May 29, 2012

THEY THREATEN, THEIR ENEMIES ATTACK:

Meet 'Flame', The Massive Spy Malware Infiltrating Iranian Computers (Kim Zetter, May 28, 2012, Wired)

A massive, highly sophisticated piece of malware has been newly found infecting systems in Iran and elsewhere and is believed to be part of a well-coordinated, ongoing, state-run cyberespionage operation.

The malware, discovered by Russia-based anti-virus firm Kaspersky Lab, is an espionage toolkit that has been infecting targeted systems in Iran, Lebanon, Syria, Sudan, the Israeli Occupied Territories and other countries in the Middle East and North Africa for at least two years.

Dubbed "Flame" by Kaspersky, the malicious code dwarfs Stuxnet in size - the groundbreaking infrastructure-sabotaging malware that is believed to have wreaked havoc on Iran's nuclear program in 2009 and 2010. Although Flame has both a different purpose and composition than Stuxnet, and appears to have been written by different programmers, its complexity, the geographic scope of its infections and its behavior indicate strongly that a nation-state is behind Flame, rather than common cyber-criminals -- marking it as yet another tool in the growing arsenal of cyberweaponry. [...]

Early analysis of Flame by the Lab indicates that it's designed primarily to spy on the users of infected computers and steal data from them, including documents, recorded conversations and keystrokes. It also opens a backdoor to infected systems to allow the attackers to tweak the toolkit and add new functionality.

The malware, which is 20 megabytes when all of its modules are installed, contains multiple libraries, SQLite3 databases, various levels of encryption -- some strong, some weak -- and 20 plug-ins that can be swapped in and out to provide various functionality for the attackers. It even contains some code that is written in the LUA programming language -- an uncommon choice for malware.

Kaspersky Lab is calling it "one of the most complex threats ever discovered."

"It's pretty fantastic and incredible in complexity," said Alexander Gostev, chief security expert at Kaspersky Lab.



Enhanced by Zemanta

Posted by at May 29, 2012 5:33 AM
  

blog comments powered by Disqus
« | Main | AN EMBARRASSMENT OF RICHES, BUT ONLY ONE FITS THAT BILL: »