Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[RedWarrior0]

In which a 20 MB virus gives Iran another reason to keep it's infrastructure entirely separate from the Internet.
http://www.bbc.co.uk/news/technology-18238326
The tl;dr version, a sidebar in the above article:

This is an extremely advanced attack. It is more like a toolkit for compiling different code based weapons than a single tool. It can steal everything from the keys you are pressing to what is on your screen to what is being said near the machine.

It also has some very unusual data stealing features including reaching out to any Bluetooth enabled device nearby to see what it can steal.

Just like Stuxnet, this malware can spread by USB stick, i.e. it doesn't need to be connected to a network, although it has that capability as well.

This wasn't written by some spotty teenager in his/her bedroom. It is large, complicated and dedicated to stealing data whilst remaining hidden for a long time.

Spoiler: Full text (click to show/hide)

Flame: Massive cyber-attack discovered, researchers say
By Dave Lee
Technology reporter, BBC News

The malware is said to have infected over 600 specific targets

A complex targeted cyber-attack that collected private data from countries such as Israel and Iran has been uncovered, researchers have said.

Russian security firm Kaspersky Labs told the BBC they believed the malware, known as Flame, had been operating since August 2010.

The company said it believed the attack was state-sponsored, but could not be sure of its exact origins.

They described Flame as "one of the most complex threats ever discovered".

Research into the attack was carried out in conjunction with the UN's International Telecommunication Union.

They had been investigating another malware threat, known as Wiper, which was reportedly deleting data on machines in western Asia.

In the past, targeted malware - such as Stuxnet - has targeted nuclear infrastructure in Iran.

Others like Duqu have sought to infiltrate networks in order to steal data.

This new threat appears not to cause physical damage, but to collect huge amounts of sensitive information, said Kaspersky's chief malware expert Vitaly Kamluk.

"Once a system is infected, Flame begins a complex set of operations, including sniffing the network traffic, taking screenshots, recording audio conversations, intercepting the keyboard, and so on," he said.

More than 600 specific targets were hit, Mr Kamluk said, ranging from individuals, businesses, academic institutions and government systems.

Iran's National Computer Emergency Response Team posted a security alert stating that it believed Flame was responsible for "recent incidents of mass data loss" in the country.

The malware code itself is 20MB in size - making it some 20 times larger than the Stuxnet virus. The researchers said it could take several years to analyse.

Iran and Israel
Mr Kamluk said the size and sophistication of Flame suggested it was not the work of independent cybercriminals, and more likely to be government-backed. 

He explained: "Currently there are three known classes of players who develop malware and spyware: hacktivists, cybercriminals and nation states.

"Flame is not designed to steal money from bank accounts. It is also different from rather simple hack tools and malware used by the hacktivists. So by excluding cybercriminals and hacktivists, we come to conclusion that it most likely belongs to the third group."

Among the countries affected by the attack are Iran, Israel, Sudan, Syria, Lebanon, Saudi Arabia and Egypt.

"The geography of the targets and also the complexity of the threat leaves no doubt about it being a nation-state that sponsored the research that went into it," Mr Kamluk said.

The malware is capable of recording audio via a microphone, before compressing it and sending it back to the attacker.

It is also able to take screenshots of on-screen activity, automatically detecting when "interesting" programs - such as email or instant messaging - were open.

'Industrial vacuum cleaner'
Kaspersky's first recorded instance of Flame is in August 2010, although it said it is highly likely to have been operating earlier.

Prof Alan Woodward, from the Department of Computing at the University of Surrey said the attack is very significant.

"This is basically an industrial vacuum cleaner for sensitive information," he told the BBC.

He explained that unlike Stuxnet, which was designed with one specific task in mind, Flame was much more sophisticated.

"Whereas Stuxnet just had one purpose in life, Flame is a toolkit, so they can go after just about everything they can get their hands on."

Once the initial Flame malware has infected a machine, additional modules can be added to perform specific tasks - almost in the same manner as adding apps to a smartphone.

[nenjin]

Can't wait until this starts showing up here at home. :|

[MaximumZero]

Wow, wtf? That's one utterly insane virus. I'm partially inclined to think that this is overblown or propaganda, though.

[RedWarrior0]

Apparently, the reason it's not very widespread is that it was very tightly targeted. And the fact that it was probably developed by a country means that it's more likely to be used against a country. The AP article on it said it was likely developed by one of US, China, Israel, or Russa, in no particular order, because nobody else has the kind of capability to do so.

[chaoticag]

And all of a sudden, I can't quite deride the pentagon for sticking with CDs.

[scriver]

Oh Internets y r u so strange and scary. Why can't we just be bbfs.

[RedWarrior0]

Further reading:
Iran claims to have a fix, plus more details on the virus:
http://www.bbc.co.uk/news/technology-18253331
In-Depth look, where it is called sKyWIper (linked to in above article:
http://www.crysys.hu/skywiper/skywiper.pdf

[Il Palazzo]

it was likely developed by one of US, China, Israel, or Russia

After reading this article posted earlier this month by Reuters, I'm inclined to think it's Israel.

[Aklyon]

This is why your keep your important crap in its own network not connected to anything. Not conencted to anything includes bluetooth now, I guess.

And all of a sudden, I can't quite deride the pentagon for sticking with CDs.

THey do have a good point there, but why not DVDs?

[MaximumZero]

This is why your keep your important crap in its own network not connected to anything. Not conencted to anything includes bluetooth now, I guess.

And all of a sudden, I can't quite deride the pentagon for sticking with CDs.

THey do have a good point there, but why not DVDs?

Or Blu-ray?

[Aklyon]

Blu-ray needs its own kind of optical drive. Even the Pentagon should have CD/DVD drives, and with those they could just upgrade their optical media cheaper than buying a crapton of blu-ray drives.

[MaximumZero]

Blu-ray needs its own kind of optical drive. Even the Pentagon should have CD/DVD drives, and with those they could just upgrade their optical media cheaper than buying a crapton of blu-ray drives.

I would question why the US government isn't the most technologically advanced nerve center in the country, but...yeah.

[Aklyon]

I haven't seen the pentagon, but if its anything like my high school was, than they'll keep their stuff until it breaks before getting more recent equipment because new tech is expensive. And the pentagon more than likely has substantially more stuff than a single high school (that loved to proclaim its title of best in the nation every sodding day and then whenever possible) does.

[Knight of Fools]

If I were a malignant hacker pro, I would totally make it connect to wireless mice and make them go crazy.

[Moghjubar]

yes, because I want my car to connect to bluetooth. It will really help me.

Hey, now my old truck has a new feature: no bluetooth!
*resumes cranking the windows up and down*