Complex Cyberwar Tool ‘Flamer’ Found Infecting Computers In Iran & Israel

Use Netsparker


In December last year, Microsoft released the patch for the vulnerability used by Duqu to propogate itself across Windows desktops. The other nasty worm going around was Stuxnet – both cyberwarfare tools, and most recently a piece of malware claimed to be more sophisticated than both has been found infecting computers in the middle east.

And worse still, it’s been around for two years and it’s only being discovered and researched now! It’s pretty covert by the looks of it though and due to the sophistication and complexity it’s most likely a state sanctioned and government built cyber weapon for intelligence gathering.

A new super-cyberweapon targeting countries like Iran and Israel that has been knocking around in computers for two years has been discovered by researchers.”Flame”, a highly sophisticated piece of malware, was unearthed by the International Telecommunication Union (ITU) and Kaspersky Lab, which said it was more complex and functional than any cyber threat it had seen to date.

Because Flame is so super-complicated and because of the geography of the attack, Kaspersky Lab’s global research and analysis team head Alexander Gostev said he was in “no doubt” that it was a state-sponsored worm. Flame is a cyber espionage program that steals data such as computer display contents, information about targeted systems, stored files, contact info and even audio conservations. Kaspersky Lab said that the worm’s features were different from Duqu and Stuxnet, but it matched up with them when comparing where it attacked, the software vulnerabilities it uses and the fact that only certain computers were targeted.

“Stuxnet and Duqu belonged to a single chain of attacks, which raised cyberwar-related concerns worldwide,” Eugene Kaspersky said in a canned statement. “The Flame malware looks to be another phase in this war, and it’s important to understand that such cyber weapons can easily be used against any country. Unlike with conventional warfare, the more developed countries are actually the most vulnerable in this case.”

It looks to be well packaged too and may well be polymorphic as non of the 43 tested anti-virus packages from the Iranian CERT could detect any malicious components in the malware.

It’s a pretty big piece of malware weighing in at several MB, and it’s modular with various threat modules built in – for different intel gathering functions would be my guess. I’ll be interested to see what Kaspersky posts about it after their deep analysis.

At that size though, I doubt this beast is written is Assembly – the oldskool way.


Iran’s National Computer Emergency Response Team posted a warning about the malware on its site today and said a fix would be coming soon.

“At the time of writing, none of the 43 tested anti viruses could detect any of the malicious components. Nevertheless, a detector was created by Maher centre and delivered to selected organisations and companies in first days of May,” the site said.

“And now a removal tool is ready to be delivered.

“The research on samples implies that the recent incidents of mass data loss in Iran could be the outcome of some installed module of this threat,” it added.

Kaspersky Lab said it was currently doing deeper analysis of Flame, which has been in the wild since March 2010, and it would tell everyone what it learned on its blog posts.

“For now what is known is that it consists of multiple modules and is made up of several megabytes of executable code in total – making it around 20 times larger than Stuxnet, meaning that analysing this cyber weapon requires a large team of top-tier security experts and reverse engineers with vast experience in the cyber defence field,” the security firm said.

Gostev said that the malware was still stealing data.

You can see the post from the Iranian CERT here:

Identification of a New Targeted Cyber-Attack

It also leasts some of the ‘features’ of the malware (spreads via removable media & LAN, records environmental sounds using the mic, scans for certain file extensions & runs a network sniffer to grab passwords in plain text). Pretty scary stuff, especially as the Flamer malware uploads everything it finds to a centralized command & control server (using 10 different domains over SSH + HTTPS).

Source: The Register

Posted in: Exploits/Vulnerabilities, Malware, Networking Hacking

, , ,


Latest Posts:


dcipher - Online Hash Cracking Using Rainbow & Lookup Tables dcipher – Online Hash Cracking Using Rainbow & Lookup Tables
dcipher is a JavaScript-based online hash cracking tool to decipher hashes using online rainbow & lookup table attack services.
HTTP Security Considerations - An Introduction To HTTP Basics HTTP Security Considerations – An Introduction To HTTP Basics
HTTP is ubiquitous now with pretty much everything being powered by an API, a web application or some kind of cloud-based HTTP driven infrastructure. With that HTTP Security becomes paramount and to secure HTTP you have to understand it.
Cangibrina - Admin Dashboard Finder Tool Cangibrina – Admin Dashboard Finder Tool
Cangibrina is a Python-based multi platform admin dashboard finder tool which aims to obtain the location of website dashboards by using brute-force, wordlists etc.
Enumall - Subdomain Discovery Using Recon-ng & AltDNS Enumall – Subdomain Discovery Using Recon-ng & AltDNS
Enumall is a Python-based tool that helps you do subdomain discovery using only one command by combining the abilities of Recon-ng and AltDNS.
RidRelay - SMB Relay Attack For Username Enumeration RidRelay – SMB Relay Attack For Username Enumeration
RidRelay is a Python-based tool to enumerate usernames on a domain where you have no credentials by using a SMB Relay Attack with low privileges.
NetBScanner - NetBIOS Network Scanner NetBScanner – NetBIOS Network Scanner
NetBScanner is a NetBIOS network scanner tool that scans all computers in the IP addresses range you choose, using the NetBIOS protocol.


Comments are closed.