Slashdot Mirror
Flame Malware Authors Hit Self-Destruct
angry tapir writes "The creators of the Flame cyber-espionage threat ordered infected computers still under their control to download and execute a component designed to remove all traces of the malware and prevent forensic analysis. Flame has a built-in feature called SUICIDE that can be used to uninstall the malware from infected computers. However, late last week, Flame's creators decided to distribute a different self-removal module to infected computers that connected to servers still under their control."
Something tells me that this wasn't designed by a teenager.
In hindsite, perhaps the developers should have triggered suicide (at least of all non-critical components) whenever contact with the control servers could not be maintained. As it stands, there's still evidence of Flame sitting on disconnected machines.
Sure, all this business with Flame is absolutely fascinating. But even more fascinating: why are European and American software companies doing business with Iran in the first place?
This signature intentionally left blank.
Dude the more you spam for it the higher the Google page ranking it gets. Out of curiosity I did a google search for malware and cleanPC was 4 out of the 5 links listed. Good god talk about SEO to the extreme
http://saveie6.com/
Does it close the doors on the way out and patch the various exploits it used to get in to the system in the first place, or does it just leave the system ripe for future re-exploitation by the same or similar tools?
In other news, over in Oz - the man who was behind the curtain is not only unimportant, but not there now, so please stop looking.
Returned Peace Corps IT Volunteer
Journals are only so deep and, more importantly, only contain file metadata. You might, sometimes, be able to use them to determine that a file used to exist on a computer, but not what its contents were.
The more I learn about Flame the more it amazes me.
The more I learn about the whole cyberwar program the more I am impressed.
The Admin and the Engineer
As in those who were infected that lost important data can no longer know (for a surety) that their important data kept on their computer/server was compromised or not.
"So our top-sekret 'eyes-only' data may or may not be compromised and they may know everything. But we don't know if they actually know anything about everything. So we can't trust anything that we've stored on a computer in the last year."
Talk about your security nightmare situation for an Intelligence Agency of some acronym.
No! It's a *SIG*. Keep the Special Interest Groups away! (Con joke!)
Which brings up something I've been wondering about...is it even POSSIBLE to overwrite a file if its on an SSD? Sure its easy enough to do on a HDD without having to wipe the whole drive, but since the SSD basically "lies" to the OS about where the data is actually at so it can perform wear leveling is it even possible to overwrite just a few files on an SSD with random data, or would one have to format the whole thing?
As for TFA just more proof it was written by a government and NOT a criminal, because a criminal would have been more likely just to wipe the whole drive just to be pricks. Lets face it when it comes to malware we have a lot more cases of the writers being pricks than we do of them being nice, so it just makes me think even more these new bugs are just government works for hire.
ACs don't waste your time replying, your posts are never seen by me.
Except when stuff like this comes out: http://freecode.com/articles/ubuntu-new-apt-packages-fix-security-vulnerabilities-3
No one should dismiss the likelihood of rogus developers submitting changes to key components of popular distros like Ubuntu to exploit. Combined with a MITM attack, your Ubuntu system is owned. This is one reason I no longer use Ubuntu. This news also appeared on Slashdot, but it's mysteriously disappeared since then (this is where I originally heard about it).
But, a format or full empty space overwrite should make sure somebody will have to disassemble the drive to actually get to the data remnants
That is almost certainly false. The vendor almost certainly has commands to let them retrieve the full data from the drive over the bus.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
This older article from slashdot points out the opposite problem.
"They found that SSDs start wiping themselves within minutes after a quick format (or a file delete or full format) and can even do so when disconnected from a PC and rigged up to a hardware blocker."
Please don't do that. you'd be surprised how many people out there can't afford a PC at all and how many guys there are like me that donate their time refurbing give aways from businesses so that those poor folks can have a PC. I have yet to see ANYONE recover squat from a spinning rust drive wiped with DoD-3, which is what I use on all donations, so please don't destroy the drives because with the price of HDDs still so high that just means that many more machines can't be refurbed to help the poor. Do a DoD-3 and then use whatever software you wish to try to recover but you won't find anything, then donate it, if you don't know about anyone like me your local churches or Freecycle will be glad to help.
But so far if things continue as they have been frankly you won't have to give away that SSD, it'll already be dead before you get a chance. The amount of failures from SSDs is just insane, every one of my gamer customers that tried to switch ended going with the hybrids or raptors simply because of how quickly they die.
But when it comes to HDDs please just do a DoD-3, there are folks out there that would look upon that old P4 or early dual as a real blessing, thanks.
ACs don't waste your time replying, your posts are never seen by me.