Slashdot Mirror
Precision Espionage MiniFlame Malware Tied To Flame
Gunkerty Jeb writes "Initially thought to be merely a module of the now-infamous Flame malware, MiniFlame, or SPE is, in reality, a secondary surveillance tool deployed against specially identified targets following an initial Flame or Gauss compromise. MiniFlame/SPE was one of three previously unseen pieces of malware discovered during a forensic analysis of Flame's command and control servers. Researchers at Kaspersky Lab and CERT-Bund/BSI determined that the program, which has compromised somewhere between 10 and 20 machines, can stand alone as an independent piece of malware or run as a plug-in for both Flame and Gauss."
First flame!
I sure hope that an actual person wrote this MiniFlame. Otherwise the virus has become self-aware and is now reproducing autonomously.
sudo make me a sandwich
It really does sound like the antivirus folks are just so far out of their league...
They were always a step behind... But now it sounds more like a mile.
Why? Simple - the very SECOND their C&C Servers (or other online parts) are known, I block them the heck out (either by IP addresses in my firewall rules tables via a powershell script, albeit when that's available OR the only information, OR by host-domain names in my custom hosts file).
"Easy as apple pie" too, "automagically", every 12 hours!
How? This:
IF you don't want to be tracked, & to get your speed/bandwidth back you paid for (as well as electricity, CPU cycles, RAM, & other forms of I/O as well), better "layered-security"/"defense-in-depth", reliability (vs. DNS poisoning redirection OR being "downed"), & even anonymity (to an extent vs. DNS request logs) + being able to "blow by" what you may feel are unjust blocks (in DNSBL's) & more...
---
APK Hosts File Engine 5.0++ 32-bit & 64-bit:
http://start64.com/index.php?option=com_content&view=article&id=5851:apk-hosts-file-engine-64bit-version&catid=26:64bit-security-software&Itemid=74
---
Custom hosts files gain me the following benefits (A short summary of where custom hosts files can be extremely useful):
---
1.) Blocking out malware/malscripted sites
2.) Blocking out Known sites-servers/hosts-domains that are known to serve up malware
3.) Blocking out Bogus DNS servers malware makers use
4.) Blocking out Botnet C&C servers
5.) Blocking out Bogus adbanners that are full of malicious script content
6.) Getting you back speed/bandwidth you paid for by blocking out adbanners + hardcoding in your favorite sites (faster than remote DNS server resolution)
7.) Added reliability (vs. downed or misdirect/poisoned DNS servers).
8.) Added "anonymity" (to an extent, vs. DNS request logs)
9.) The ability to bypass DNSBL's (DNS block lists you may not agree with).
10.) Blocking out TRACKERS
11.) More screen "real estate" (since no more adbanners appear onscreen eating up CPU, Memory, & other forms of I/O too - bonus!)
12.) Truly UNIVERSAL PROTECTION (since any OS, even on smartphones, usually has a BSD drived IP stack).
13.) Faster & MORE EFFICIENT operation vs. browser plugins (which "layer on" ontop of Ring 3/RPL 3/usermode browsers - whereas the hosts file operates @ the Ring 0/RPL 0/Kernelmode of operation (far faster) as a filter for the IP stack itself...)
14.) Custom hosts files work on ANY & ALL webbound apps (browser plugins do not).
15.) Custom hosts files offer a better, faster, more efficient way, & safer way to surf the web & are COMPLETELY controlled by the end-user of them.
---
* There you go... & above all else IF you choose to try it for the enumerated list of benefits I extolled above?
Enjoy the program!
(However, more importantly, the results in better speed/bandwidth, privacy, reliability, "layered-security"/"defense-in-depth", & even anonymity to an extent (vs. DNS request logs & blowing past DNSBL's) + more, that custom hosts files can yield...)
---
Of course, THIS is NOT going to "go well" with 3 types of people out there online, profiting by advertising & nefarious exploits + more @ YOUR expense as the consumer:
A.) Malware makers & the like (botnet masters, etc./et al)
B.) ADVERTISERS - the TRULY offended ones, as it is their "lifeblood" in psychological attack galore, tracking, & more, etc.!
C.) Possibly webmasters (who profit by ad banners, but fail to realize that those SAME adbanners suck away the users' bandwidth/speed, electricity, CPU cycles, RAM, & other forms of I/O they PAY FOR, plus, adbanners DO get infested with malicious code, & if anyone wants many "examples thereof" from the past near-decade now? Ask!)
---
APK
P.S.=> Lastly - It does a BETTER JOB than AdBlock &/or Ghostery (both of those are OWNED BY ADVERTISERS & are crippled in the forme
The era of governments using malware as part of their standard military/security/intelligence arsenal has arrived.
What political party do you join when you don't like Bible-thumpers *or* hippies?
You haven't accomplished a damn thing, trolls (see subject-line, YOU FAIL, badly)...
* As-per-my-usual? I challenge ANYONE to disprove the points I stated in my post you bogusly downmodded...
(Knowing FULL WELL that whoever downmodded my post won't be able to MEET THAT CHALLENGE... lol!)
APK
P.S.=> Thus, well... you just KNOW I've just GOTTA SAY IT, as-is-per-my-inimitable style:
This? THIS was just "too, Too, TOO EASY - just '2ez'" - since whoever "computing technically" speaking can't justify their downmod of my post I just replied to on valid grounds by disproving my points...
Face it - YOU know it, I know it, & anyone else reading with 1/2 a brain, knows it also...
... apk
Is there likely to be a lot more of this type of thing out there that just hasn't been discovered? I was thinking...damn, it's gotta be embarrassing for those secretive TLAs for their activities to be made so public, but then, what is the likelihood that those secretive TLAs have a lot more stuff out there that simply hasn't been made public?
Plus an illogical off-topic weak failing ad hominem attack on myself, rather than disproving my points here -> http://yro.slashdot.org/comments.pl?sid=3186429&cid=41658979 is "the best you've got", little ac troll?
* Please... make me laugh some more!
(Like I said: Not a SINGLE ONE OF YOU CAN DISPROVE MY POINTS in the link above, & you ALWAYS RUN from this challenge put to you also -> http://yro.slashdot.org/comments.pl?sid=3186429&cid=41659277 )
APK
P.S.=> Face facts, troll - YOU FAIL, miserably... and you know it!/quote... apk
Fully dyslexia or ADHD addled brains, like yours? Disprove my points here instead troll -> http://yro.slashdot.org/comments.pl?sid=3186429&cid=41658979 because your off-topic illogical ad hominem attacks only show anyone reading that you are indeed, lol, "pulling a forrest gump" (& running)...
* You FAIL, troll... & you're apparently out of modpoints to bogusly + unjustifiably downmod my post (instead of disproving its points).
APK
P.S.=> Of course, IF you could manage to disprove my points in that link above, then I couldn't SAY you are failing, but alas? LMAO, you are - badly!/quote... apk
Malware like this is unique in warfare in that the payload can be recovered intact, reverse engineered, and deployed for other motives quite easily, and (from my admittedly limited understanding) requires only off-the-shelf technological overhead. I've read several articles here recently about critical infrastructure related SCADA equipment needing per-site patches due to backdoors and poor default security settings. Presuming the proliferators of this malware based espionage are intelligent and can predict the following chain of events, they must have deemed this to be an acceptable risk, or even want it to happen...
I wonder what the legal liabilities for the originating state(s) are when a modified version impact their own citizens and infrastructure? It worries me that nations are running headlong into this type of undeclared war. Bioweapons are limited in their usefulness in warfare for this very reason - their propensity to harm non-combatants on both sides. With our dependance on IT and networks in all areas including the provisions of the necessities of life, when this escalates, it won't be pretty.
The program runs itself every 12 hours "automagically" IF I wish & gets its data for custom hosts files from 12 reputable & reliable sites for that. I'll get it then without lifting a finger!
* However/OR, I can just do a "manual run" right then too...
(I also get a LOT of botnet C&C Server information from articles during my evenings as well, & sometimes, my sources don't even get them THAT fast, so I do manual runs in the evenings after dinner usually!)
APK
P.S.=> So far, since 1997 when I started doing custom hosts files? I have myself covered vs. LITERALLY 1,848,485++ known bad sites/servers/hosts-domains that serve up malicious content/exploits/malware etc.-et al!
Now, that's pretty good considering it's a solution in custom hosts files that's TIGHTLY INTEGRATED into the OS since it's really only using a part of the IP stack, as a filter for it!
(The IP stack's written in C + assembly afaik, fastest there is, AND, it runs in Ring 0/RPL 0/kernelmode too, not usermode/Ring 3/RPL 3 AND layering ontop of browsers ONLY (not external to browser email programs like Outlook/Outlook Express or Eudora for example)... SLOW!'
Solutions like AdBlock, by way of comparison AGAIN in terms of "SLOW"?
AdBlock's also written in SLOWER interpreted languages like javascript, python, & perl too - not as fast, OR efficient as the IP stack yet again which again, was written in FAR FASTER C & Assembly language... period!
All that, is where custom hosts files rock (and more), vs. "solutions" that are OWNED BY ADVERTISERS (& intentionally weakened by default in AdBlock + Ghostery in tracking)...
... apk
Nothing to see here ...
Is it? I run it manually when & IF needed (by simply visiting the sites as they update, sometimes every 20 minutes or so, other times once a day, sometimes once a week or once a month), & then I scour articles on security too, mainly for botnet C&C servers that aren't mentioned/listed/noted in my normal 12 sources...
* Pretty simple - but, @ the VERY LEAST, I am covered "automagically" every 12 hours for them all...
APK
P.S.=> I can certainly say 1 thing - I know that my being covered vs. nearly 2 million (& growing) KNOWN bad sites/servers/hosts-domains that are bogus DNS servers, botnet C&C servers, fastflux hosts, or just plain malware or malscripted housing sites... and, VERY CURRENTLY found as so here, & inserted into my custom hosts file!
(For security, it's a great extra-layer of protection, but the speed gains are even MORE astounding & noticeable!)
QUESTION: Are you? I am SURE I am...
... apk
Nobody Seems To Notice and Nobody Seems To Care - Government & Stealth Malware
In Response To Slashdot Article: Former Pentagon Analyst: China Has Backdoors To 80% of Telecoms 87
How many rootkits does the US[2] use officially or unofficially?
How much of the free but proprietary software in the US spies on you?
Which software would that be?
Visit any of the top freeware sites in the US, count the number of thousands or millions of downloads of free but proprietary software, much of it works, again on a proprietary Operating System, with files stored or in transit.
How many free but proprietary programs have you downloaded and scanned entire hard drives, flash drives, and other media? Do you realize you are giving these types of proprietary programs complete access to all of your computer's files on the basis of faith alone?
If you are an atheist, the comparison is that you believe in code you cannot see to detect and contain malware on the basis of faith! So you do believe in something invisible to you, don't you?
I'm now going to touch on a subject most anti-malware, commercial or free, developers will DELETE on most of their forums or mailing lists:
APT malware infecting and remaining in BIOS, on PCI and AGP devices, in firmware, your router (many routers are forced to place backdoors in their firmware for their government) your NIC, and many other devices.
Where are the commercial or free anti-malware organizations and individual's products which hash and compare in the cloud and scan for malware for these vectors? If you post on mailing lists or forums of most anti-malware organizations about this threat, one of the following actions will apply: your post will be deleted and/or moved to a hard to find or 'deleted/junk posts' forum section, someone or a team of individuals will mock you in various forms 'tin foil hat', 'conspiracy nut', and my favorite, 'where is the proof of these infections?' One only needs to search Google for these threats and they will open your malware world view to a much larger arena of malware on devices not scanned/supported by the scanners from these freeware sites. This point assumed you're using the proprietary Microsoft Windows OS. Now, let's move on to Linux.
The rootkit scanners for Linux are few and poor. If you're lucky, you'll know how to use chkrootkit (but you can use strings and other tools for analysis) and show the strings of binaries on your installation, but the results are dependent on your capability of deciphering the output and performing further analysis with various tools or in an environment such as Remnux Linux. None of these free scanners scan the earlier mentioned areas of your PC, either! Nor do they detect many of the hundreds of trojans and rootkits easily available on popular websites and the dark/deep web.
Compromised defenders of Linux will look down their nose at you (unless they are into reverse engineering malware/bad binaries, Google for this and Linux and begin a valuable education!) and respond with a similar tone, if they don't call you a noob or point to verifying/downloading packages in a signed repo/original/secure source or checking hashes, they will jump to conspiracy type labels, ignore you, lock and/or shuffle the thread, or otherwise lead you astray from learning how to examine bad binaries. The world of Linux is funny in this way, and I've been a part of it for many years. The majority of Linux users, like the Windows users, will go out of their way to lead you and say anything other than pointing you to information readily available on detailed binary file analysis.
Don't let them get you down, the information is plenty and out there, some from some well known publishers of Linux/Unix books. Search, learn, and share the information on detecting and picking through bad binaries. But this still will not touch the void of the APT malware described above which will survive any wipe of r/w media. I'm convinced, on both *nix and Windows, these pieces of APT malware