June 08, 2012, 11:35 AM — Back when the Microsoft Update piece of the Flame espionage-software package was still undetected it could have sold for $1 million on the malware black market, a security researcher says.
"That discovery is worth a lot of money," says Marcus Carey, security researcher at vulnerability-management firm Rapid7, "at least six figures and probably more -- seven figures. That's how elite that attack is."
Since Flame and its components were unmasked, though, that has all changed. "Nobody's going to pay that now," he says.
The vulnerability that first came to light Sunday when Microsoft issued a rare out-of-cycle security update was an obscure part of a complex and stealthy platform that had evaded detection for more than four years.
BACKGROUND: Flame Malware: All You Need to Know
In particular, Flame exploited Microsoft Terminal Services by having its certificate authority generate fake digital signatures that authenticated malware as legitimate Microsoft updates. This allowed the attackers to alter and update its code at will.
But that was just one feature of the entire Flame architecture. Other sophisticated elements include the ability to delete all or parts of itself from infected machines and then overwrite those parts to eliminate any trace.
It also had a command-and-control infrastructure "unlike anything we've ever seen before," according to Kaspersky Lab researchers. It operated out of 80 domains, and the servers involved were apparently unhacked machines deployed in legitimate businesses. The servers attempted updates to set alternative C&C paths, Kaspersky says.
Creators of Flame were among the elite of malware creators, Carey says. "They had to have a higher aptitude -- a world-class understanding of how to exploit software and of cryptography."