Flame is Lame

http://www.f-secure.com/weblog/archives/00002383.html

by wglb • 14 years ago

267 100 14 years ago

It's a fairly nice summary of Flame, but it could do without the link-bait title, since the conclusion of the article is exactly the opposite.

MehdiEG• 14 years ago

It's clearly linkbait but it is actually nicely written and informative so I'll give them a pass on this one.

Spooky23• 14 years ago

It's satire.

pbhjpbhj2• 14 years ago

Now I'm wondering if the submitter wrote a good title and some mod came along and bawdlerised it??

It's a terrible title. Fine for a media site trying to sell stories based on sensationalism but I thought we were building a brave new online community here.

brunnsbe• 14 years ago

Who said that Flame was Lame? I haven't stumbled on that much critique about Flame.

mxxx• 14 years ago

yeah, can't say that i have either. most of what i've read about it has been somewhat in awe of the complexity of the thing.

bleusink• 14 years ago

I think it's a reply to this article: http://xato.net/malware/flame-is-kind-of-lame/

(discussed on HN here: http://news.ycombinator.com/item?id=4087914)

mikkohypponen• 14 years ago

Some examples:

http://idealab.talkingpointsmemo.com/2012/05/flame-malware-m... "The hype surrounding Flame may be partially the result of the ITU"

http://www.thetechherald.com/articles/Is-the-hype-surroundin... "None of the methods of this malware are particularly new."

http://xato.net/malware/flame-is-kind-of-lame/ "It’s just not that impressive as far as features go. In fact, 10 years ago it really wouldn’t have been that impressive."

Mikko

bjornsing• 14 years ago

Completely agree. That novel cryptographic hash collision thing is mind boggling, all the rest is just run-of-the-mill.

jjguy2• 14 years ago

To paraphrase Edison, anything worthwhile is 99% perspiration and 1% inspiration. The novel md5 collision/windows update propagation is Flame's 1%. The rest is just what's made possible as a result.

It is a cogent reminder of the fragility of the Internet's security infrastructure.

wglb2• 14 years ago

Well, I thought the unreadable, unprocessable, undeleteable file named '.' was rather clever.

lmm2• 14 years ago

It was clever the first time someone did it, but it's old-hat by now

mtgx• 14 years ago

If this was indeed developed by NSA, wouldn't this sort of attack be easier for them since NSA gets access to Microsoft's source code for Windows?

Tuna-Fish• 14 years ago

The access to source code is mostly irrelevant.

Access to signing keys is very relevant, and I think there is a very real chance (p>0.2) that the huge oversight MS did with the terminal server keys happened because they were ordered to do it.

tptacek10• 14 years ago

That's an awfully baroque government backdoor --- a misconfigured X.509 attribute on a certificate that turns out to be signed with a hash for which controlled collisions turn out to be feasible.

serialx• 14 years ago

No. The key to this malware being NOT lame is that it uses a new cryptographic attack. Which is, not helped by looking at Microsoft's source code.

slig• 14 years ago

How come do they get access to MS code?

celticninja2• 14 years ago

I imagine it goes something like this:

US Govt: we want source code access

MS: That is propiatory information

US Govt: give us access or we wont allow MS products to be used by govt. departments

MS: how quick do you want that access?

jjguy2• 14 years ago

Ref Microsoft's Shared Source Initiative: http://www.microsoft.com/en-us/sharedsource/default.aspx

Enterprises w/ 10k+ seats, OEMs, MVPs and governments can get access to Windows source these days. Microsoft launched the program in 2006 or so to dampen the "Linux is more secure because we can see the source!!" FUD.

dchest• 14 years ago

http://www.microsoft.com/government/en-gb/initiatives/Pages/...

Government Security Program: Addressing the unique security requirements of governments worldwide by helping government actively participate in ensuring the security of their critical systems. We help enhance system security by providing access to Microsoft Windows and Office source code, prescriptive and authoritative security guidance, technical training, security information, and Microsoft security experts.

parktheredcar• 14 years ago

https://www.microsoft.com/en-us/sharedsource/default.aspx

dhx3• 14 years ago

The Common Criteria Evaluation and Validation Scheme (CCEVS) is a form of software accreditation that focuses on software security.

You can view the results for the Windows 7 accreditation at [1]. The website also has comprehensive documentation on the methodology used to accredit the software (including visibility of the source code).

[1] http://www.niap-ccevs.org/st/vid10390/

einhverfr2• 14 years ago

I don't think so. I won't go on record with what I know but I do know that Microsoft has consented to allow governments audit, review, and sometimes even modify their source code.

I suspect a polite request (perhaps backed by a threat including the L-word) will get them far further than a virus.

Edit: Others have pointed to public documentation of this program. I believe the two cases I was aware of at the time were the governments of China and Germany.

tptacek10• 14 years ago

The source code to Windows doesn't matter. In 2012, even teenagers find vulnerabilities in Windows by reading the assembly code in IDA Pro. It's one of the most comprehensively reverse-engineered pieces of code on the planet.

PostOnce• 14 years ago

mtgx theorized it would be easier with access to the Windows source, and it would, and you know it would, and you're purposely being obtuse; arguing for the sake of arguing.

There is a reason we have programming languages, and we don't all write directly in machine code. Just because it's techincally possible to do things in a more difficult way doesn't mean they would be done that way with a faster, easier option readily available.

Stop being silly. :P

patio113• 14 years ago

I think tptacek has hummed a few bars in this direction before, but it has become received wisdom on some parts of the Internet that geeks vs. government is an asymmetric fight and that since governments are stupid geeks will win. You often see this in, let me cherry pick out of charitability, threads suggesting that the OSS community develop surveillance countermeasures for use by dissidents subject to certifiably evil regimes.

It doesn't really matter whether the nation state in question is Iran or the United States. Do not pick fights with people who can respond to a hacking incident by writing a check for $5 million dollars to a defense contractor and consider that low-intensity conflict resolution. It will not end well.

cheatercheater2• 14 years ago

You forgot to mention black choppers.

FTFY: "Do not pick fights with people who can fly black choppers"

patio113• 14 years ago

So when you mention black choppers, people will assume you are either being ironic or crazy. There's a particular policy goal affiliated with these attacks, and a spectrum of options for achieving that policy goal. Those options included "There exist certain individually identifiable employees of a foreign government who are personally indispensable to implementing something which goes against our policy goals. We could assassinate them."

If you read the papers you know that that option is neither a joke nor the fevered imaginings of a paranoid conspiracy theorist.

pliny• 14 years ago

The idea that governments are stupid in the sphere of technology ignores the recent-ish discovery on behalf of governments that if you just pay a bunch of geeks to be geeks on behalf of the (evil or otherwise) government and make them exempt from bureaucracy they get results that are at least as good as geeks acting independently.

epenn• 14 years ago

Similarly, I'll grant that the fight may appear asymmetrical at the higher level of organizations if one side is run by geeks and the other side is run by non-geeks. Nonetheless one should recognize that those hired by either side to be on the "front lines" so to speak will be geeks. Whether they're computer geeks or gun|bomb|espionage|etc geeks, assuming an asymmetry in the ability to employ strategy and accomplish goals on that level would be unwise.

tatsuke95• 14 years ago

Right. It always comes back to the people performing the task. Because people are generally "good" (IMHO), "evil" isn't particularly easy to get away with. This goes for geeks, police and even the military. Commands can be issued, but real people with real emotions have to deliver. This is why whistle-blower protection is so key to our economy and society.

And while politics may attract a disproportionate level of narcissists and sociopaths, I'm guessing CS doesn't.

timdiggerm• 14 years ago

"geeks vs government" assumes geeks don't work for the government.

morsch3• 14 years ago

Neither Stuxnet nor Flame target hackers or even the general population. They were targeting specific institutions. Attacking is easy once you know who or what to attack.

Each individual hacker and each individual citizen is a much smaller target. Sure, as soon as you're identified, you're toast: they break in and install malware on your computer -- if you're lucky. But there's a lot of hackers and even more normal people, all of which can be made individually harder to identify through smart software.

tptacek10• 14 years ago

Lots of people. Relatively few pieces of software. Pit against an avalanche of money and access to the best talent in the world. The incentive structure doesn't work, at all.

Don't build circumvention tools. If you're lucky, they'll just turn out to be useless.

gvb• 14 years ago

In addition, keep in mind that the geeks in government (a) cannot talk about what they are working on (see http://www.foxnews.com/us/2011/12/26/decades-later-cold-war-...) and (b) are happy to be considered stupid because it makes their job easier.

DanI-S3• 14 years ago

> You often see this in, let me cherry pick out of charitability, threads suggesting that the OSS community develop surveillance countermeasures for use by dissidents subject to certifiably evil regimes.

> It doesn't really matter whether the nation state in question is Iran or the United States. Do not pick fights with people who can respond to a hacking incident by writing a check for $5 million dollars to a defense contractor and consider that low-intensity conflict resolution. It will not end well.

Are you really saying that people should avoid writing software that could help people who are subject to evil regimes because said evil regime might be upset at them? There's an uncertain level of personal risk associated with doing such things, but there's definite moral hazard in total self-interest.

Either way, if Flame was written by the US or Israel a lot of us on here are already complicit in such a project. We live in a democracy. Those are our tax dollars, hard at work.

I totally agree with you otherwise; governments are not stupid.

patio113• 14 years ago

Are you really saying that people should avoid writing software that could help people who are subject to evil regimes because said evil regime might be upset at them?

No, I'm saying that "my software helps people who are subject to evil regimes" is approximately as irresponsible as "my homeopathic remedy solves cancer" except in this case cancer has essentially infinite computational resources, arbitrarily high numbers of very savvy domain experts, and an army. Any hacker who believes their software, or their community's software, will hold up to dedicated adversarial interest from a nation-state is dangerously delusional.

tptacek10• 14 years ago

He's not saying that, I am.

There's no personal risk to writing regime circumvention tools. Iran isn't going to have you assassinated for your work on Tor.

There is serious risk to using Tor in Iran. Death squads and disappearances aren't a conspiracy theory in Iran; they are the regime's well-understood M.O. When circumvention tools like Tor work, they hide your traffic from the regime. When they stop working, or are turned, they do exactly the opposite: they attach a statistical marker to your traffic that says "whether or not you can read these packets, the person sending them is interesting".

The people working on circumvention tools are mostly well-intentioned (many of them are friends of mine), but they are delusional about the SWOT analysis at play here. None of them have any unique skills that aren't available to an organization willing to shell out 6-7 figures to a team in a month. Money buys competence. A lot of money buys a lot of competence. Iran has a lot of money. Circumvention projects do not.

Kickstarter hasn't seen the amount of money that a world government could spend without director-level approval on a project to turn a circumvention tool against its users.

And that's before you get to the fact that many, if not most, of the computers in authoritarian regimes are probably already rootkitted.

ChuckMcM• 14 years ago

I agree with this, and I was similarly amazed when some folks calling themselves Anonymous started dumping personal information about law enforcement officers onto the web, you don't pick fights with people who are going to hunt you down and eliminate you. It may be they will just lock you up, it may be worse than that.

That said, there is a history of people who have done that, paid the ultimate price, and later been honored for their sacrifice. Seems like history can go either way sometimes in judging the act, hero or idiot.

I'm all in favor of people keeping their eyes open though as they walk into it.

For me things like Flame just tell me that what I knew as an engineer could be done, actually have been done. And that is always a bit of a wake up call.

rdl• 14 years ago

I think a bigger asymmetry than "hackers vs. governments" is "defense vs. offense" -- the state of computer security is laughable enough that the attacker will probably win, whoever he is.

If non-government hackers were building offensive tools, vs. defensive, and only had to win periodically vs. essentially all the time, they'd be able to put up a better fight. Government doesn't have a particular monopoly on competence, and internal politics and budget issues probably would allow a relatively capital-poor non-governmental enterprise to do pretty well vs. a contractor/government team.

sparknlaunch• 14 years ago

I thought the big thing was that flame found itself into a network locked out from the outside world. So the intrigue lies in how it made it into this network ?

Auguste• 14 years ago

I hadn't heard about that (so please excuse my ignorance), but surely it's just a case of somebody accidentally/intentionally bringing it in on removable storage, like a USB drive, and plugging it in.

celticninja2• 14 years ago

yes, the article says that it will put itself onto USB sticks so that it can be transferred out of a walled garden, therefore it can enter the same way.

ticks• 14 years ago

I'm probably alone on this, but 'lame' is such a lazy word to use. Saying it repeatedly just made me stop reading.

adewinter• 14 years ago

FWIW (I didn't realize this either until the end), the article is actually pointing out that flame isn't lame for one very specific reason: the cutting edge cryptography research that went into it.

gjm11• 14 years ago

No. The article is pointing out that Flame isn't lame in lots of different ways, and saying that the naysayers kept calling it lame until one single spectacular bit of non-lameness came to light. It's suggesting that they should have cottoned on sooner. At least, that's my reading of it.

Tenhundfeld• 14 years ago

It's using lame as a response to this article: http://xato.net/malware/flame-is-kind-of-lame/

kyebosh• 14 years ago

Apparently "gay" & "retarded" are horribly offensive & insensitive descriptors, but "lame" is ok. Who knew?

MiguelHudnandez• 14 years ago

I suggest it's because it's not commonly used today for its actual definition.

People don't normally refer to themselves or people they love as "lame." Not so for "gay" or "retarded."

A modern equivalent of "lame" might be "handicapped," even though it is not as specific.

Niten• 14 years ago

The thing I find most interesting about Flame: whoever developed it surely understood that by being released into the wild like this, their new cryptographic attack was guaranteed to eventually be discovered and analyzed. And yet they spent that attack's secrecy on a (very sophisticated, but still) fishing expedition.

So what cryptanalytical capabilities do they have which are considered too sensitive to expose via malware?

tptacek10• 14 years ago

Bear in mind that attacks on MD5 have an inherently limited shelf life, and that while the exploit used in Flame may be new, the underlying vulnerability and the fundamental technique used to exploit it are very well known.

s_henry_paulson• 14 years ago

Think about it this way. Flame was designed not to spread automatically, only when it was told to, meaning that a targeted attack like this would be difficult to discover since it affected a relatively few amount of computers compared to a virus designed to propagate at every opportunity, as well as the fact that fishing expedition was limited to only persons the owner were interested in.

Combine this with the fact that we're now dating the creation of the virus to at latest summer 2008 [1], and you've got a sophisticated surveillance mechanism that has been installed on thousands of computers and evaded detection for at least 5 years.

I'm sure there's lots more tricks that advanced virus authors like this have up their sleeve, but they're only useful to someone if they actually get used, and this seems to have paid off for whoever was behind this.

[1] http://www.nation.com.pk/pakistan-news-newspaper-daily-engli...

nikcub2• 14 years ago

> 7. The stolen info is sent out by infecting USB sticks that are used in an infected machine and copying an encrypted SQLLite database to the sticks, to be sent when they are used outside of the closed environment. This way data can be exfiltrated even from a high-security environment with no network connectivity.

> "Agent.BTZ did something like this already in 2008. Flame is lame."

Flame's approach is different and more impressive. Agent.BTZ copied itself and used an easy-to-discover autorun.inf file in the root directory of attached disks or network shares. Flame exports its database by encrypting it and then writing it to the USB disk as a file called '.' (just a period, meaning 'current directory')

When you run a directory listing you can't see it. You can't open it. The windows API doesn't allow you to create a file with that name and Flame accomplishes this by opening the disk as a raw device and directly writing to the FAT partition. Impressive, right.

While a lot of these individual features alone are not impressive the sum of the parts, combined with the collision attack on the certificate signature are very impressive.

As for the main point of Mikko's post, I have never understood why so many folks in the netsec industry are arrogantly pessimistic about the innovation of others. I found Flame jaw-droppingly amazing.

Nobody knew about it for years, yet it was derided when discovered and documented.

EthanHeilman2• 14 years ago

>I have never understood why so many folks in the netsec industry are arrogantly pessimistic about the innovation of others. I found Flame jaw-droppingly amazing.

People are unsure as to why it has such a large file size (do we know why yet?). One very common explanation is that it is bloated because of poor software engineering, some of the people that believe this explanation attempt to fit the facts to that narrative.

Also Consider the culture of the demo scene/exploit writers. The smaller code the better the programmer.

Personally I like to think that the flame authors intentionally exploited this prejudice and made it large so that: 1. it wouldn't look like malware, 2. if it was discovered no one would take it seriously and look deeper, 3. reverse engineering it would be complicated by it's large file size (cost > benefit from an AV perspective).

tptacek10• 14 years ago

The same question was asked of Stuxnet; the answer is probably boring: state-sponsored malware authors are not like demo scene writers and do not care if their code is particularly elegant. They probably care more that it's J2EE-style maintainable.

m0nastic• 14 years ago

As for the main point of Mikko's post, I have never understood why so many folks in the netsec industry are arrogantly pessimistic about the innovation of others. I found Flame jaw-droppingly amazing.

Infosec is an inherently pessimistic enterprise, although spending time here makes me think it's not a perspective limited to security.

Just look at how almost every post here ends up littered with comments like "This isn't new. My XYZ already does all of this." People like to feel superior (it helps reinforce the individual nerd exceptionalism)

Maakuth• 14 years ago

You might want to read between the lines. My take is that the style is a bit sarcastic, especially considering the last lines.

altrego99• 14 years ago

> This isn't new. My XYZ already does all of this.

This is exactly the attitude used by some negative minded mediocre people to demotivate free thinkers. To be fair, to most of them it probably also doesn't seem new in reality, because their grey cells lack the sophistication required to understand the difference.

dhx3• 14 years ago

I think it is more a case of the public information security field moving from a small, highly technical niche of hackers (example list[1]) to a mainstream career path that openly trains and employs thousands of people that may not have a traditional “hacker mind-set”[2][3].

BIFF[4] is still remembered by many within the early niche group of hackers. It is likely that similar psychology has been driving the ridicule at hacker conferences in recent years towards mainstream reporting on “cyber” topics and use of buzz phases such as “Advanced Persistent Threat”.

[1] https://en.wikipedia.org/wiki/Cypherpunk#Noteworthy_cypherpu...

[2] http://www.catb.org/~esr/faqs/hacker-howto.html

[3] https://www.schneier.com/blog/archives/2006/09/what_is_a_hac...

[4] https://en.wikipedia.org/wiki/BIFF

dhx3• 14 years ago

It is worth noting that the 8.3 short name of the hidden file was HUB001.DAT[1]. This is because VFAT allows the specification of both a short name (8.3) and long name (LFN) for each file/directory.

You can find 8.3 '.' entry names by searching a partition for \x2e\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20

A file with an LFN of '.' could be found with (hopefully this is correct) \x00\x2e\x00\x00\x00\x00\xff\xff\xff\xff\x0f

It appears as if 8.3 file names starting with '.' are treated specially but LFNs starting with '.' carry no significant meaning.

I struggled to find references to other malware that has used a similar approach. Does anyone have more information?

Surely Windows does not attempt to automatically execute files with a LFN (UTF-16 name) of '.'?

[1] http://labs.bitdefender.com/2012/06/flame-the-story-of-leake...

[2] https://en.wikipedia.org/wiki/File_Allocation_Table#Director...

nikcub2• 14 years ago

It isn't executed, it is used to get the data out of airgapped networks onto connected infected machines

lawnchair_larry• 14 years ago

Security folks often lack development experience, specifically in products that ship, to appreciate the big picture. This is why certain people on HN were so fixated on a lack of code obfuscation to give credit to the massive QA effort behind making all of stuxnet work on such a complex target.

I say this as a security person who has previously done dev on product teams.

at-fates-hands• 14 years ago

>> Nobody knew about it for years, yet it was derided when discovered and documented.

I had the same reaction, then I thought they did this on purpose to downplay how really impressive Flame is. I imagine the people writing these blogs are actually thinking "Holy S%$&!" behind closed doors or within other security circles.

yassim• 14 years ago

I'm curious.

>9. Latest research proves that Flame is indeed linked to Stuxnet....

Whats the chance that this "Resource 207" is some 3rd party module that more than 1 developer had access to? I concede that placing the same resource in the same resource location in 2 different unrelated applications is a bit of a long shot, but I dont see it as a smoking gun either.

cdooh• 14 years ago

I've been meaning to ask, exactly how big a team would it take to design such a virus?

ritratt• 14 years ago

Flame caught all the attention because it made use of a new hash collision technique currently not know to anyone. Which would mean it was govt. backed.

Flame is Lame

Related Stories