Couple links to info - Flame malware « Giveaway of the Day Forums

Back to Giveaway of the Day

Giveaway of the Day Forums » General discussion

Couple links to info - Flame malware

(8 posts) (5 voices)

Started 11 years ago by mikiem2
Latest reply from Jeff Hargreave

mikiem2
Moderator

http://www.securelist.com/en/blog?cat=4
last couple by Aleks at the time I'm posting this

arstechnica.com/security/2012/05/spy-malware-infecting-iranian-networks-is-engineering-marvel-to-behold/

http://labs.bitdefender.com/2012/05/cyber-espionage-reaches-new-levels-with-flamer/

---------------------

I've started to see articles etc. that maybe have a bit less accurate info, maybe with a bit of editorial content thrown in. If interested maybe those links will help, & as the malware is being studied by good guys & bad, perhaps knowing what to look for isn't a bad idea either.

Posted 11 years ago #
Anonymous
Unregistered

Thanks mikiem2 more info
http://www.kaspersky.com/about/news/virus/2012/Kaspersky_Lab_and_ITU_Research_Reveals_New_Advanced_Cyber_Threat

http://www.certcc.ir/index.php?name=news&file=article&sid=1894

At the time of writing, none of the 43 tested antiviruses could detect any of the malicious components.

http://www.informationweek.com/aroundtheweb/security/iran-confirms-attack-by-new-virus/6c45306d5056746f4d437136326d71393752576b62773d3d?cid=SBX_iwk_fture_sociative_Security_security&itc=SBX_iwk_fture_sociative_Security_security

Iran Confirms Attack by New Virus

Posted 11 years ago #
mikiem2
Moderator

There are a couple of new blogs from the same guy at Kaspersky posted to securelist.com/en/blog?cat=4 -- many will no doubt be relieved to read: "It’s important to say that Flame does not run on Windows 7 64 bit...".

There's also a new article at http://labs.bitdefender.com/2012/06/flame-the-story-of-leaked-data-carried-by-human-vector/

It includes info on how the malware apparently writes to USB storage in a way that's almost completely undetectable. As with Stuxnet, probably how whomever got the malware onto systems with no outside connections in the 1st place. And a good reminder to treat any USB device with caution -- if it can store data it can store an exploit, occasionally right from the factory.

Personally I think the part about Flame not working on win7 64 interesting -- the team that created Flame spent enough resources on the effort that I'd think they certainly could have designed it to work on both win7 32 & 64. So why didn't they, considering win7 64 is so much more common than the 32 bit version? Flame can be upgraded/patched, & new modules added -- it could have been around much longer than the 2010 dates they've confirmed so far, being revised in 2010 rather than created that year... if win7 64 wasn't so popular when Flame was conceived, its authors wouldn't have known any better. OR, maybe Flame was targeting older hardware because that's what the intended target installations used? ***IF*** Flame's masters are based in the West, e.g. the EU or US, I suppose not working on win7 64 *might* have even been a Microsoft demand, in return for their cooperation.

Posted 11 years ago #
graylox
Moderator

I don't live east of Iran and I don't have a nuclear reactor under my kitchen sink, but my paranoia is still showing it's ugly face....

DHS Issues Joint Warning On Flame's Windows Update Hack

Posted 11 years ago #
Robert
StrayCat

http://threatpost.com/en_us/blogs/flame-malware-uses-forged-microsoft-certificate-validate-components-060412

http://answers.microsoft.com/en-us/windows/forum/windows_xp-security/kb2718704-connection-to-flame-malware/ca73ce4b-4718-4926-bb86-b21a1762012a

The good news is, MS is pushing kb2718704 right now on XP and 7 (32bit-not sure about 7 64bit)
:)

(If not, you can always use windows update).

Quote from the second link :

Flamer is not“out there” on the Internet right now, spreading from country to country. You are not
likely to find Flamer attached to an email in your Outlook Inbox (USB flash drives seem
to be Flamer’s infection vector of choice). And if you are using a good antivirus product ,it is now protecting you from Flamer. The major AV products were quickly updated to detect

Flamer and the better ones will now have generic detection of malware that has “Flamer-like”
characteristics.

Posted 11 years ago #
Robert
StrayCat

On US machines the date should read 6/04/2012.
:)

Posted 11 years ago #
mikiem2
Moderator

MS is pushing kb2718704 right now on XP and 7 (32bit-not sure about 7 64bit)

Yes, it was pushed out to 7 64 as well -- I assume the worries are twofold: that bits & pieces of Flame will wind up being used in other malware, & that they'd face criticism & even possibly legal action if they didn't [just have to show harm that would not have happened had MS released a win7 64 patch].

Flamer and the better ones will now have generic detection of malware that has “Flamer-like” characteristics.

My understanding is that Flame succeeded because, outside of collecting/forwarding data it behaved more like Windows than malware. I'm not doubting that future versions of AV software will watch for & hopefully prevent future malware, but IMO it will have to continue to be on a case-by-case basis as new threats are discovered, IOW as it is now. [I can just imagine heuristic AV scanning for processes that behave like Windows] So even hinting that we'll all be protected from so-called "Flamer-like characteristics" sounds awful patronizing to me, sort of a marketing statement.

Reason I highlight that is in case anyone else reads it the same way I do, as patronizing -- that statement was made by Stephen Cobb ESET Security Evangelist [an evangelist works in/for marketing]. No reason then to denounce Microsoft nor ESET because of it.

my paranoia is still showing it's ugly face....

I worry that someone(s) will make use of Flame methods & code, targeting the self-serve photo kiosks & machines that are all over the place, at least here in the US -- they all accept USB sticks, SDHC cards etc., and all of those USB sticks & cards are plugged into systems at home... alter things a bit so it's not recognized by AV software, & in theory at least a bad guy/gal could build a pretty massive botnet.

Posted 11 years ago #
Jeff Hargreave
Member

I noticed a lot of exploits utilizing Adobe Flash as cover-up.
Adobe is rather secretive when confronted on how secure the Adobe Flash platform is.

Now, to put this into perspective:
On one day, count how many ads you have passed that are made with Flash.
And, how many of the same ads are from the same origin.
It's extremely easy to fake ads and design them for on the fly patch and hack when you visit a website.
Next thing, the 0-Day attacks. Nobody, for obvious reasons, knows exactly how many 0-Day vulnerabilities are actually out here. At the moment there is some serious festering underneath the carpets. What we have seen with Flame is even not in the slightest the tip of the iceberg.
The top 10 Anti Virus companies are having a very busy time including Microsoft.
However, as always, they all prioritize enterprise customers first. The consumers (we) have to wait on the way for a fix.

Things to consider:

Use VMWare Player - although hackers researching on this particular platform persistently, real vulnerabilities are extremely hard to find.
Install a Linux distribution like CentOS from YOUR real ISO image. Don't use ANY offered browser appliances that are not VMWare certified.

VMWare is the safest way at the moment.
Not many use it because they find it inconvenient at best.
Not so at all, if you pause the VMWare it will start up very quick.
Set an entry in the start-up items of Windows... done.

Next:
Disable scripts for new unknown websites, regardless of whatsoever.
Enable scripts only on 100% trusted websites.

Disable automatic download of content inside your email. By downloading content automatically the actual content downloaded might be on the attackers server to get confirmation who has downloaded the content to verify someones email address.
Usually this particular content is a 1 pixel in size blank image.
Common is: http://servername.com/download/p.png --- "p" as pixel png

And never open any attachments without scanning them with up-to-date AV software
Just because you receive a ZIP file from your friend doesn't mean your friend's email is not compromised.

Last thing:

USE COMMON SENSE for whatever you do on the Internet.
Things not to download include:

- Unknown Freeware offers via advertising
- Keygens and serial text files (in 90% of cases they are not clean)
- Game Trainers (use common sense)
- video clips with custom or unrecognized Codec (buy your girlfriend something nice)
- ZIP files from unknown sources
- Executable (EXE) from unknown sources
- a note to system optimizers: look out for reputable companies like Symantec etc.

...

Posted 11 years ago #

RSS feed for this topic

Reply

You must log in to post.