3 ms·
Researchers already have samples of Flame saved. Nobody needs to do forensic analysis to try and recover deleted files here. In all likelihood, all the Flame a
by tjohns 14y ago
Researchers already have samples of Flame saved. Nobody needs to do forensic analysis to try and recover deleted files here.
In all likelihood, all the Flame authors are trying to do is prevent computer owners from casually detecting that they were infected, now that Flame is public knowledge.
- robocat 14y agoPresumably it is purging machine specific (targeted) configuration, code updates, and spooled data too, i.e. not just the virus code. Knowing specfically what the virus was looking for, which machines were infected, and what data was snarfed is of critical importance to the targets. Purging makes the targets job of forensics much much harder. Edit: flame code is not monolithic - forensics would be very interested in getting code for all modules: "Later, the operators can choose to upload further modules, which expand Flame’s functionality. There are about 20 modules in total and the purpose of most of them is still being investigated." - http://www.richardsilverstein.com/tikun_olam/2012/05/28/flame-israels-new-contribution-to-middle-east-cyberwar/ http://www.richardsilverstein.com/tikun_olam/2012/05/28/flam...