Forgot your password?
typodupeerror
Security IT

Flame Malware Authors Hit Self-Destruct 260

Posted by samzenpus
from the without-a-trace dept.
angry tapir writes "The creators of the Flame cyber-espionage threat ordered infected computers still under their control to download and execute a component designed to remove all traces of the malware and prevent forensic analysis. Flame has a built-in feature called SUICIDE that can be used to uninstall the malware from infected computers. However, late last week, Flame's creators decided to distribute a different self-removal module to infected computers that connected to servers still under their control."
This discussion has been archived. No new comments can be posted.

Flame Malware Authors Hit Self-Destruct

Comments Filter:
  • by reve_etrange (2377702) on Thursday June 07, 2012 @10:18PM (#40252539)
    The article implies that the new module overwrites with random data instead of just deleting files. I guess the original authors didn't think of that one...government inefficiency in action I suppose.
    • Re: (Score:3, Insightful)

      by Anonymous Coward

      No need to wipe the files if no one knows they're there.

    • by cheater512 (783349) <nick@nickstallman.net> on Thursday June 07, 2012 @10:50PM (#40252751) Homepage

      It overwrites with random data THEN deletes.

      Makes it impossible to tell it was ever installed.
      Otherwise you could scan the disk for remnants to tell if a computer was infected in the past.

      Delete doesn't actually remove any data, just the filename and allocates it as free space.

      • by Billly Gates (198444) on Thursday June 07, 2012 @11:13PM (#40252897) Journal

        The more I learn about Flame the more it amazes me.

        Arstechnica.com has more stories on it and how it worked through collision detection and much more. I am amazed yet worried as I am sure malware mobfia folks are using the source code with real NATO grade malware complete with forging certificates, turning zombies into proxy servers, and using the Md5 collision detection done by professional mathematicians.

        Worse Ubuntu and other operating systems can be hit by this as they use the same algorithms for the certificates. This piece of malware was just done through conventional 0 day exploits but rather a very sophisticated means of forging certificates and might have done the cyberworld much more harm.

      • by Darinbob (1142669)

        Many file systems will allocate new blocks when overwriting data. Not sure what Windows does. There is also the problem of scrubbing old versions of the files whenever updates are recieved.

      • by hairyfeet (841228) <bassbeast1968@ g m a i l.com> on Friday June 08, 2012 @01:43AM (#40253657) Journal

        Which brings up something I've been wondering about...is it even POSSIBLE to overwrite a file if its on an SSD? Sure its easy enough to do on a HDD without having to wipe the whole drive, but since the SSD basically "lies" to the OS about where the data is actually at so it can perform wear leveling is it even possible to overwrite just a few files on an SSD with random data, or would one have to format the whole thing?

        As for TFA just more proof it was written by a government and NOT a criminal, because a criminal would have been more likely just to wipe the whole drive just to be pricks. Lets face it when it comes to malware we have a lot more cases of the writers being pricks than we do of them being nice, so it just makes me think even more these new bugs are just government works for hire.

        • Trashing the whole disk is mindless vandalisim, botnet authours may be pricks but they don't normally vandalise their own bots.
          • by DarkOx (621550) on Friday June 08, 2012 @05:37AM (#40254519) Journal

            Right but the assumption has always been they don't vandalize their own bots because the owners would then discover they are part of a bot net. That does not hold if the bot net owner is already dismantling the network, I don't know what motivation they have to not nuke the hosts entirely to ensure there don't leave any finger prints.

            The only thing I can think of is they may be concerned that if a large percentage of the public has their machines trashed all at the same time Joe Sixpack of Pakistani mangoes might wake up and start taking computer security seriously. Which could make future bot nets harder to construct.

        • by Anonymous Coward on Friday June 08, 2012 @03:22AM (#40254027)

          As someone who works in the ITAD industry SSDs are causing an absolute shit-fit to put it lightly. No, it is not possibly to reliably overwrite any given file on an SSD. The obfuscation layer makes it impossible to do perform a true full overwrite and even harder to verify.

          Sadly even formatting the whole thing is ineffective if you want to be sure that 100% of data is overwritten. SSDs have 10-30% more blocks than they let on, and the drive chooses which ones it's telling you about. If you write one day and wipe another your guess is as good as mine where the data was saved, what the software tried to overwrite, and what any effort to verify is reading. All three could be different.

          • Modern hard drives can do similar things though the probability is lower because they only do it as a fault recovery mechanism rather than as part of normal operation.

            Some drives (both HDD and SSD) have a built in secure erase function but you have to trust the drive manufacturer to have implemented it right.

            Bottom line if you have a modern storage device (whether solid state or spinning rust) and need to be absoloutely sure the data won't fall into enemy hands your only option is to reduce it to dust.

            • by hairyfeet (841228) <bassbeast1968@ g m a i l.com> on Friday June 08, 2012 @10:24AM (#40256789) Journal

              Please don't do that. you'd be surprised how many people out there can't afford a PC at all and how many guys there are like me that donate their time refurbing give aways from businesses so that those poor folks can have a PC. I have yet to see ANYONE recover squat from a spinning rust drive wiped with DoD-3, which is what I use on all donations, so please don't destroy the drives because with the price of HDDs still so high that just means that many more machines can't be refurbed to help the poor. Do a DoD-3 and then use whatever software you wish to try to recover but you won't find anything, then donate it, if you don't know about anyone like me your local churches or Freecycle will be glad to help.

              But so far if things continue as they have been frankly you won't have to give away that SSD, it'll already be dead before you get a chance. The amount of failures [codinghorror.com] from SSDs is just insane, every one of my gamer customers that tried to switch ended going with the hybrids or raptors simply because of how quickly they die.

              But when it comes to HDDs please just do a DoD-3, there are folks out there that would look upon that old P4 or early dual as a real blessing, thanks.

        • Re: (Score:3, Informative)

          by Henk Poley (308046)

          A format is not enough. You have to do a ATA Secure Erase to be really sure. But, a format or full empty space overwrite should make sure somebody will have to disassemble the drive to actually get to the data remnants. Since the visible virtualized drive part will of course remain empty, else the 'contract' of storage would be broken.

        • by DocSavage64109 (799754) on Friday June 08, 2012 @10:02AM (#40256485)
          This older article from slashdot [slashdot.org] points out the opposite problem.

          "They found that SSDs start wiping themselves within minutes after a quick format (or a file delete or full format) and can even do so when disconnected from a PC and rigged up to a hardware blocker."
  • Interesting (Score:5, Interesting)

    by Anonymous Coward on Thursday June 07, 2012 @10:18PM (#40252545)
    Something tells me that this wasn't designed by a teenager.
    • Re: (Score:2, Insightful)

      by bmo (77928)

      The teenage hacker in a basement was never as much of a risk compared to what started happening about 15 years ago with organized crime getting involved.

      This "new" kind of malware has been dubbed (I think more accurately than most) crimeware.

      And whether governments do it, or the RBN, it's still crimeware.

      --
      BMO

      • by Taco Cowboy (5327)

        This "new" kind of malware has been dubbed (I think more accurately than most) crimeware

        I think Mobware is a more accurate description

        "Crime" can be mere petty crime

        But "Mob" is a total different animal altogether

    • Re:Interesting (Score:5, Insightful)

      by flyingsquid (813711) on Thursday June 07, 2012 @11:41PM (#40253045)

      Something tells me that this wasn't designed by a teenager.

      There are a limited number of possible suspects. First off, not many parties have the means to create this. The consensus is that Flame is one of the largest and most advanced pieces of malware ever created- it's 20 megabytes of code- which strongly implies that it was developed by a nation with an advanced cyber-warfare capability. That list is pretty short, and would include countries like the United States, China, Russia, Israel, and North Korea.

      Second, let's look at the targets. The Flame malware hit Iran, Israel/Palestine, Sudan, Syria, Lebanon, Saudi Arabia, and Egypt, in that order. Roughly half of the infections are in Iran. So whoever created Flame is worried about the Middle East, but really, really worried about Iran. More worried about Iran than any other country. The Iran fixation suggests two possible suspects- Israel and the United States.

      The focus on Iran is consistent with Flame coming from the U.S., but Flame also targets several U.S. allies, including Egypt and Saudi Arabia. The other thing is, Flame doesn't target anything outside of the Middle East. If it was produced by the U.S., you'd expect Flame to be found in other countries- North Korea and Pakistan, for example- where the U.S. has security interests. But whoever created Flame doesn't really care what happens in North Korea or Pakistan. Whoever created Flame is primarily concerned with countries that are either enemies or potential enemies of Israel- Iran, Palestine, Syria, Lebanon. That strongly suggests Israel as the culprit.

      • "The Flame malware hit Iran, Israel/Palestine, Sudan, Syria, Lebanon, Saudi Arabia, and Egypt, in that order."

        Why would Israel create malware that hits themselves second? So they can play innocent?

        • Maybe it was unintentional? Stuxnet wasn't supposed to be released, maybe a code change was made and deployed in Israel and it escaped at that point.
          • Re:In that order (Score:4, Insightful)

            by sortadan (786274) on Friday June 08, 2012 @02:52AM (#40253921)
            Why would you think that they wouldn't spy on their own people, especially with their relationship to the Palestinians? If anything, the fact that it's not showing up in the US would tend to prove the point that it was Israel. The US clearly [slashdot.org] isn't afraid to spy on it's own people.
        • Re:In that order (Score:4, Insightful)

          by Bevilr (1258638) on Friday June 08, 2012 @01:33AM (#40253609)
          Have you bothered to read other articles on Flame? It's ability to record and gather information and transmit it back to C&C servers means that it's an excellent tool not just to do large government espionage, but also to listen in on individual conversations. As a tool in a fight against domestic terrorism, and counter espionage. I imagine it would be very effective, it's like a wiretap, without having to ask a judge for a wiretap. Infections in Israel/Palestine aren't broken down by Israel vs Palestine anywhere I've seen, which may mean that the vast majority are in Palestine. If that's true, it is another pretty large piece of evidence in favor of Israeli authorship.
      • Re:Interesting (Score:5, Insightful)

        by viperidaenz (2515578) on Friday June 08, 2012 @12:45AM (#40253371)
        ... because small groups of smart people can't create something complex? It's software, you don't need massive amounts of funding, all you need is a few smart people and some time.
      • Re:Interesting (Score:5, Interesting)

        by DarkOx (621550) on Friday June 08, 2012 @05:47AM (#40254585) Journal

        it's 20 megabytes of code- which strongly implies that it was developed by a nation with an advanced cyber-warfare capability.

        The thing weighing in at 20 megs is not an achievement, rather its an embarrassment showing total lack of craft. Much of the code in this thing is not the malware itself either, its interpreters and support libraries to run it, and much of open source and otherwise stuff that serves other purposes. Its not an efficiently built thing at all.

        The only achievement here if there is one is somebody manged to deliver a payload that large, so often undetected and reliably. I agree it looks state sponsored to me, only government contractors could create a turd this large and still polish it enough that it mostly worked.

        • Re:Interesting (Score:4, Interesting)

          by cryptizard (2629853) on Friday June 08, 2012 @08:04AM (#40255281) Homepage
          Actually quite the opposite. It has been stated by antivirus folks that its large size and structure actually helped it hide for longer. AV software is used to viruses being super-optimized and obfuscated. Flame on the other hand looks like any other desktop application, complete with included runtimes.
  • by Anonymous Coward on Thursday June 07, 2012 @10:20PM (#40252557)

    My mother was wondering why her computer suddenly was working so much better.

    Thanks dudes!

    • by macraig (621737)

      Of course the performance bump had nothing at all to do with you removing all your TrueCrypted porn and finally freeing up more than 1% of the drive....

  • No AutoDestruct (Score:5, Interesting)

    by bengoerz (581218) on Thursday June 07, 2012 @10:29PM (#40252627)
    In hindsite, perhaps the developers should have triggered suicide (at least of all non-critical components) whenever contact with the control servers could not be maintained. As it stands, there's still evidence of Flame sitting on disconnected machines.
    • Re:No AutoDestruct (Score:5, Insightful)

      by nanoflower (1077145) on Thursday June 07, 2012 @10:36PM (#40252669)
      All too true. I'm sure the authors will be taking that into account for their next version. Hopefully everyone will be on the lookout and catch it quicker than they did this one.
    • Re:No AutoDestruct (Score:5, Insightful)

      by Anonymous Coward on Thursday June 07, 2012 @10:37PM (#40252677)

      That doesn't sound like a very effective worm. If they did it that way you could fix the infection with a pf rule.

    • Heh. A virus dead man's switch.

    • Re:No AutoDestruct (Score:5, Interesting)

      by Billly Gates (198444) on Thursday June 07, 2012 @11:17PM (#40252913) Journal

      If this is a real professional job I would not be surprised if it leaves some backdoors opened for another different piece of malware. It wouldn't surprise me if Cisco router rootkits exist. After all evidence points in China they are doing just this, as they did with Nortel routers with a backdoor.

    • Re:No AutoDestruct (Score:5, Interesting)

      by Baloroth (2370816) on Thursday June 07, 2012 @11:21PM (#40252947)

      The implication here, since the creators had to know security researchers already had the virus code, is that there is some module the researchers don't know about (which is actually highly probable, anyways, given the fact they wouldn't have unrestricted access to the targeted computers) and the creators wanted to eliminated the evidence. Most likely, that was the module that fulfilled Flame's main purpose, since researchers still aren't sure exactly what it does, which means now they might never know. It also helps that the targeted computers are (most likely) not infected anymore, so people can't even identify if they were ever hit.

      A secondary implication is that Flame has fulfilled it's purpose. Again, what that is, no one is exactly sure (espionage, certainly, but you don't create something this advanced without some specific target in mind) and wasn't worth maintaining anymore.

      • Alternatively, the fact that it was discovered may mean the current deployment was aborted and there will be (or already is) a new version of Flame to replace the old one.

      • The implication here, since the creators had to know security researchers already had the virus code, is that there is some module the researchers don't know about (which is actually highly probable, anyways, given the fact they wouldn't have unrestricted access to the targeted computers) and the creators wanted to eliminated the evidence. Most likely, that was the module that fulfilled Flame's main purpose, since researchers still aren't sure exactly what it does, which means now they might never know. It also helps that the targeted computers are (most likely) not infected anymore, so people can't even identify if they were ever hit.

        A secondary implication is that Flame has fulfilled it's purpose. Again, what that is, no one is exactly sure (espionage, certainly, but you don't create something this advanced without some specific target in mind) and wasn't worth maintaining anymore.

        It's probably. I think the main reason however is, that a large portion of people who have been infected don't know it yet, and the people in charge prefer to keep it that way.

    • In hindsite, perhaps the developers should have triggered suicide (at least of all non-critical components) whenever contact with the control servers could not be maintained.

      Well, there's always version 2.0 after all. Maybe we'll see that feature, among many others I'm sure, in the next version. Somehow I doubt that we've seen the last of Flame or the people who created it [wikia.com].

    • by Sir_Sri (199544)

      If it's intended to run on not networked control systems (say the ones being used in hardened bunkers to make nuclear weapons components) that wouldn't help you a lot.

      Those computers probably start network connected to get setup, and are then disconnected for work, precisely the time you want your malware to do its thing. They circumvent the hooks into windows update knowing that they'll all have windows updates run on them before the get pulled off.

    • If we accept that this is software used by a state for espionage then networks that aren't routinely connected to the internet in a fashion that allows direct contact with the control servers may be of more interest than ones that are and such automatic removal might not be desired.

      Perhaps a military private network is compromised when someone attaches a compromised laptop to it. Perhaps information is then snuck out or instructions fed in on subsequent occasions that such a laptop is connected, sneaker-n
    • There are also images of Flame components on a lot of the backups of every significant system that was infected. An unrelated malware that simply crashed computers in a way that forced reloads from backups would not be difficult to construct, and could possibly assure that Flame components would again be in active residence on the networks.

      Flame may very well be capable of becoming undead. To assure that this could not happen, it may be necessary to destroy all backups since the days before Flame.

      A relate

  • The bigger question. (Score:5, Interesting)

    by multicoregeneral (2618207) on Thursday June 07, 2012 @10:37PM (#40252679) Homepage
    Sure, all this business with Flame is absolutely fascinating. But even more fascinating: why are European and American software companies doing business with Iran in the first place?
    • by Hamsterdan (815291) on Thursday June 07, 2012 @10:44PM (#40252715)

      I have a hunch money's involved...

    • by TheEyes (1686556) on Thursday June 07, 2012 @10:59PM (#40252825)

      Why do companies outsource their factories to China? Why did AIG and several other companies leverage themselves to several times what they were worth?

      Birds gotta fly. Fish gotta swim. Pointy-haired bosses gotta sacrifice the future for a monetary bonus today.

    • by gman003 (1693318) on Thursday June 07, 2012 @11:04PM (#40252851)

      You know what's more interesting?

      Heckler und Koch GmbH and Rheinmetal AG have licensed factories in Iran. Iranian factories are cranking out G3s, MP5s, MG3s, all legally and for export. Not to mention the various Chinese/Russian small arms they manufacture (couldn't find out whether those were licensed or not).

      I think that, before they ban software companies from doing business in Iran, they should maybe think about banning the firearm companies. Just a thought.

      • A very literate answer. Thank you.

        I'm not criticizing anyone. Just thought it was odd, considering all the blanket sanctions that actually do ban software companies, and anyone else for that matter from working in the country.
      • by kermidge (2221646)

        Nice catch.

        I recall reading some thirty years back that the last parties to lose money in a depression are cosmetics and booze; by examination and extrapolation they seem to do pretty well in good times as well.

        Arms merchants transcend that - there's always people wanting to mess over others, and other people wanting to defend themselves. I expect that given net and scope of profit and the realpolitik of weaponry, it's a no-lose proposition. Guns and bullets have no morals, nor, essentially, do their make

        • Guns and bullets are not a free market, the governments regulate the industry so it is split between a regulated market and a black market. Both of which inflate prices.
      • Nobody ever went broke selling weapons. My cousin went into weapons, now he owns his own moon. Me? I opened a bar in the back end of Space.

        - Quark

        Or something like that.

        Also:

        Rule of Acquisition #34: war is good for business.

        Why does nobody go to war with Switzerland?
        Because Switzerland is the home of the largest banks in the world, and the largest weapons manufacturers in the world. They supply money and arms to everybody. One man's money is as good as another's, be he Western despot or Eastern hero

      • Re: (Score:2, Informative)

        by Anonymous Coward

        Heckler und Koch GmbH and Rheinmetal AG have licensed factories in Iran.

        Not quite correct: there were factories in Iran producing those weapons under license, since the early 1970s. Not H&K factories. The Iranians originally paid a royalty on each item produced.

        Are you also going to be indignant that Bell provided critical assistance in establishing the helicopter repair and production facility at Isfahan in the same period?

    • by AHuxley (892839)
      Iran pays on time and very well. Gold, local currencies... Iran is good like that.
    • by fullback (968784) on Thursday June 07, 2012 @11:36PM (#40253009)

      Because there is no legitimate reason to not do business. The relentless war mongering against fictional bogeymen is fascinating, too.

    • by Sir_Sri (199544) on Thursday June 07, 2012 @11:48PM (#40253093)

      1. Because iran has money.
      2. Because there are 70 million people in Iran, the vast majority of whom are not engaged in trying to kill americans or europeans.
      3. Because lots of people, especially in europe, believe that US sanctions are counter productive, and so don't have such sanctions.

      Also keep in mind there are lots of things that aren't barred from export to Iran, and lots of things are sold legally to other countries and then illegally re-exported to Iran. Most notably to qatar and bahrain, but other places as well.

    • why are European and American software companies doing business with Iran in the first place?

      Why not? How is it significantly different from Russia, or China, or Vietnam, or Saudi Arabia?

      • by Anonymous Coward

        ... or Israel?

  • by tick-tock-atona (1145909) on Thursday June 07, 2012 @10:42PM (#40252699)

    Not only does Flame use a previously unknown MD5 chosen prefix attack [arstechnica.com], but now they are removing all traces of the software from machines under their control.

    Now, since security researchers already have copies of the software this isn't going stop anyone further deconstructing and analysing it. The only possible reason for doing this is to avoid discovery of infection somewhere particularly sensitive. I wonder who the lucky person or nation-state is?

  • by Voyager529 (1363959) <(moc.oohay) (ta) (925regayov)> on Thursday June 07, 2012 @11:00PM (#40252829)

    The people who wrote Flame are the same fine ladies and gentlemen who have brought us CleanMyPC.com. Apparently their accountant is on vacation or something, because removing malware is generally a service that they charge for.

    • Re: (Score:3, Interesting)

      by Billly Gates (198444)

      Dude the more you spam for it the higher the Google page ranking it gets. Out of curiosity I did a google search for malware and cleanPC was 4 out of the 5 links listed. Good god talk about SEO to the extreme

  • Oh oh..... can I name the next one? Let's call it "Red Mercury", and it should be taking out a reactor in 5, 4, 3, 2

  • ... it is way too late to get rid of the evidence. I mean, really? Every malware researcher ever must now have a copy of the code.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      ... it is way too late to get rid of the evidence. I mean, really? Every malware researcher ever must now have a copy of the code.

      The code, sure. But there is still value in hiding what data has been stolen. Destroying the evidence rather than deleting it in a recoverable way means that if a target realises they were infected they will have to assume that everything was taken. That's much worse than knowing exactly what was taken. Consider online store that keeps credit card details for a million users - the difference between knowing that 20 credit card details were leaked and merely knowing that you were infected could well be the d

    • by Arrepiadd (688829)

      Sure, but who says the point was trying to avoid being discovered

      To me it sounds more like a method to avoid being detected where it hadn't been yet. Let's say the biggest bad ass in the neighborhood just got to know about Flame. As others have pointed, unless he backed up his computer, he will never be able to find out if he was infected. For whomever built this, I'd say this is very valuable.

  • by arthurh3535 (447288) on Friday June 08, 2012 @12:28AM (#40253283)

    As in those who were infected that lost important data can no longer know (for a surety) that their important data kept on their computer/server was compromised or not.

    "So our top-sekret 'eyes-only' data may or may not be compromised and they may know everything. But we don't know if they actually know anything about everything. So we can't trust anything that we've stored on a computer in the last year."

    Talk about your security nightmare situation for an Intelligence Agency of some acronym.

  • by RivenAleem (1590553) on Friday June 08, 2012 @03:53AM (#40254149)

    Download rate for MyCleanPC is up in Iran, Israel/Palestine, Sudan, Syria, Lebanon, Saudi Arabia, and Egypt.

If Machiavelli were a hacker, he'd have worked for the CSSG. -- Phil Lapsley

Working...