Flame: Massive cyber-attack discovered, researchers say

http://www.bbc.com/news/technology-18238326#?utm_source=twitterfeed&utm_medium=twitter

by Juha • 14 years ago

158 80 14 years ago

count• 14 years ago

Didn't Sub7 do all of that back in the 90s?

TheCapn• 14 years ago

BBC won't provide the technical details that we hackers would require to differentiate the two. If it shares the likes of Stuxnet then it would have some pretty clever 0-days inside to help with infection and spreading.

hippich2• 14 years ago

right. and it was NOT developed by state.

makomk3• 14 years ago

I think hobbyist development of exploits of the kind that lead to Sub7 has mostly fallen out of fashion, to be honest. Most of the stuff out there these days seems to be commercially-driven scamware and phishing and its developers don't have the same incentive to make their code as 1337 as possible. So 90s-style exploit kits and RATs are quite unusual in 2012.

swatkat2• 14 years ago

Kaspersky blog has more info: http://www.securelist.com/en/blog/208193522/The_Flame_Questi...

mkr-hn• 14 years ago

The LUA makes me wonder if the creator could be identified by their coding style.

pjin• 14 years ago

From the Kaspersky article, Flame ships with a Lua VM, sqlite3, zlib, libbz2, and an SSL library (probably OpenSSL?), and these and more apparently result in its unusually large size (almost 20 MB).

Sounds almost like "lean malware" written by a relatively small team using easily available tools and libraries.

gregholmberg• 14 years ago

The Lua [0] functions are an interesting read.

CamelCase is mingled with upper and lower case VERBOSE_DEFINITIONS separated_by_underscores. This lack of a clear coding style may be visually annoying, but can be added during a final obfuscation step. The unstyled code may not be present in the unobfuscated repo, and does not necessarily indicate the presence of conflicting coding styles on the malware team.

The properties table called flame_props is created and populated inside of a deeply nested if-statement. Are all other branches of this function forced to operate without a valid properties table? This is not an obvious design choice for any programmer who values harmony in a team working on a shared codebase. Perhaps the Lua coder worked alone. Also, this kind of wtf_logic is difficult to insert later as obfuscation.

On lines 2 and 4 of the example, the Flame Lua supervisor appears to be loading text from an external source and eval'ing it as code. Lua distributions have long offered an entire API for managing and loading modules. Breaking a large project into modules is a standard practice. Reinventing a module loading tool, then, is probably not a path to reliability. The module loading code in Lua is a time-tested grab bag of platform-specific heuristics and yet is still a frequent topic of discussion on the mailing list. Given the multi-platform operating requirements of the program, reinventing it doesn't seem like the most robust design decision.

Similarly, the flame_props table is initialized with strings that looks like the names of entries in property tables of other modules. Why is there not a central way to create and populate these tables? Requiring conversion of "string dot string" into a clean table reference before use seems to unnecessarily add danger to the setup code.

Although I keep referring to a possible obfuscation step, I don't see strong evidence for one. The code uses variable names like SUCCESSFUL_INTERNET_TIMES_CONFIG next to l_1_0 and l_1_1. The short names are quite likely to cause new bugs due to typos, yet the long is very descriptive, almost self-documenting. I have seen code like this before -- it came from neglect bordering on malice, not from deliberate obfuscation.

There is plenty more in there.

[0] "What's in a name?" http://www.lua.org/about.html#name

LiquidSummer6• 14 years ago

>At the moment, we haven’t seen use of any 0-days; however, the worm is known to have infected fully-patched Windows 7 systems through the network, which might indicate the presence of a high risk 0-day.

I really want to know what that 0day is, I can't comprehend how hard it would be to find a 0day remote execution on a Windows system

btipling• 14 years ago

The exploit might not be part of the package. It could be that the exploit installs flame and then uninstalls or removes traces of itself. 0days are very valuable, it makes sense to remove it if it has served its purpose.

Some exploits like those delivered via browsers attempt to execute code in privileged contexts without any file i/o. There might never have been anything to remove.

gaius3• 14 years ago

Aren't these the guys who wigged out because they thought Duqu was written in an entirely new custom virus language? And it was actually Visual C++? The second most common compiler on the planet? (after GCC) I would take their analysis with a big pinch of salt.

swordswinger12• 14 years ago

Give them some credit. Duqu was written using a nonstandard C extension for OO and it was pretty heavily obfuscated iirc.

klt0825• 14 years ago

That was actually my first thought as well. To be fair, it was C with Simple Object Orientation so not quite as terrible as misidentifying C++ straight up though it was still a bit of a fiasco.

From their perspective, I'm sure (over)hyping everything new they analyze as the next 'big deal' helps business even if they are wrong about the details on occasion.

dbh937• 14 years ago

From the official blog post: >There are however some links which could indicate that the creators of Flame had access to technology used in the Stuxnet project - such as use of the “autorun.inf” infection method If I'm not mistaken, you can find youtube videos on how to exploit autorun.inf to make a prank virus. I'm with you on these guys missing easy stuff.

tomrod• 14 years ago

Man, I love hearing the nitty-gritty security details. More like this, please!

vecinu• 14 years ago

I assume we are going to see a complicated and interesting dissection a la Stuxnet? The Stuxnet TED talk [0] was really interesting, I ended up giving a talk to my department at work afterwards.

[0] http://www.youtube.com/watch?v=CS01Hmjv1pQ

jacquesgt• 14 years ago

Here's a much deeper and more technical presentation Ralph Langner gave on Stuxnet.

http://vimeopro.com/s42012/s4-2012/video/35806770

LiquidSummer6• 14 years ago

I'm fed up by these technically lacking stories that don't give you the details but tell you that its "complex". While I realise that the BBC website is aimed towards the general public I think that it would be beneficial to include at least some technical details.

davidandgoliath• 14 years ago

If you're fed up with that, avoid the mainstream media & delve into the blog post linked up above :)

LiquidSummer6• 14 years ago

Haha! yeah I just finished reading the kinda-more-informative analysis (http://www.securelist.com/en/blog/208193522/The_Flame_Questi...). Seems very interesting. I wish that they would share the samples so other hobbyists could also see what it is like

zby• 14 years ago

Or links to sources - this is the web for god's sake!

tlack• 14 years ago

I'd love to know more about the command and control servers. If any of them involve paid hosting that might help to out the guilty party.

LiquidSummer6• 14 years ago

Highly unlikely that that will happen, simply because even the smaller virus writers take precaution when buying servers, they usually do it using stolen credit cards that are not hard to acquire. In addition, the it also depends whether the hosting companies are willing to assist people with the investigation.

hippich2• 14 years ago

if I would invest that much time into writing software, I would add TOR or i2p connectivity and would connect to hidden service

duaneb6• 14 years ago

I would love to see the binary, even if it means waiting until vulnerabilities are patched.

josephkern3• 14 years ago

At 20MB I would be suprised if it didn't patch itself with new exploits.

thursley• 14 years ago

More technical details (pdf) on: http://www.crysys.hu/skywiper/skywiper.pdf

Although the naming differs it has been noted on several blogs that it is the same malware.

LiquidSummer6• 14 years ago

I always hesitate a little bit when I open a pdf, specially when it is one on malware

missing_cipher• 14 years ago

Would opening a pdf via Chrome for example provide any extra protection? From what I understand most of the exploits are because of embedded media, no?

rbanffy2• 14 years ago

It depends: will you render it using Adobe's software?

FreakLegion• 14 years ago

Note that while the exploit is in the PDF, the vulnerability is in the PDF reader. In practice, Adobe's software is the only attack surface anyone ever exploits, so you can read exploit-laden PDFs worry-free by using a less popular alternative. The same is true with Word/Excel files, etc.

You should still have some kind of comprehensive security solution in place, particularly for a business environment, but use of non-standard software is an effective fail-safe for when your "real" security craps out on you (as it inevitably will).

jsz0• 14 years ago

For what it's worth if you're using OSX Lion Preview is sandboxed.

duaneb6• 14 years ago

Use chrome! It's probably more secure than downloading the PDF and opening it with Adobe software.

rhdoenges• 14 years ago

> sKyWIper may have been active for as long as five to eight years

spooky.

fishcakes5• 14 years ago

We should just convert the comments to a poll. Who is behind this?

fishcakes5• 14 years ago

China

fishcakes5• 14 years ago

Isreal

fishcakes5• 14 years ago

non-state actor

codesuela• 14 years ago

North Korea

maayank• 14 years ago

How would we keep track of scores? would you keep editing your post to reflect changes in voting?

(this is besides the point if it is a good or bad idea. In any case, it is certainly seems novel to me)

dylanhassinger• 14 years ago

Weyland-Yutani

ktizo• 14 years ago

CotDC (only saying this because the list of features reminds me of an article I read years ago about MS Back Orifice)

radagaisus• 14 years ago

>> Our estimation of development ‘cost’ in LUA is over 3000 lines of code, which for an average developer should take about a month to create and debug.

They should do project estimation instead of Security Analysis.

munin• 14 years ago

"It’s easier to hide a small file than a larger module." my mind is blown. small files are not like small rocks. it's a computer!

gue5t• 14 years ago

Assuming fairly dense formats (no .wavs or .bmp images), large files necessarily mean more than small files, so they draw more attention to themselves. "Why is /foo/bar using 300MB of disk?" is a much more likely avenue of inquiry than "Why is /foo/bar using 50KB of disk?".

moe• 14 years ago

Except the last time when 20MB was "large" was in the early 1990s. Today, even if someone goes to clean out their harddrive, a 20MB file is unlikely to even appear on the radar.

gcb• 14 years ago

Their conclusion that because it doesn't steal money it can't belong to cybercriminals is bogus and show how little they understand of the industry.

I've heard of researchers from one company dumpster diving the competition. A worm (as amateur as a 20mb one ) could easily be the work of those kind. But i think it gets less press than "evil country" "omg world cyber war" ...not that it may not be happening anyway.

haberman2• 14 years ago

The reason why Flame is [20MB] is because it includes many different libraries, such as for compression (zlib, libbz2, ppmd) and database manipulation (sqlite3), together with a LUA virtual machine.

SQLite is 500kB, Lua is 150kb, zlib is 80kB, libbz2 is 60kB. Together this comes to less than 1MB, not 20MB. You would need an awful lot of libraries like this to get anywhere close to 20MB.

timdorr• 14 years ago

They're likely skipping over a ton of libraries for brevity's sake. It captures data from audio, video, bluetooth, and other sources. A full BT stack is going to be pretty sizable. If there's any compression being done on that audio or video, that could also add to the bulk.

runjake• 14 years ago

I don't get the point of your comment. Are you saying you doubt it's 20MB? Or that it doesn't include a lot of libraries?

What point are you trying to make exactly?

fusiongyro• 14 years ago

He's pointing out that the explanation for the size given in the article isn't adequate because the facts don't bear it out.

mikegirouard• 14 years ago

> "Currently there are three known classes of players who develop malware and spyware: hacktivists, cybercriminals and nation states."

Surely that can't be all-inclusive… is it?

dfc• 14 years ago

How could it not be? That is a very broad group. Who else has the motivation to develop and maintain large scale malware/spyware? If you want to be pedantic about it cybercriminal is probably broad enough to be all inclusive.

I guess you could include companies like Sony but they were probably excluded for not having the same malicious intent.

NelsonMinar• 14 years ago

The Wired ThreatLevel article is a good alternative summary to the BBC article. http://www.wired.com/threatlevel/2012/05/flame/

DrummerHead• 14 years ago

Those paragraphs are so short that it makes me angry.

Flame: Massive cyber-attack discovered, researchers say

Related Stories