Iran Flamed by Super Virus

[JAD_333]

Overwhelmingly, comments on this article have congratulated Israel, although no hard evidence exists to say what country or persons came up with this grandaddy of all spy viruses.

ran Confirms Attack by New Data Virus
By THOMAS ERDBRINK
Published: May 29, 2012 68 Comments

TEHRAN — The computers of high-ranking Iranian officials appear to have been penetrated by a data-mining virus called Flame, in what may be the most destructive cyberattack on Iran since the notorious Stuxnet virus, an Iranian cyberdefense organization confirmed on Tuesday.

In a message posted on its Web site, Iran’s Computer Emergency Response Team Coordination Center warned that the virus is potentially more harmful than the 2010 Stuxnet virus, which destroyed several centrifuges used for Iran’s nuclear enrichment program. In contrast to Stuxnet, the newly identified virus is designed not to do damage but to secretly collect information from a wide variety of sources.

Flame, which experts say could be as many as five years old, was discovered by Iranian cyberexperts. In a statement about Flame on its Web site, Kaspersky Lab, a Russian producer of antivirus software, said that “the complexity and functionality of the newly discovered malicious program exceed those of all other cyber menaces known to date.”

The virus bears special encryption hallmarks that an Iranian cyberdefense official said bear strong similarities to previous Israeli malware. “Its encryption has a special pattern which you only see coming from Israel,” said Kamran Napelian, an official with Iran’s Computer Emergency Response Team. “Unfortunately, they are very powerful in the field of I.T.”

While Israel never comments officially on such matters, its involvement was hinted at by top officials there. “Anyone who sees the Iranian threat as a significant threat — it’s reasonable that he will take various steps, including these, to harm it,” said the vice prime minister and strategic affairs minister, Moshe Yaalon, in a widely quoted interview with Israel’s Army Radio on Tuesday.

In a speech Tuesday night, Prime Minister Benjamin Netanyahu did not mention Flame specifically, but he did include cyberthreats as one of five critical types of threats Israel faces, saying, “We are investing a great deal of money in that, human capital and financial capital. I expect these investments to yield a great deal in the coming years.”

Mr. Napelian said that Flame seems designed to mine data from personal computers and is distributed through USB sticks rather than the Internet, meaning that a USB has to be inserted manually into at least one computer in a network.

“This virus copies what you enter on your keyboard, it monitors what you see on your computer screen,” Mr. Napelian said in a telephone interview. That includes collecting passwords, recording sounds if the computer is connected to a microphone, scanning disks for specific files and monitoring Skype.

“Those controlling the virus can direct it from a distance,” Mr. Napelian said. “Flame is no ordinary product. This was designed to monitor selected computers.”

Mr. Napelian said he was not authorized to disclose how much damage Flame had caused, but guessed the virus had been active for the past six months and was responsible for a “massive” data loss. Iran says it has developed antivirus software to combat Flame, something that international antivirus companies have yet to do, since they have just become aware of its existence.

“One of the most alarming facts is that the Flame cyberattack campaign is currently in its active phase, and its operator is consistently surveilling infected systems, collecting information and targeting new systems to accomplish its unknown goals,” Alexander Gostev, chief security expert at Kaspersky Lab said on the company’s Web site.

In his speech Tuesday, at the annual conference of Israel National Security Studies, Mr. Netanyahu made his first public comments about the talks last week in Baghdad on Iran’s nuclear program, expressing disappointment that the Western powers were not demanding more of Tehran.

“Not only should the sanctions be intensified, the demands should be intensified,” Mr. Netanyahu said. “I say sadly that this is not what’s being required of Iran today. In the previous round they were asked to stop the 3.5 percent enrichment and that’s not what’s happening now.”

He added: “They have continued to enrich, undisturbed. In other words, they are moving ahead, constantly, with their nuclear program to build a nuclear bomb.”

Jodi Rudoren contributed reporting from Tel Aviv.

http://www.nytimes.com/2012/05/30/wo....html?_r=1&hpw

[Double Edge]

Mr. Napelian said that Flame seems designed to mine data from personal computers and is distributed through USB sticks rather than the Internet, meaning that a USB has to be inserted manually into at least one computer in a network.

“This virus copies what you enter on your keyboard, it monitors what you see on your computer screen,” Mr. Napelian said in a telephone interview. That includes collecting passwords, recording sounds if the computer is connected to a microphone, scanning disks for specific files and monitoring Skype.

ok

“Those controlling the virus can direct it from a distance,” Mr. Napelian said. “Flame is no ordinary product. This was designed to monitor selected computers.”

Then they can find out with whom Flame is communicating with.

Mr. Napelian said he was not authorized to disclose how much damage Flame had caused, but guessed the virus had been active for the past six months and was responsible for a “massive” data loss.

Huh ?

“One of the most alarming facts is that the Flame cyberattack campaign is currently in its active phase, and its operator is consistently surveilling infected systems, collecting information and targeting new systems to accomplish its unknown goals,” Alexander Gostev, chief security expert at Kaspersky Lab said on the company’s Web site.

They still don't know what it does.

[Doktor]

New super-cyberweapon 'the Flame' discovered
Contributor: Andrew Elwell

Posted: 05/28/2012 12:00:00 AM EDT

A cyber weapon 20 times more sophisticated than Stuxnet has been discovered by Russian internet security firm Kaspersky Lab it was revealed this morning.
The malicious programme, called the Flame, is thought to have been undetected for two years having been active, or “in the wild”, since March 2010. Middle Eastern countries including Iran, Israel, Sudan, Syria, Lebanon, Saudi Arabia and Egypt have all been affected according to reports.

Due to the complex nature of the virus, the Flame has been labelled a “super-cyberweapon.” Fears have been growing over a possible ‘cyber war’ for a number of years; the uncovering of the Flame as the next phase in that conflict is unlikely to allay those fears.

Eugene Kaspersky, CEO and co-founder of Kaspersky Lab, said: “The risk of cyber warfare has been one of the most serious topics in the field of information security for several years now. Stuxnet and Duqu belonged to a single chain of attacks, which raised cyberwar-related concerns worldwide. The Flame malware looks to be another phase in this war, and it’s important to understand that such cyber weapons can easily be used against any country. Unlike with conventional warfare, the more developed countries are actually the most vulnerable in this case.”

What’s worse, considering the Flame has been running wild for over two years, the “next phase” of cyber warfare and the even the phase after that may also be running through our networks undetected as we speak.

Kaspersky said that the Flame “can steal valuable information, including but not limited to computer display contents, information about targeted systems, stored files, contact data and even audio conversations.”

It’s believed that such a complex programme is unlikely to be the work of cyber criminals or individuals within a group, such as Anonymous or LulzSec, and is probably a government-backed virus just as the Stuxnet virus was.

It is, however, easy to overstate this threat. The term ‘cyber warfare’ itself is one that polarises opinion, with many commentators and experts insisting that there will never be a ‘war’ fought solely in the cyber domain; rather, that attacks in the cyber domain will be utilised as a warfare tactic during a physical conflict.
Indeed, according to Kaspersky, “the primary purpose of Flame appears to be cyber espionage, by stealing information from infected machines.”

Espionage is not an act of war. The Cold War was underpinned by 50 years of espionage and intelligence gathering on all sides; it did not lead to conflict per se. Similarly, no nation is likely to perceive any such attack on its computer networks as an act of war.

Dick Crowell of the U.S. Navy War College has a thoughtful response to this, which he expressed at a recent conference on cyber security. “I don’t believe there will ever be a thing which we can call a ‘Cyber War’ … but I think cyber warfare tactics will be employed in all future conflicts.”

The Flame is clearly a serious threat to national security, personal privacy and commercial intellectual property, but it’s flippant to throw terms like ‘cyber war’ around unduly. The discovery of each of these new “phases” should be considered within a sensible and contextual framework.

This article says the virus attacked other countries but Iran, too, oh and not for 6 months, but for 2 years

[bigross86]

Middle Eastern countries including Iran, Israel, Sudan, Syria, Lebanon, Saudi Arabia and Egypt have all been affected according to reports.

Yup, we infected our own computers too, for shits and giggles...

[JAD_333]

This article says the virus attacked other countries but Iran, too, oh and not for 6 months, but for 2 years

It's viral.

[Double Edge]

A 20MB (!) virus with embeedded SQLite

see the source for addtional links

Super-powerful Flame worm could take YEARS to dissect | The Register | May 29 2012

Super-powerful Flame worm could take YEARS to dissect
But it shares same scripting tech as Angry Birds
By John Leyden

Posted in Business, 29th May 2012 13:11 GMT

Analysis The exceptionally complex Flame malware, this week found on numerous systems across the Middle East and beyond, is likely to take months if not years to analyse.

Early indications suggest that Flame is a cyber-espionage toolkit that has penetrated computers primarily, but not exclusively, in Iran and Israel. The worm may have been in circulation for at least two years (and perhaps much longer) but only hit the news on Monday following a series of announcements by security groups and antivirus firms.

Iran's National Computer Emergency Response Team published a warning about the data-stealing virus [1], promising an antidote: so far the malware has completely evaded detection by commercial antivirus scanners. Iranian researchers described the malware as a "close relation" to Stuxnet, the famously well-engineered nasty that sabotaged industrial control systems linked to Iran's controversial nuclear programme.

Kaspersky Lab said the UN International Telecommunication Union had alerted it to Flame and asked for help analysing the malware, which was believed to be wiping information from Middle Eastern computers. Kaspersky said the unusually large virus [2] has been spreading since March 2010.

However, Hungarian security researchers at the Laboratory of Cryptography and System Security (CrySyS) fear Flame may have been active for somewhere between 5 to 8 years. The Budapest-based lab published a preliminary analysis [PDF] [3] of the malware, which it dubbed sKyWIper - the CrySys Lab realised the complex piece of malicious software that they had been analysing for weeks was clearly a build of Flame.

Other security firms have since waded in with their own observations and early analysis; confusingly, other researchers are calling the threat either Viper or Flamer.

There's general consensus that Flame is the most elaborate malware threat ever uncovered, and that it was almost certainly developed by a state-sponsored team. The Hungarian team concludes that the malware was "developed by a government or nation state with significant budget and effort, and may be related to cyber warfare activities".

How Flame spread its digital inferno

The 20MB virus compromises Windows-based PCs and stealthily installs itself before stealing data and passwords, taking screenshots and surreptitiously turning on microphones to record audio conversations. The malware sets up a backdoor and opens encrypted channels to command-and-control (C&C) servers using SSL protocols.

Flame shares some characteristics with the early Duqu and Stuxnet worms, but also has a number of differences.

Like Stuxnet and Duqu, Flame malware can spread via USB sticks and across insecure networks. All three infect machines running Microsoft's operating system. Flame contains exploits for known and fixed vulnerabilities, such as the print spooler's remote code execution bug and the .lnk security hole first found in Stuxnet.

However, Flame is much more complex than either Stuxnet or Duqu: it is made up of attack-launching modules that can be swapped in and out as required for a particular job; it uses various open-source libraries including libz for compression; it is spread out over several files rather than as one executable; and most unusually it uses a database managed by the SQLite library.

It also executes a small set of scripts written in Lua - a programming language favoured by computer game makers such as Rovio for Angry Birds. These direct the operation of the attack modules.

Several Flame files claim to be Microsoft Windows components, but none are signed with a valid (or even possibly stolen) private key - unlike the signed files used by Duqu and Stuxnet.

Both Duqu and Stuxnet targeted industrial control systems, while Flame is far more promiscuous. Crucially, analysis suggests that while Stuxnet and Duqu use the same building blocks (a common platform most likely used [4] by the same programming team), Flame is independent of this architecture.

"The threat shows great similarity to Stuxnet and Duqu in some of its ways of operation yet its code base and implementation are very different, and much more complex," McAfee notes [5], hypothesising that Flame might be a "parallel project" to Stuxnet and Duqu.

Worm rears head after attacks on oil field systems

Over recent weeks, prior to Monday's announcement about the malware, Iran reported intensified cyber-attacks on its energy sector, which they observed as a direct continuation of the Stuxnet and Duqu attacks. This may be linked to a decision last month [6] to disconnect the main oil export terminal on Kharg Island in the Persian Gulf following a computer virus infection.

"Evidently, the threat has been developed over many years, possibly by a large group or dedicated team," McAfee notes.

"We found publicly available reports from anti-spyware companies, and log files in public help forums, which could indicate infections of early variants of Skywiper in Europe and Iran several years ago (for example: March 2010). Skywiper appears to be more wildly spread than Duqu, with similarly large numbers of variants."

Symantec agrees with its rival's assessments that Flame was developed by a team, concluding that the "code was not written by a single individual but by an organised well-funded group of personnel with directives". Unlike Stuxnet, Flame is not particularly targeted and has spread to civilians' systems in many countries.

"Initial telemetry indicates that the targets of this threat are located primarily in Palestinian West Bank, Hungary, Iran, and Lebanon. Other targets include Russia, Austria, Hong Kong, and the United Arab Emirates. The industry sectors or affiliations of individuals targeted are currently unclear," Symantec said.

"However, initial evidence shows the victims may not all be targeted for the same reason. Many appear targeted for individual personal activities, rather than their company of employment. Interestingly, in addition to particular organisations being targeted, many of the attacked systems appear to be personal computers being used from home Internet connections."

David Harley, senior researcher at ESET, agreed with McAfee that Flame and Stuxnet are more different than they are similar.

"Whether it’s actually targeting a specific country is not clear: after all, Stuxnet is nowadays assumed to have been targeting Iran, but was originally detected over a very wide area," Harley said. "While there’s speculation that Flamer is linked in some way to Stuxnet and Duqu, that seems to me to be purely speculative right now, as the code seems very different."

Other than saying it's likely the work of state-sponsored black hat coders, possibly in the employ of an intelligence agency, nobody is speculating who is behind Flame. A lot of the same caveats apply to Stuxnet, but circumstantial evidence does point towards some sort of joint Israeli-US operation.

Even though the full capabilities of Flame, much less who created it and why, remain a bit of a mystery, security firms can at least add detection for the malware now that samples are circulating among researchers.

"Other tricks that Skywiper/Flame might have up its sleeve may take some time to ascertain. It's code more than twenty times larger than Stuxnet, which means it could take substantial effort to analyse it all," writes Graham Cluley, a senior security consultant at Sophos. "Fortunately, complete code analysis is not necessary to add detection."

[Double Edge]

The Flame: Questions and Answers |Securelist |May 28 2012

[S2]

David Sanger Points Stuxnet At America and Israel

In a fascinating article adapted by the NYT from David Sanger's forthcoming book- Confront and Conceal: Obama's Secret Wars And The Surprising Use Of American Power, the Washington D.C.-based White House correspondent for the NYT draws a compelling picture of the decisions and processes behind the development and employment of the Stuxnet computer virus. The article lays responsibility for the use of Stuxnet clearly at the feet of Barak Obama although the origins of its development trace back to the Bush Administration.

Israel? Co-opted into the project for reasons of their intelligence insights, computer savvy and preparedness to implement plans that could hinder U.S. objectives. This is, as usual from Sanger, an excellent read-

Obama Order Sped Up Waves Of Cyber Attacks Against Iran-NYT Sanger June 1, 2012

[Parihaka]

In a fascinating article adapted by the NYT from David Sanger's forthcoming book- Confront and Conceal: Obama's Secret Wars And The Surprising Use Of American Power, the Washington D.C.-based White House correspondent for the NYT draws a compelling picture of the decisions and processes behind the development and employment of the Stuxnet computer virus. The article lays responsibility for the use of Stuxnet clearly at the feet of Barak Obama although the origins of its development trace back to the Bush Administration.

Israel? Co-opted into the project for reasons of their intelligence insights, computer savvy and preparedness to implement plans that could hinder U.S. objectives. This is, as usual from Sanger, an excellent read-

Obama Order Sped Up Waves Of Cyber Attacks Against Iran-NYT Sanger June 1, 2012

As usual I'm left in two minds about Obama. On the one hand I applaud the use of other than bombs to achieve a purpose, but while I realise what we know of is only the tip of the iceberg (or should be), both of these attacks seem relatively simplistic in conception, as though the 'weapons' were implemented too early in their development. I'd hope that there are far more sophisticated pieces of code out there, not in writing but in concept, one's that don't destroy centrifuges but which do misreport results as an example.

[S2]

Parihaka Reply

"...both of these attacks seem relatively simplistic in conception, as though the 'weapons' were implemented too early in their development..."

Perhaps. OTOH, there's also the concern about overcooking the stew. The aroma might reach those for which it's intended far before the main dish. To that end, "use it or lose it" becomes part of the calculus.

"...I'd hope that there are far more sophisticated pieces of code out there..."

I'd imagine there are many variations of a theme at play already or in the works. You're unquestionably a bright guy but hardly the only one. These ladies and gents do this for a living (now) and I've little reason to question their (or our enemies) skills. We've almost certainly only seen the tip of the iceberg.

Of equal interest to me is the nature of the article and its revelations. Is this a contrived leak? If not, what damage has been done to American/Israeli/Western nat'l security interests by this article? Might this article be disinformation with Sanger playing the unwitting (or otherwise) dupe?

[Double Edge]

both of these attacks seem relatively simplistic in conception, as though the 'weapons' were implemented too early in their development.

What i'm not getting is how quickly these efforts get attributed back to the US & Israel. Why is the press talking about it if these are supposedly classified ops. It makes me suspect the actual utility of these tools and makes me consider instead the effects making their use public achieves ie yet another psy-ops. This ain't some new fangled cyber warfare, its old school, true & tested psychological warfare.

If Iran has to do lots of checks, that in itself slows their operation down. There may not even be a worm or if there was it wasn't very effective at its job which would not be too surprising. Therefore much better to have people talk about it.

FUD (Fear, Uncertainty, Doubt) has its uses in a lot of fields.

I'd hope that there are far more sophisticated pieces of code out there, not in writing but in concept, one's that don't destroy centrifuges but which do misreport results as an example.

A worm that is upto 20MB is a joke. Who the hell expects such a contraption to spread, let alone be useful for the stated purpose. Any resonably competent IT dept ought to be able to contain its spread in a corporate environment. It strikes me as ambitious to think an heavily defended nuclear plant could not.

On the one hand I applaud the use of other than bombs to achieve a purpose

This is the other bit, (and i don't want to fight it too much) the hype over these efforts and the 'success' of sanctions are used to counter the 'bomb iran' brigade.

[S2]

Loose Lips Sink Ships

Others are wondering similarly. CNN's take on security/intelligence leaks-

Loose Lips And The Obama Nat'l Security Ship-CNN

[Double Edge]

heh, as i clicked on the NYT article from the CNN link i got this ad from the economist saying...'why an attack will not elliminate the threat'. Great way to set the scene.

Let me add a secondary target to the list. The American + Israeli public and any other interested bystander. For here are the answers to that burning question..

'What are we doing about it'

..no doubt, stoked up by the breathless, hysterical spin to date.

Loose lips ? no, just more loose talk on top of before and there's loads more where that came from.

This isn't about blowing secrets except in some limited instances, this is about purposeful spin dressed up as leaks. i don't see the govt getting all bent out of shape over it. hell, they're actively partaking in it. that means its in their interest. oh some people are upset but what are they doing about it. No Valery Plame like witch hunt yet is there. This ain't no wikileaks.

All your CNN link does is further reinforce the spin. oh important people are upset, it must be true then.

In the latest case, the White House denied it was orchestrating the leak. Asked Friday if the Times' story detailing the cyberattack on Iran was an "authorized leak," White House spokesman Josh Earnest disagreed "in the strongest possible terms."

"That information is classified for a reason. Publicizing it would pose a threat to our national security," Earnest told reporters.

Yeah, right :Dancing-Banana:

But the White House has tried to be more open about what have been secretive programs. The president himself became the first administration official to acknowledge U.S. drones were conducting attacks in Pakistan when he made a comment to a supporter in an online chat, even though officials through all the years of the program had never said publicly they were being conducted.

If they are trying to be open about those programs they are not secret anymore. Just adding an official impirmatur to what is already known on the ground. Where is the secret when there have already been 250+ strikes at the time the president confirmed it.

[snapper]

I wonder if we shall ever see 'VMD' or Virus's of Mass Destruction where suspicion that a country may be developing them promts a pre-emptive 'cyber strike'? I am sure we are not far off. Certainly Stuxnet was what might classed as a 'targeted' attack aimed directly at the Iranian nuclear programme, be it a weapons programme or not. So the Iranians claim anyway. Flame the Iranians again blame those fiendishly clever Israelis for.

As for Flame itself nobody seems sure of what it does as yet, or how it gains entry. Stuxnet was 500k of code and Flame is 20 MB. Nobody even seems to be sure how long Flame has been around as they only became aware of it after some computers were wiped, which may or may not have been due to Flame.

Kinda reminds me of the foolproof cuber security doctrine; "If you've got a computer, don't turn it on. If you do turn it on don't contect it to the web" etc...

[snapper]

Seems this Flame virus has a self destruct switch: "The creators of the Flame malware have sent a "suicide" command that removes it from some infected computers." BBC News - Flame malware makers send 'suicide' code

I am wondering why such a 'suicide command' is necessary and/or activated. Has someone been too clever that they need to cover up their tracks? Perhaps it is reverse engineerable? Odd...