Slashdot Mirror
Flame Malware Authors Hit Self-Destruct
angry tapir writes "The creators of the Flame cyber-espionage threat ordered infected computers still under their control to download and execute a component designed to remove all traces of the malware and prevent forensic analysis. Flame has a built-in feature called SUICIDE that can be used to uninstall the malware from infected computers. However, late last week, Flame's creators decided to distribute a different self-removal module to infected computers that connected to servers still under their control."
The article implies that the new module overwrites with random data instead of just deleting files. I guess the original authors didn't think of that one...government inefficiency in action I suppose.
.: Semper Absurda
Something tells me that this wasn't designed by a teenager.
My mother was wondering why her computer suddenly was working so much better.
Thanks dudes!
Er no, this is infected machines being remotely instructed to clean themselves up by the person controlling the "virus". It has nothing to do with you doing anything to your machine. They sent the virus an instruction, and the virus is removing all traces of itself from a machine.
Seven puppies were harmed during the making of this post.
In hindsite, perhaps the developers should have triggered suicide (at least of all non-critical components) whenever contact with the control servers could not be maintained. As it stands, there's still evidence of Flame sitting on disconnected machines.
Sure, all this business with Flame is absolutely fascinating. But even more fascinating: why are European and American software companies doing business with Iran in the first place?
This signature intentionally left blank.
Not only does Flame use a previously unknown MD5 chosen prefix attack, but now they are removing all traces of the software from machines under their control.
Now, since security researchers already have copies of the software this isn't going stop anyone further deconstructing and analysing it. The only possible reason for doing this is to avoid discovery of infection somewhere particularly sensitive. I wonder who the lucky person or nation-state is?
The only possible reason for doing this is to avoid discovery of infection somewhere particularly sensitive.
Or, to make everyone else stop looking.
You know all of the installations received the same self-destruct command how again?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
The people who wrote Flame are the same fine ladies and gentlemen who have brought us CleanMyPC.com. Apparently their accountant is on vacation or something, because removing malware is generally a service that they charge for.
maybe it self destructs when it can't find a LAN connection?
Works for Diablo 3...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Does it close the doors on the way out and patch the various exploits it used to get in to the system in the first place, or does it just leave the system ripe for future re-exploitation by the same or similar tools?
In other news, over in Oz - the man who was behind the curtain is not only unimportant, but not there now, so please stop looking.
Returned Peace Corps IT Volunteer
... it is way too late to get rid of the evidence. I mean, really? Every malware researcher ever must now have a copy of the code.
As in those who were infected that lost important data can no longer know (for a surety) that their important data kept on their computer/server was compromised or not.
"So our top-sekret 'eyes-only' data may or may not be compromised and they may know everything. But we don't know if they actually know anything about everything. So we can't trust anything that we've stored on a computer in the last year."
Talk about your security nightmare situation for an Intelligence Agency of some acronym.
No! It's a *SIG*. Keep the Special Interest Groups away! (Con joke!)
Which is why it's sound engineering for a computer to have a bios loader burned into a rom chip that can reflash the bios.
Have you bothered to read other articles on Flame? It's ability to record and gather information and transmit it back to C&C servers means that it's an excellent tool not just to do large government espionage, but also to listen in on individual conversations. As a tool in a fight against domestic terrorism, and counter espionage. I imagine it would be very effective, it's like a wiretap, without having to ask a judge for a wiretap. Infections in Israel/Palestine aren't broken down by Israel vs Palestine anywhere I've seen, which may mean that the vast majority are in Palestine. If that's true, it is another pretty large piece of evidence in favor of Israeli authorship.
Why would you think that they wouldn't spy on their own people, especially with their relationship to the Palestinians? If anything, the fact that it's not showing up in the US would tend to prove the point that it was Israel. The US clearly isn't afraid to spy on it's own people.
By the same reasoning it could have been made by Iran..
Download rate for MyCleanPC is up in Iran, Israel/Palestine, Sudan, Syria, Lebanon, Saudi Arabia, and Egypt.
It's an illegal activity, whether done by governments or by the mob.
So if the government murders (we call it war) or kidnaps (we call it arrest), is it also illegal? I understand and sympathize with a lot of the "fuck da man" libertarianism around here, but nobody's ever seriously argued that the government shouldn't have more power to affect a person than the average person. The trade-off is all the accountability they're supposed to have. We don't let your neighbor tie you up and lock you in his house, but we let the police - if they can justify it.
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
This older article from slashdot points out the opposite problem.
"They found that SSDs start wiping themselves within minutes after a quick format (or a file delete or full format) and can even do so when disconnected from a PC and rigged up to a hardware blocker."
Despite being smart and thoughtful enough to put in a method to cover their tracks after discovery, they took way, WAY to long to pull the trigger and too much forensic data has already been determined. That's a failure of bureacracy. A more nimble organization would have flushed the damn thing before it could be slashdotted.