{"id":3338,"date":"2012-05-28T19:57:10","date_gmt":"2012-05-28T18:57:10","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3338"},"modified":"2015-09-09T19:36:58","modified_gmt":"2015-09-09T11:36:58","slug":"complex-cyberwar-tool-flamer-found-infecting-computers-in-iran-israel","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2012\/05\/complex-cyberwar-tool-flamer-found-infecting-computers-in-iran-israel\/","title":{"rendered":"Complex Cyberwar Tool ‘Flamer’ Found Infecting Computers In Iran & Israel"},"content":{"rendered":"

In December last year, Microsoft released the patch for the vulnerability used by Duqu<\/a> to propogate itself across Windows desktops. The other nasty worm going around was Stuxnet – both cyberwarfare tools, and most recently a piece of malware<\/a> claimed to be more sophisticated than both has been found infecting computers in the middle east.<\/p>\n

And worse still, it’s been around for two years and it’s only being discovered and researched now! It’s pretty covert by the looks of it though and due to the sophistication and complexity it’s most likely a state sanctioned and government built cyber weapon for intelligence gathering.<\/p>\n

A new super-cyberweapon targeting countries like Iran and Israel that has been knocking around in computers for two years has been discovered by researchers.”Flame”, a highly sophisticated piece of malware, was unearthed by the International Telecommunication Union (ITU) and Kaspersky Lab, which said it was more complex and functional than any cyber threat it had seen to date.<\/p>\n

Because Flame is so super-complicated and because of the geography of the attack, Kaspersky Lab’s global research and analysis team head Alexander Gostev said he was in “no doubt” that it was a state-sponsored worm. Flame is a cyber espionage program that steals data such as computer display contents, information about targeted systems, stored files, contact info and even audio conservations. Kaspersky Lab said that the worm’s features were different from Duqu and Stuxnet, but it matched up with them when comparing where it attacked, the software vulnerabilities it uses and the fact that only certain computers were targeted.<\/p>\n

“Stuxnet and Duqu belonged to a single chain of attacks, which raised cyberwar-related concerns worldwide,” Eugene Kaspersky said in a canned statement. “The Flame malware looks to be another phase in this war, and it\u2019s important to understand that such cyber weapons can easily be used against any country. Unlike with conventional warfare, the more developed countries are actually the most vulnerable in this case.”<\/p><\/blockquote>\n

It looks to be well packaged too and may well be polymorphic<\/a> as non of the 43 tested anti-virus packages from the Iranian CERT could detect any malicious components in the malware.<\/p>\n

It’s a pretty big piece of malware weighing in at several MB, and it’s modular with various threat modules built in – for different intel gathering functions would be my guess. I’ll be interested to see what Kaspersky<\/a> posts about it after their deep analysis.<\/p>\n

At that size though, I doubt this beast is written is Assembly<\/a> – the oldskool way.<\/p>\n