Flame Named A Cryptographic Marvel; Infected PCs Commit Suicide
Uber-malware Flame is the most complex tool for cyber espionage discovered in the wild to-date, expert cryptographers have said, the first example of an MD5 collision attack being used in earnest. "Flame uses a yet unknown MD5 chosen-prefix collision attack" renowned experts Marc Stevens and B.M.M. de Weger announced in a security discussion group this week, having been forced to create a custom tool specifically in the hope of digging through the malware's secrets. Meanwhile, Symantec spotted what appeared to be a desperate suicide instruction sent out to a number of compromised computers.
That suicide command is one of Flame's more unique features in the malware world. According to early reports on the tool, those in remote control of it have been cleaning up previously infected systems as they go along, tidying their trail and making it harder for experts to pin-down. In that way, the number of compromised computers is kept reasonably stable.
According to Symantec, the Flame operators used what command and control (C&C) systems they still had access to to distribute a new file called "browse32.ocx" which, when triggered, caused all infected files and folders to be deleted and overwritten. The uninstaller itself is then deleted, leaving no trace of Flame on the PC.
"The design of Flame is partly based on world-class cryptanalysis" Stevens and de Weger said in a statement this week. "Further research will be conducted to reconstruct the entire chosen-prefix collision attack devised for Flame."
That attack involved mimicking Microsoft certification to digitally sign Flame modules, in effect fooling Windows machines into believing them to be legitimate code from the company. In that way, remote operators could add to Flame's core functionality with various add-on packages, depending on the nature of the infected machine.
The complexity of the malware has led to assumptions that Flame was created not by a lone group of hackers but with the backing of a nation-state, equipped with a team of not only software engineers but of top-class cryptography specialists.
[via ArsTechnica]