Flame Malware Origins Remain Murky, but Its Sophistication Is Clear

By Wayne Rash  |  Posted 2012-05-30

Flame Malware Origins Remain Murky, but Its Sophistication Is Clear

The blogosphere and the nontech media are all abuzz about Flame, the newly exposed malware that is apparently wreaking havoc with Iranian computers. It€™s also creating problems elsewhere in the Middle East, but apparently hasn€™t spread significantly beyond there.

But is Flame really a new threat, or is it simply a newly discovered threat? Or maybe it€™s been around for a while and only seems new to people who haven€™t been paying attention.

What is known about Flame (or Flamer or Skywiper) is that it€™s come to the attention of the International Telecommunications Union€™s cyber-security people. The ITU€™s people put out a report saying it€™s a dangerous piece of malware. What€™s also known is that Flame apparently doesn€™t really do any damage to the systems it infects, but rather collects information and sends it to a series of servers around the world and that those servers send it along to somewhere else.

We also know one other thing: cyber-security experts don€™t agree on whether it€™s a threat, whether it is still operating or whether the whole thing is overblown. Kaspersky Lab, which has close ties to the ITU, is calling Flame the most sophisticated cyber-weapon yet released.

Kaspersky Lab has described Flame is a backdoor Trojan with worm-like features that allow it to propagate on local networks and removable media. It is reportedly capable of taking screenshots, recording audio conversations and intercepting network traffic. On the other hand, security expert Jeffrey Carr thinks the whole thing is overblown. Carr is CEO of cyber-security firm Taia Global.

Carr, in fact, suggests that the most likely source for malware such as Flame is a group of mercenary hacker crews who make a business of stealing anything they can and reselling it to the highest bidder. But is Carr right? Is Kaspersky right? We really don€™t know if anyone is right, but I suspect they€™re all wrong, at least at some level.

One thing we do know is that Flame is sophisticated. It can morph into many forms, rendering many signature-based antivirus packages less effective than they might be. We also know that Flame is extremely complex€”it€™s apparently written in C++, has a number of modules, propagates through a variety of media and can perform a variety of functions. In other words, it€™s the perfect spyware.

There are also suggestions that Flame has actually been around for more than five years, which if true, means that it€™s been operating without many people knowing it even exists€”for a very long time in malware terms. It€™s also not very widespread. The country with the most infections reported is Iran, and even there, the number of infections noted in Carr€™s article is fewer than 200. That€™s not exactly a global nightmare€”at least not yet.

Flame Looks Well-Suited for State-Sponsored Espionage

Working with the assumption that Flame is really intended for cyber-espionage, which is what appears to be the case, then how worried should we be? The answer is, not very worried. Flame does not appear to have spread beyond the Middle East, and it doesn€™t do any actual damage. The infection is easily found if you know what to look for, and Iranian authorities reported that they have created a tool for removing it in the few days since they found out about it.

The reality of Flame is that unless you€™re in one of the affected countries, this isn€™t much of a threat and certainly doesn€™t deserve all the hype surrounding it. However, it does show that someone, somewhere, has developed an effective cyber-espionage system and that they have the infrastructure to use it. In other words, worrying specifically about Flame is counter-productive. You should worry about what whoever created Flame is doing now totally undetected.

And, of course, that brings us back to the question of Flame€™s origin. If Flame was created, as many have suggested, by a national cyber-espionage team of some sort, then the people who should worry are the people on that nation€™s list of enemies. Since the target appears to be Iran in this case, then Iran needs to worry about being attacked by some country that doesn€™t like them, which is basically everybody.

But that also means that only places that have some commerce with Iran also need to worry about being infected; this might explain why only Middle Eastern countries seem to have been affected. However, that does bring up the question of why so many computers in Israel were affected, unless Israel is somehow connecting with Iran€™s computers in some way.

But suppose the origin of Flame is really some sort of criminal syndicate? Despite Carr€™s suggestions, I€™m not sure that makes sense. Unless the hypothetical criminal syndicate thought Iran might have information worth stealing (nuclear secrets?) and had a ready buyer (the United States?), it€™s hard to see why they€™d bother. But it€™s easy to see why other countries would bother.

After all, the United Nations has been trying to penetrate Iran€™s nuclear secrets for years. Just because the ITU is an agency that€™s part of the UN doesn€™t mean that body wasn€™t involved. But so could any number of other governmental entities, including the United States. Could the United States possibly be sponsoring a cyber-espionage effort aimed at Iran? I don€™t know, but if I were the Director of National Intelligence, I€™d do it in a heartbeat.

Rocket Fuel