The blogosphere and the nontech media are all abuzz about Flame, the newly exposed malware that is apparently wreaking havoc with Iranian computers. Its also creating problems elsewhere in the Middle East, but apparently hasnt spread significantly beyond there.
But is Flame really a new threat, or is it simply a newly discovered threat? Or maybe its been around for a while and only seems new to people who havent been paying attention.
What is known about Flame (or Flamer or Skywiper) is that its come to the attention of the International Telecommunications Unions cyber-security people. The ITUs people put out a report saying its a dangerous piece of malware. Whats also known is that Flame apparently doesnt really do any damage to the systems it infects, but rather collects information and sends it to a series of servers around the world and that those servers send it along to somewhere else.
We also know one other thing: cyber-security experts dont agree on whether its a threat, whether it is still operating or whether the whole thing is overblown. Kaspersky Lab, which has close ties to the ITU, is calling Flame the most sophisticated cyber-weapon yet released.
Kaspersky Lab has described Flame is a backdoor Trojan with worm-like features that allow it to propagate on local networks and removable media. It is reportedly capable of taking screenshots, recording audio conversations and intercepting network traffic. On the other hand, security expert Jeffrey Carr thinks the whole thing is overblown. Carr is CEO of cyber-security firm Taia Global.
Carr, in fact, suggests that the most likely source for malware such as Flame is a group of mercenary hacker crews who make a business of stealing anything they can and reselling it to the highest bidder. But is Carr right? Is Kaspersky right? We really dont know if anyone is right, but I suspect theyre all wrong, at least at some level.
One thing we do know is that Flame is sophisticated. It can morph into many forms, rendering many signature-based antivirus packages less effective than they might be. We also know that Flame is extremely complexits apparently written in C++, has a number of modules, propagates through a variety of media and can perform a variety of functions. In other words, its the perfect spyware.
There are also suggestions that Flame has actually been around for more than five years, which if true, means that its been operating without many people knowing it even existsfor a very long time in malware terms. Its also not very widespread. The country with the most infections reported is Iran, and even there, the number of infections noted in Carrs article is fewer than 200. Thats not exactly a global nightmareat least not yet.