Stuxnet... Someone kicked Iran's Ass...

[talisman]

Still cool. Was doing some more reading on this the other day. Very impressive stuff.

[GhostTX]

Now that they know who did it...guess who's going to be the target of everybody else?

[jones4stangs]

nice follow up

[CJ]

Someone is getting killed in Iran as we speak.

[majorownage]

Act of war.

[Broncojohnny]

Act of war.

You mean like seizing an embassy and holding the personnel hostage?

[DON SVO]

You mean like seizing an embassy and holding the personnel hostage?

He's in Branson, Missouri, Al. He's relaxing and on vacation and has no time to spend here for a few days

[Forever_frost]

Act of war.

You really have never found anything worth fighting for have you?

[CJ]

You really have never found anything worth fighting for have you?

you are a wise man frost.

[Forever_frost]

you are a wise man frost.

I have my moments. Our implements of war should not be used foolishly or lightly. However when there is a just cause, they should be used to their full extent.

[UserX]

No one is concerned these Cyberattacks can be used on US citizens?

http://www.f-secure.com/weblog/archives/00002383.html

Flame is Lame

Posted by Mikko @ 10:36 GMT | Comments




--------------------------------------------------------------------------------



When the Flame malware was found two weeks ago, it was characterized as 'Highly advanced', 'Supermalware' and 'The biggest malware in history'.

These comments were immediately met with ridicule from experts who were quick to point out that there was nothing particularly new or interesting in Flame.

In fact, the only unique thing in Flame seemed to be its large size. Even that was not too exciting as analysts went digging for examples of even larger malware and indeed found them (some malware tries to look like video files so they carry full-length movies inside their bodies).

Suggestions that Flame was created by a government and, like Stuxnet and Duqu, would be the product of a nation-state were met with ridicule as well.

But let's have a look at what we've learned about Flame over these two weeks.

1. Flame has a keylogger and a screengrabber

They naysayers are unimpressed. "We've seen that before. Flame is lame."

2. Flame has built-in SSH, SSL and LUA libraries

"Bloated. Slow. Flame is still lame."

3. Flame searches for all Office documents, PDF files, Autodesk files and text files on the local drives and on network drives. As there would easily be too much information to steal, it uses IFilters to extract text excerpts from the documents. These are stored in a local SQLLite database and sent to the malware operators. This way they can instruct the malware to hone in on the really interesting material.

"Flame is lame"

4. Flame can turn on the microphone of the infected computer to record discussions spoken near the machine. These discussions are saved as audio files and sent back to the malware operators.

"Flame is lame, lol"

5. Flame searches the infected computer and the network for image files taken with digital cameras. It extracts the GPS location from these images and sends it back to the malware operators.

"Still, Flame is lame"

6. Flame checks if there are any mobile phones paired via Bluetooth to the infected computer. If so, it connects to the phone (iPhone, Android, Nokia etc), collects the Address Book from the phone and sends it to the malware operators.

"Flame is still lame, kind of."

7. The stolen info is sent out by infecting USB sticks that are used in an infected machine and copying an encrypted SQLLite database to the sticks, to be sent when they are used outside of the closed environment. This way data can be exfiltrated even from a high-security environment with no network connectivity.

"Agent.BTZ did something like this already in 2008. Flame is lame."

8. When Flame was now finally caught, the attackers have been busy destroying all evidence and actively removing the infections from the affected machines.

"Doesn't prove anything. Lame."

9. Latest research proves that Flame is indeed linked to Stuxnet. And just one week after Flame was discovered, US Government admitted that they had developed Stuxnet together with the Israeli Armed Forces.

"You're just trying to hype it up. Still lame."

10. Flame creates a local proxy which it uses to intercept traffic to Microsoft Update. This is used to spread Flame to other machines in a local area network.

"Lame. Even if other computers would receive such a bogus update, they wouldn't accept it as it wouldn't be signed by Microsoft".

The fake update was signed with a certificate linking up to Microsoft root, as the attackers found a way to repurpose Microsoft Terminal Server license certificates. Even this wasn't enough to spoof newer Windows versions, so they did some cutting-edge cryptographic research and came up with a completely new way to create hash collisions, enabling them to spoof the certificate. They still needed a supercomputer though. And they've been doing this silently since 2010.

"…"

And suddenly, just like that, the discussion on whether Flame is lame or not …vanished.

[Nash B.]

Fascinating.

[UserX]

No one is concerned these Cyberattacks can be used on US citizens?

I guess that's a no. This is a pretty crazy virus the government has created, don't think this won't be used at home to catch more "terrorists". Big brother is watching. Where's my tinfoil hat?

3. Flame searches for all Office documents, PDF files, Autodesk files and text files on the local drives and on network drives. As there would easily be too much information to steal, it uses IFilters to extract text excerpts from the documents. These are stored in a local SQLLite database and sent to the malware operators. This way they can instruct the malware to hone in on the really interesting material.

4. Flame can turn on the microphone of the infected computer to record discussions spoken near the machine. These discussions are saved as audio files and sent back to the malware operators.

5. Flame searches the infected computer and the network for image files taken with digital cameras. It extracts the GPS location from these images and sends it back to the malware operators.

6. Flame checks if there are any mobile phones paired via Bluetooth to the infected computer. If so, it connects to the phone (iPhone, Android, Nokia etc), collects the Address Book from the phone and sends it to the malware operators.

9. Latest research proves that Flame is indeed linked to Stuxnet. And just one week after Flame was discovered, US Government admitted that they had developed Stuxnet together with the Israeli Armed Forces.

[stevo]

This is either a "hmmmm" or a "fuuuuuck" moment.....

Stevo

[big_tiger]

I guess that's a no. This is a pretty crazy virus the government has created, don't think this won't be used at home to catch more "terrorists". Big brother is watching. Where's my tinfoil hat?

WTF could we do about it, since it probably already happened? lol We all sleep at night because we all know the odds are too low for us to be a target.