Back when the Microsoft Update piece of the Flame espionage-software package was still undetected it could have soldfor $1 million on the malware black market, a security researcher says. “That discovery is worth a lot of money,” says Marcus Carey,security researcher at vulnerability-management firm Rapid7, “atleast six figures and probably more — seven figures. That’s howelite that attack is.” Since Flame and its components were unmasked, though, that has allchanged. “Nobody’s going to pay that now,” he says. PDA GSM Mobile
The vulnerability that first came to light Sunday when Microsoftissued a rare out-of-cycle security update was an obscure part of a complex and stealthy platform that had evaded detection for more than four years. MORE: Flame malware’s structure among most complex ever seen, saysKaspersky Lab BACKGROUND: Flame Malware: All You Need to Know In particular, Flame exploited Microsoft Terminal Services byhaving its certificate authority generate fake digital signaturesthat authenticated malware as legitimate Microsoft updates. Thisallowed the attackers to alter and update its code at will. But that was just one feature of the entire Flame architecture.Other sophisticated elements include the ability to delete all orparts of itself from infected machines and then overwrite thoseparts to eliminate any trace. China Resistive Touch Screen Tablet PC
It also had a command-and-control infrastructure “unlike anythingwe’ve ever seen before,” according to Kaspersky Lab researchers . It operated out of 80 domains, and the servers involved wereapparently unhacked machines deployed in legitimate businesses. Theservers attempted updates to set alternative C&C paths,Kaspersky says. Creators of Flame were among the elite of malware creators, Careysays. “They had to have a higher aptitude — a world-classunderstanding of how to exploit software and of cryptography.” The Microsoft piece of Flame involved a technique called MP5collisions that have been known since 2008 but that had never beenapplied to Microsoft software before, he says. China Wifi Tv Mobile Phone
Doing somethingsimilar with Microsoft certificates opened the door to installingand tailoring Flame to a vast number of computers, he says. Flame was so stealthy that it sat in a code archive maintained byF-Secure for two years, undetected as malware, according to a blog post on Wired . Carey says Flame is an impressive piece of work, but it doesn’tappear to pose a threat to most corporate networks because it seemsto have been crafted for targeted attacks against networks in theMiddle East. Tim Greene covers Microsoft for Network World and writes the.