Flame Created by Government – Backed Hackers to Attack Middle Eastern Countries

Susanne Posel
OccupyCorporatism
May 30, 2012

 

 

 

 

There is a devastating cyber threat targeting the Middle East; stealing “sensitive” information.

Dubbed “Flame” by the researchers at Kaspersky Lab , and have found that this malware “might be the most sophisticated cyber weapon yet unleashed.”

Flame can discover network traffic, record keyboard strokes and audio conversations, and take screenshots; and sort the data on Flame’s very own command-and-control servers.

Not surprisingly, Iran has been the most devastated by Flame, with at least 189 infections. Iran’s National Computer Emergency Response Team posted a security alert stating that it believed Flame was responsible for “recent incidents of mass data loss” in the country.

Israel/Palestine came in second with 98, followed by Sudan (32), Syria (30), Lebanon (18), Saudi Arabia (10), and Egypt (5). Kaspersky themselves do not acknowledge any specific target, yet Flame’s list of victims says what the researchers are unwilling to point out.

Vitaly Kamluk, chief malware expert at Kaspersky Lab, says that Flame was created to collect sensitive data and strongly suggests that this worm could only have come from a government-backed group of hackers.

Kamluk stated: “Currently there are three known classes of players who develop malware and spyware: hacktivists, cybercriminals and nation states. Flame is not designed to steal money from bank accounts. It is also different from rather simple hack tools and malware used by the hacktivists. So by excluding cybercriminals and hacktivists, we come to conclusion that it most likely belongs to the third group.”

Alexander Gostev , from the Kaspersky Lab wrote: “From the initial analysis, it looks like the creators of Flame are simply looking for any kind of intelligence – emails, documents, messages, discussions inside sensitive locations, pretty much everything. We have not seen any specific signs indicating a particular target such as the energy industry – making us believe it’s a complete attack toolkit designed for general cyber-espionage purposes.”

However, Gostev believes Flame could evolve into a more sinister weapon: “Such highly flexible malware can be used to deploy specific attack modules, which can target SCADA devices, ICS, critical infrastructure and so on.”

Flame was uncovered after the UN’s International Telecommunication Union (ITU) requested that Kaspersky search out malware that was deleting digital information in the Middle East.

Gostev recognizes that Flame is “incredibly sophisticated” and “redefines the notion of cyberwar and cyberespionage.”

Sounds like Iran and other Middle Eastern nations are being specifically targeted.

Flame includes a “sophisticated attack toolkit” which makes it extremely difficult to decipher.

Gostev explained that: “The reason why Flame is so big is because it includes many different libraries, such as for compression (zlib, libbz2, ppmd) and database manipulation (sqlite3), together with a LUA virtual machine. Generally, modern malware is small and written in really compact programming languages, which make it easy to hide. The practice of concealment through large amounts of code is one of the specific new features in Flame.”

Flame appears to be the combination of two separate malware already created. Indicators show the creators of Flame “had access to technology used in the Stuxnet project.”

Therefore Flame may be a project that compliments Stuxnet and Duqu.

Stuxnet attacks through Microsoft Windows, targeting Siemens supervisory control and data acquisition (SCADA) systems. This worm was the same type that infiltrated the Iranian nuclear facility infrastructure in 2010.

Duqu, an identical twin to Stuxnet, is believed by security researchers to be designed to steal information from industrial control systems without causing damage.

Google Chairman Eric Schmidt, recently spoke at the London Science Museum where he warned about governments being the most dangerous threat to the internet. “While threats come from individuals and even groups of people, the biggest problem will be activities stemming from nations that seek to do harm. It is very difficult to identify the source of cyber-criminality and stop it,” he said.

And while Flame is extracting sensitive information from Middle Eastern computers, do not forget that these same sovereign nations are being ravaged by terrorist groups backed by the US, the UN and Israel.

You can skip to the end and leave a response. Pinging is currently not allowed.

Leave a Reply

Powered by WordPress | Designed by: Premium WordPress Themes | Thanks to Themes Gallery, Bromoney and Wordpress Themes