Does the Flame malware that was reported in the Middle East have any wider security implications?

ITworld Answers

Ask a Question

Does the Flame malware that was reported in the Middle East have any wider security implications?

blackdog 50 weeks ago

I don't know much about the Flame malware that was reported last week beyond the "facts" that it was probably designed by the US and/or Israeli governments, it targeted Iran and it was a large piece of software. What, if any, new threats does it introduce that require additional security steps for businesses here in the US?

Tags: flame, malware, virus

Topic: Security

Answer this Question

Login or register to post answers
Permalink

Answers

2 total

jimlynch 50 weeks ago

Here's a good background article about it.

Flame (malware)
http://en.wikipedia.org/wiki/Flame_(malware)

"Flame,[a] also known as Flamer, sKyWIper,[b] and Skywiper,[2] is modular computer malware discovered in 2012[3][4] that attacks computers running the Microsoft Windows operating system.[5] The program is being used for targeted cyber espionage in Middle Eastern countries.[1][5][6] Its discovery was announced on 28 May 2012 by MAHER Center of Iranian National Computer Emergency Response Team (CERT),[5] Kaspersky Lab[6] and CrySyS Lab of the Budapest University of Technology and Economics.[1] The last of these stated in its report that "sKyWIper is certainly the most sophisticated malware we encountered during our practice; arguably, it is the most complex malware ever found."[1]

Flame can spread to other systems over a local network (LAN) or via USB stick. It can record audio, screenshots, keyboard activity and network traffic.[6] The program also records Skype conversations and can turn infected computers into Bluetooth beacons which attempt to download contact information from nearby Bluetooth-enabled devices.[7] These data, along with locally stored documents, are sent on to one of several command and control servers that are scattered around the world. The program then awaits further instructions from these servers.[6]

According to estimates by Kaspersky in May 2012, Flame had infected approximately 1,000 machines,[7] with victims including governmental organizations, educational institutions and private individuals.[6] At that time the countries most affected were Iran, Israel, Sudan, Syria, Lebanon, Saudi Arabia, and Egypt,[3][6] with a "huge majority of targets" within the first.[8] The program ceased operation after its exposure in the media.[8]"

Share this answer
Permalink

hughye 50 weeks ago

Microsoft just released a patch a day or so ago that plugs the hole exploited by Flame (or at least claims to). Apparently Flame used a method that let it falsify a MS digital credential so that it looks like an update for enterprise users with remote desktops. And it was around since at least 2010. Which is nice.

I have read conflicting accounts of how serious of a development Flame really is. Kaspersky has been ringing the alarm bells very loudly, although they did note that it was a very targeted piece of malware. There is always a risk of something targeted getting "off-target" and causing all kinds of unintended consequences. Still, the risk to most companies is so small as to be negligible. We just aren't its target. The ironic thing is that overall security is probably increased by the discovery, since yet another vulnerability is addressed. Total security is like trying to squeeze a handful of water; it will never be accomplished.

Share this answer
Permalink

Answer this Question

Ask a question

Google to lengthen SSL encryption keys from August

Google plans to upgrade the security of its SSL (Secure Sockets Layer) certificates, an important component of secure communications.

Microsoft brushes off claim Xbox Live accounts were compromised

Microsoft brushed off a dubious hacker's claim on Thursday that he stole 47 million account credentials for Microsoft's Xbox Live gaming service.

Could the Bitcoin network be used as an ultrasecure notary service?

Manuel Araoz, a 23-year-old developer in Argentina, has an idea for Bitcoin that doesn't focus on money.

U.S. urged to let companies 'hack-back' at IP cyber thieves

U.S. companies should be allowed to take aggressive countermeasures against hackers seeking to steal their intellectual property, contends the private Commission on the Theft of American Intellectual Property.

Researchers find more versions of digitally signed Mac OS X spyware

Security researchers have identified multiple samples of the recently discovered "KitM" spyware for Mac OS X, including one dating back to December 2012 and targeting German-speaking users.

SoftBank said to be in talks with US to allay national security fears

The U.S. government is in negotiations with SoftBank for greater control over equipment purchases by Sprint Nextel and the selection of one of the Japanese company's nominee to the U.S. carrier's board, according to a news report.

Twitter aims to become safer with two-step sign-in

Twitter, in a much-needed move to keep its users safer from cyberattacks, is introducing a more secure login process.

Growing mobile malware threat swirls (mostly) around Android

Mobile devices are getting hit by a boom in malware similar to the one that hit PCs starting with the rise of the Web, a security software executive said Tuesday.

Blue Coat Systems to acquire security analytics firm Solera Networks

Blue Coat Systems, a provider of Web traffic filtering and business assurance products and services, plans to buy security analytics specialist Solera Networks, which uses data mining techniques to classify network traffic and detect potential security threats.

New Citadel malware variant targets Payza online payment platform

A new variant of the Citadel financial malware is targeting users of the Payza online payment platform by launching local in-browser attacks to steal their credentials, according to researchers from security firm Trusteer.