Posted by Virus Bulletin on May 30, 2012
Malware possibly used for cyber-espionage.
The jury is out on whether 'Flame' (also known as 'Flamer' or 'Skywiper') is 'the most lethal cyberweapon to date' as some have claimed, or just a highly complex and sophisticated piece of malware. But simply from looking at the volume of security vendors' blog posts dedicated to the malware since its discovery this week, it is clear that Flame is far from ordinary.
One thing we do know is that there is a lot that isn't known yet. Because of both its size - when fully deployed, it is almost 20MB - and its complexity, researchers expect the full analysis to take several months at least.
What is known is that Flame is a modular piece of malware that has worm-like features, which allows it to spread on a local network. The use of modules is not unique to Flame: prevalent trojans such as ZeuS and SpyEye allow for the use of modules or plug-ins. However, whereas the latter kinds of malware are used to target the masses (stealing online banking details, sending spam), Flame's capabilities, which include network-sniffing, taking screenshots and recording audio conversations, suggest it is being used for cyber-espionage purposes.
So far, a few hundred infections are known, with victims varying from individuals to state-related organisations. Most of the victims are located in the Middle East: of the few hundred known infections, Iran features most prominently as a location, followed by Israel and Sudan.
The complexity of the malware, the prevalence of infections in Iran, as well as a number of technical features (such as the use of the Lua scripting language), suggest similarities with Stuxnet and Duqu. However, there are many differences too: unlike Stuxnet it does not appear to target SCADAs and the number of infections is probably significantly larger than that of Duqu. It is currently unclear whether the malware uses any zero-day exploits.
It is possible that Flame was developed by the same group that developed Stuxnet and Duqu, though likely as a parallel project. Given the location of the infections and the fact that developing something like Flame would require huge resources, many believe the governments of one or more rich Western nations are behind the malware. However, as with Duqu and Stuxnet, noone has been able to prove such claims.
While it has been discovered only recently, it is believed that Flame has been around for some time, possibly going back as far as March 2010. Writing about the malware, F-Secure's Mikko Hyppönen said that this is a case where the anti-virus industry has failed.
Virus Bulletin will continue to follow the developments around Flame and report about it on www.virusbtn.com and on our Twitter feed. While complacency is rarely a good idea when it comes to cybercrime, it is worth pointing out that the vast majority of users and organisations are unlikely to be affected by the malware.
Possibly the best introduction to Flame is this set of FAQs at Kaspersky's Securelist blog. Flame was first reported by MAHER, the Iranian CERT, whose report can be found here. A thorough analysis was performed in a report by the Hungarian CrySys lab here (PDF).
Posted on 30 May 2012 by Virus Bulletin
