Flame Malware Makers Send 'Suicide' Code
bbc.com
bbc.com
Anyone in the antivirus/virus community knows how much of a slow and often incompetent operation Symantec & Co are.
Even if they were doing little more than independently confirming the cutting edge work of other firms, their voice is massively 'louder' and today's mass media landscape is tilted away from the independent investigation that we could rely upon to properly attribute the work being done in such technical situations.
My biggest problem with all this media is that with knowledge of how it works, and having control of the C&C software, none of those idiots are just saying "For a day let's spoof all of their update centers and spam suicide signal to anyone who comms during that day." Which would kill a majority if not ALL of the virus out there.
Another option is to not sit around proudly on their C&C centers, but that's an obvious start on reversing them as well as a relay point for data. Finding WHAT data EXACTLY they're hunting is the first step in finding who is doing it.
It should be pointed out that they're not actually allowed to do that. As silly as it sounds, controlling another person's computer without their permission is illegal, no matter the reason. The best they can do is take over the /entire/ C&C chain, a monumental task, and then not send any commands to the infected machines, thereby rendering the virus inert.
This has actually happened a few times and it's frustrating to everybody involved, you should read the post linked from here: http://news.ycombinator.com/item?id=3764345
If a virus was spreading and I could counter it (especially without writing my own virus just for that) then my first action would be to do so and document it well.
A doctor would be clapped for, if he/she diagnosed an illness and treated someone. There would be some mumblings of doubt but who would take action against good will and humanitarianism?
If a mechanic saw someone's break lines cut, isn't it their duty just the same to use their information to help people?
We can't learn everything in life, we specialize. Society is no good if we don't use our differed knowledge in tandem with one another. As a specialist if you're not willing to help people with your knowledge then likely you're just a specialist for the purpose of profit, not passion. With that said, perhaps you should reconsider a few things.
I knew I was technically in violation of the law (contra certain amusing "self-defense" rationalizations) however.
In a closed system if you can get ahold of the destination as they have, you can redirect everything else to that center temporarily and just let it keep spamming suicide modules. If it's still confusing I can try to explain it better.
This is simply not the case.[0]
[0] http://dottech.org/wp-content/uploads/2010/12/dotTech_AV_Com...
Secondly, you have to remember that these companies employ many free-thinking humans with varied jobs and abilities. Among those are some skilled analysts who simply take apart viruses for a paycheck. A lot of AV companies have at least a few people who are best of breed at this stuff. They post writeups and share the work of what is interesting. Marketing is generally not involved in the technical blog posts that you see.
Actually I'd disagree. The interesting thing for me is that it overwrites memory locations to thwart memory forensics. This isn't a common thing at all, but is something that I covered in a talk at a DC4420 meeting a year or two ago.
I read a piece about conficker a while ago. I thought it was super cool that it patched the security vulnerability on infected conputers to protect itself. Its just really clever. Now you have Flame which has done what it has done and is now trying to kill itself to make it look like it never existed.
Obviously though it is also deeply concerning. States are investing more and more into cyber warfare. If anything more money needs to be spent hardening computer networks and systems to protect from exactly these kind of threats.
Very fascinating.
I'd like to know how many writes it did since this would finally settle the issue of whether FBI / NSA can read erased data. If one write is good enough for them, you know they can't recover anything with one write either.
In all likelihood, all the Flame authors are trying to do is prevent computer owners from casually detecting that they were infected, now that Flame is public knowledge.
Knowing specfically what the virus was looking for, which machines were infected, and what data was snarfed is of critical importance to the targets.
Purging makes the targets job of forensics much much harder.
Edit: flame code is not monolithic - forensics would be very interested in getting code for all modules: "Later, the operators can choose to upload further modules, which expand Flame’s functionality. There are about 20 modules in total and the purpose of most of them is still being investigated." - http://www.richardsilverstein.com/tikun_olam/2012/05/28/flam...
Second, my source has extensive Israeli military, political & intelligence experience. Third, almost all his scoops have turned out to be true. None have been proven false. Now, what are your bona fides & do they match his?
"The design of this new variant required world-class cryptanalysis"
to
"The finding gives support to claims that Flame must have been built by a nation state rather than cybercriminals."
Doesn't that assume world-class cryptographers only work for governments? Are there are other reasons people are assuming this was state-sponsored?
(Of course, they could be criminals. But there are other reasons to suspect that that is unlikely, most importantly the fact that Flame doesn't appear to steal credit cards.)
It doesn't necessarily rule out criminals, but its much more likely that its state-sponsored.
If the malware is designed to grab bank passwords or steal money, then you can assume there's a criminal enterprise behind it.
But if the malware is specifically targeting certain "problem" countries; and stealing documents and other things of non-monetary value, then it's very likely that there's a government behind it. Which criminal mastermind will say, "tomorrow, I'll steal Word documents of all Syrians" ? What will he do with them anyways? Given the abundance of low-hanging fruit, why would a criminal jump through all these hoops?
He'll sell them to a state actor. Even if something is non-monetary, if someone with money wants it, it can be monetized.
I had heard that Flame targeted Iran, which was one of the reasons people suspected US and/or Israel. This says Israel was targeted. Am I misinterpreting something here? If other evidence supposedly points to a nation-state, what nation-state dislikes both Iran and Israel? Something's not adding up.
Edit: Thanks. "Spy on friends" or "Spy on yourself to deflect attention" seem as viable as any other theories out there, if not more.
In all seriousness, the spying may not be as hardcore or blatant(!) as say US/China or US/Russia but they are not looking for the same kind of intel between US/UK. I wuold be very very surprised if there was not some intel gathering at some level.
Saudi Arabia
Or do nation-state malware programmers maintain a strict no-contact policy to keep the government's hands clean?
I suppose we'll never know the answer.
It talks a bit about how one person tracked attacks through multiple countries back to China.
That one worm was discovered does not mean that every state-designed worm will be (or has been).