. "Spy on friends" or "Spy on yourself to deflect attention" seem as viable as any other theories out there, if not more.
- mkr-hn 14y ago
  Another article on this (I don't have the link) indicated that the operators were carefully picking their targets and uninstalling it from uninteresting systems. If you have a virus like this, you can target people in your own country and help deflect suspicion at the same time.
- Spooky23 14y ago
  "Liking" a nation does not preclude other nations from spying on them. I'm sure the US and Israel spy on each other.
  - kamjam 14y ago
    I'm sure the US spies on pretty much everyone, friend or foe... and it's probably the same the other way round too!
    - daniel_solano 14y ago
      Sure. It's also a great way to get around domestic wiretapping laws. Assuming you can cooperate well enough with a foreign power, you can have a "I'll show you yours if you show me mine." sort of situation.
      - Volscio 14y ago
        The US has some very close allies for sharing intel, and it'd be a massive incident if it got out that such allied countries were spying on each other. It happens to some degree, but if stuff gets out, the White House & State can make heads roll, so you'd only see pretty routine spycraft occur between allies (counter-intel, rumor mill, feelers).
fl3tch 14y ago
> The command located every Flame file sitting on a PC, removed it and then overwrote memory locations with gibberish to thwart forensic examination. I'd like to know how many writes it did since this would finally settle the issue of whether FBI / NSA can read erased data. If one write is good enough for them, you know they can't recover anything with one write either.
- tjohns 14y ago
  Researchers already have samples of Flame saved. Nobody needs to do forensic analysis to try and recover deleted files here. In all likelihood, all the Flame authors are trying to do is prevent computer owners from casually detecting that they were infected, now that Flame is public knowledge.
  - robocat 14y ago
    Presumably it is purging machine specific (targeted) configuration, code updates, and spooled data too, i.e. not just the virus code. Knowing specfically what the virus was looking for, which machines were infected, and what data was snarfed is of critical importance to the targets. Purging makes the targets job of forensics much much harder. Edit: flame code is not monolithic - forensics would be very interested in getting code for all modules: "Later, the operators can choose to upload further modules, which expand Flame’s functionality. There are about 20 modules in total and the purpose of most of them is still being investigated." - http://www.richardsilverstein.com/tikun_olam/2012/05/28/flame-israels-new-contribution-to-middle-east-cyberwar/ http://www.richardsilverstein.com/tikun_olam/2012/05/28/flam...
- sp332 14y ago
  Stuxnet was US-funded, Flame wasn't.
  - morsch 14y ago
    And you know this... how?
eli 14y ago
At first I thought, why bother. But of course you would want to try to leave your target with no immediate way to determine which machines had been hit. Wonder why they didn't do it sooner. Perhaps they were worried about losing control if too many c&c servers were taken out.
ktizo 14y ago
so, is it officially the future yet?

202 points by ytNumbers 14y ago

bobsy 14y ago

Flame sounds awesome. I am always fascinated by clever bits of kit like this. I read a piece about conficker a while ago. I thought it was super cool that it patched the security vulnerability on infected conputers to protect itself. Its just really clever. Now you have Flame which has done what it has done and is now trying to kill itself to make it look like it never existed. Obviously though it is also deeply concerning. States are investing more and more into cyber warfare. If anything more money needs to be spent hardening computer networks and systems to protect from exactly these kind of threats.

Pewpewarrows 14y ago
Self-destruct codes and patching up the hole you came in through are both pretty par for the course when it comes to non-trivial malware.
- adgar 14y ago
  It's par for the course, but it's still a spectacle to see a malware so big/important/advanced self-destruct in front of our eyes, in the news.
thirdsun 14y ago
Maybe you already did as it was very popular back then, but you should read the detailed story on stuxnet that was featured in Wired a while ago: http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/all/1 http://www.wired.com/threatlevel/2011/07/how-digital-detecti... Very fascinating.
- aparadja 14y ago
  Fantastic read. Thank you!

hartleybrody 14y ago

Not sure I follow the logic of "The design of this new variant required world-class cryptanalysis" to "The finding gives support to claims that Flame must have been built by a nation state rather than cybercriminals." Doesn't that assume world-class cryptographers only work for governments? Are there are other reasons people are assuming this was state-sponsored?

JoachimSchipper 14y ago
There are lots of academic crypto researchers, there are some state-sponsored (i.e. secret-service) crypto researchers, and there are even a scant few commercial crypto researchers; the academics and commercial entities are usually reasonably open about their work, so that leaves state-sponsored cryptographers. (Of course, they could be criminals. But there are other reasons to suspect that that is unlikely, most importantly the fact that Flame doesn't appear to steal credit cards.)
gahahaha 14y ago
There is also the little fact that Flame seems to have been targeting Iran, Syria, and the West Bank. Not proof that a nation state was involved, but surely there are more profitable targets for a criminal master mind capable of inventing new cryptographic methods.
noodle 14y ago
From the other articles I've read, its my understanding that they're basically saying Flame is so sophisticated, it was probably developed by a team of really, really smart people with time and resources at their disposal. It doesn't necessarily rule out criminals, but its much more likely that its state-sponsored.
ajays 14y ago
It depends on what the malware is designed to do. Cui bono, as they say. If the malware is designed to grab bank passwords or steal money, then you can assume there's a criminal enterprise behind it. But if the malware is specifically targeting certain "problem" countries; and stealing documents and other things of non-monetary value, then it's very likely that there's a government behind it. Which criminal mastermind will say, "tomorrow, I'll steal Word documents of all Syrians" ? What will he do with them anyways? Given the abundance of low-hanging fruit, why would a criminal jump through all these hoops?

losethos 14y ago

10 i = i + 1 20 PRINT i 30 IF i > 100000 THEN i = 0: GOTO 10 40 IF INKEY$ = "" THEN 10 50 PRINT "Bible, Line:", i God says... reprobates. 13:8 For we can do nothing against the truth, but for the truth. 13:9 For we are glad, when we are weak, and ye are strong: and this also we wish, even your perfection. 13:10 Therefore I write these things being absent, lest being present I should use sharpness, according to the power which the Lord hath given me to edification, and not to destruction. 13:11 Finally, brethren, farewell. Be perfect, be of good comfort, be of one mind, live in peace; and the God of love and peace shall be with you. 13:12 Greet one another with an holy kiss. 13:13 All the saints salute you.

fibertbh 14y ago

Since a nation state is supposedly behind this, wouldn't they have secured their command & control hosts better?

ajross 14y ago
Surely they're not actually maintaining those hosts themselves (imagine the embarassment of doing a RDNS lookup and getting "flame-cc1.nsa.gov"). They are almost certainly compromised machines owned by someone else, which makes "securing" them in the classic sense pretty much impossible.
- runn1ng 14y ago
  I know it was a joke comment, but names like "Flame", "Duqu" or "Stuxnet" are not names in which those viruses were developed, but those were attributed to them later through security community
- Splines 14y ago
  How far down the rabbit hole would you have to go before you find a connection from a .gov machine? Or do nation-state malware programmers maintain a strict no-contact policy to keep the government's hands clean? I suppose we'll never know the answer.
  - ceejayoz 14y ago
    I'd imagine the folks doing this have a windowless van parked outside a Starbucks. I'm fairly certain you'd never be able to trace it back to a .gov computer without physically finding the computers themselves.
  - Kadrith 14y ago
    Did you ever read about Titan Rain? http://www.time.com/time/magazine/article/0,9171,1098961,00.html http://www.time.com/time/magazine/article/0,9171,1098961,00.... It talks a bit about how one person tracked attacks through multiple countries back to China.

timaelliott 14y ago

Symantec is just jealous these guys can remove viruses from a machine so damn efficiently.

stcredzero 14y ago
It helps if you know where it is ahead of time.
philbarr 14y ago
Yeah, it's much harder to fully remove, say, Norton Antivirus from your computer.
- X-Istence 14y ago
  I've been nuking my computers from orbit, has anyone found an alternate that works better?
- moron 14y ago
  I'm not sure it's even possible to do. I take a more creative approach involving "deny" file permissions everywhere and deliberately writing over various .exe files with gibberish.

jorgeleo 14y ago

But... Did the first officer concurr???

ascendant 14y ago

The cat can never be put back into the bag.

eevilspock 14y ago
It could never have been kept in the bag. State-sponsored viruses and other Internet hacking are inevitable.
- leot 14y ago
  That's not obviously true. That one worm was discovered does not mean that every state-designed worm will be (or has been).
guelo 14y ago
Obama has been careless when it comes to giving the military free rein with new weapons without considering the consequences or legal precedent.
- drivebyacct2 14y ago
  Well that's a whole boat-load of assumptions and accusations. And some rather funny/naive ones at that.
  - guelo 14y ago
    How about telling me what it is you think instead of condescendingly calling me funny and naive. Besides the use of weaponized computer viruses, which the NY Times confirmed was done by Obama in the Stuxnet case, I am also thinking of the massive increase in drone strike assassinations, including of American citizens, in countries we are not at war with, namely Pakistan and Yemen. The only assumption I made is that Flame was also done by Obama but I don't think that is a big leap.
AsylumWarden 14y ago
Meow. Who says they would want to put the cat back in the bag. Part of war is showing the other side that your guns are bigger and meaner. If the US is responsible, and like others I am reasonably confident we are, then the US just flashed a really nice show of what we are capable of in a real cyberwar.

haberman 14y ago

As someone who doesn't keep up with the crypto/security communities, one thing that has surprised me is how the cutting-edge news on this Flame story has been coming from antivirus vendors like Kaspersky Lab and Symantec. General sentiment seems to be that AV vendors are low-tech operations that don't have the best people when it comes to security. Other comments even on this very thread reflect this sentiment "timaelliott: Symantec is just jealous these guys can remove viruses from a machine so damn efficiently." Do these guys deserve more respect than we give them?

ahsteele 14y ago
Symantec is gobbling up headlines specifically to make you believe they are a high-tech operation. There are many other private firms and state operations which you will never hear about, running rings around Symantec.
- cldrope 14y ago
  As per normal. Anyone in the antivirus/virus community knows how much of a slow and often incompetent operation Symantec & Co are.
roc 14y ago
I'm not sure where the cutting edge work is being done in this case, but generally speaking we 'hear' from Kaspersky/Symantec in these sorts of press stories primarily because they have notable press/marketing operations with tight relationships to mainstream news organizations. Even if they were doing little more than independently confirming the cutting edge work of other firms, their voice is massively 'louder' and today's mass media landscape is tilted away from the independent investigation that we could rely upon to properly attribute the work being done in such technical situations.
- deleted 14y ago
  [deleted]
  - 14y ago

joshuahedlund 14y ago

> Flame targeted countries such as Iran and Israel and sought to steal large amounts of sensitive data. I had heard that Flame targeted Iran, which was one of the reasons people suspected US and/or Israel. This says Israel was targeted. Am I misinterpreting something here? If other evidence supposedly points to a nation-state, what nation-state dislikes both Iran and Israel? Something's not adding up. Edit: Thanks. "Spy on friends" or "Spy on yourself to deflect attention" seem as viable as any other theories out there, if not more.

mkr-hn 14y ago
Another article on this (I don't have the link) indicated that the operators were carefully picking their targets and uninstalling it from uninteresting systems. If you have a virus like this, you can target people in your own country and help deflect suspicion at the same time.
Spooky23 14y ago
"Liking" a nation does not preclude other nations from spying on them. I'm sure the US and Israel spy on each other.
- kamjam 14y ago
  I'm sure the US spies on pretty much everyone, friend or foe... and it's probably the same the other way round too!
  - daniel_solano 14y ago
    Sure. It's also a great way to get around domestic wiretapping laws. Assuming you can cooperate well enough with a foreign power, you can have a "I'll show you yours if you show me mine." sort of situation.
    - Volscio 14y ago
      The US has some very close allies for sharing intel, and it'd be a massive incident if it got out that such allied countries were spying on each other. It happens to some degree, but if stuff gets out, the White House & State can make heads roll, so you'd only see pretty routine spycraft occur between allies (counter-intel, rumor mill, feelers).

fl3tch 14y ago

> The command located every Flame file sitting on a PC, removed it and then overwrote memory locations with gibberish to thwart forensic examination. I'd like to know how many writes it did since this would finally settle the issue of whether FBI / NSA can read erased data. If one write is good enough for them, you know they can't recover anything with one write either.

tjohns 14y ago
Researchers already have samples of Flame saved. Nobody needs to do forensic analysis to try and recover deleted files here. In all likelihood, all the Flame authors are trying to do is prevent computer owners from casually detecting that they were infected, now that Flame is public knowledge.
- robocat 14y ago
  Presumably it is purging machine specific (targeted) configuration, code updates, and spooled data too, i.e. not just the virus code. Knowing specfically what the virus was looking for, which machines were infected, and what data was snarfed is of critical importance to the targets. Purging makes the targets job of forensics much much harder. Edit: flame code is not monolithic - forensics would be very interested in getting code for all modules: "Later, the operators can choose to upload further modules, which expand Flame’s functionality. There are about 20 modules in total and the purpose of most of them is still being investigated." - http://www.richardsilverstein.com/tikun_olam/2012/05/28/flame-israels-new-contribution-to-middle-east-cyberwar/ http://www.richardsilverstein.com/tikun_olam/2012/05/28/flam...
sp332 14y ago
Stuxnet was US-funded, Flame wasn't.
- morsch 14y ago
  And you know this... how?

eli 14y ago

At first I thought, why bother. But of course you would want to try to leave your target with no immediate way to determine which machines had been hit. Wonder why they didn't do it sooner. Perhaps they were worried about losing control if too many c&c servers were taken out.

ktizo 14y ago

so, is it officially the future yet?