I'd love to know more about the command and control servers. If any of them involve paid hosting that might help to out the guilty party.
I would love to see the binary, even if it means waiting until vulnerabilities are patched.
Flame: Massive cyber-attack discovered, researchers say
71–80 of 84 posts
Re: Flame: Massive cyber-attack discovered, researchers say
#72More technical details (pdf) on: http://www.crysys.hu/skywiper/skywiper.pdf Although the naming differs it has been noted on several blogs that it is the same malware.
I always hesitate a little bit when I open a pdf, specially when it is one on malware
Use chrome! It's probably more secure than downloading the PDF and opening it with Adobe software.
Re: Flame: Massive cyber-attack discovered, researchers say
#73Earlier quoted context omitted.
I don't get the point of your comment. Are you saying you doubt it's 20MB? Or that it doesn't include a lot of libraries? What point are you trying to make exactly?
He's pointing out that the explanation for the size given in the article isn't adequate because the facts don't bear it out.
Exactly. I particularly wanted to mention that it's entirely possible to ship software that uses libraries like this but isn't 20MB large. But maybe there are a lot more libraries included than are mentioned here (as another poster suggested).
Re: Flame: Massive cyber-attack discovered, researchers say
#74Earlier quoted context omitted.
From the Kaspersky article, Flame ships with a Lua VM, sqlite3, zlib, libbz2, and an SSL library (probably OpenSSL?), and these and more apparently result in its unusually large size (almost 20 MB). Sounds almost like "lean malware" written by a relatively small team using easily available tools and libraries.
FLAME isn't a virus, it is software from Brazil, just like LUA is from Brazil. "Tool prototyping in the FLAME platform is based on the Lua scripting language. Lua is adopted in FLAME as an extension language: its interpreter is embedded as a library into the measurement agents. On the one hand, the Lua interpreter gives to the scripts running in the agents access to active measurement primitives through a high-level,…
Thank you for doing ten-minutes of research. Your investigative style of journalism is apparently better than both Kaspersky and the BBC.
Re: Flame: Massive cyber-attack discovered, researchers say
#75Earlier quoted context omitted.
I always hesitate a little bit when I open a pdf, specially when it is one on malware
Use chrome! It's probably more secure than downloading the PDF and opening it with Adobe software.
Adobe Reader X actually has a decent sandbox ... but you're generally correct, I would trust chrome more.
Re: Flame: Massive cyber-attack discovered, researchers say
#76I'd love to know more about the command and control servers. If any of them involve paid hosting that might help to out the guilty party.
I would love to see the binary, even if it means waiting until vulnerabilities are patched.
At 20MB I would be suprised if it didn't patch itself with new exploits.
Re: Flame: Massive cyber-attack discovered, researchers say
#77Earlier quoted context omitted.
Give them some credit. Duqu was written using a nonstandard C extension for OO and it was pretty heavily obfuscated iirc.
Not really; they just did OO with C structs and function pointers, this is actually how it used to be done in high- performance code like computer graphics before C++ got fast enough. And the " obfuscation" was passing the -O flag to the compiler...
s/used to be done/is/
Also, the Linux kernel, and any other half decent large C program.
Re: Flame: Massive cyber-attack discovered, researchers say
#78Earlier quoted context omitted.
Aren't these the guys who wigged out because they thought Duqu was written in an entirely new custom virus language? And it was actually Visual C++? The second most common compiler on the planet? (after GCC) I would take their analysis with a big pinch of salt.
That was actually my first thought as well. To be fair, it was C with Simple Object Orientation so not quite as terrible as misidentifying C++ straight up though it was still a bit of a fiasco. From their perspective, I'm sure (over)hyping everything new they analyze as the next 'big deal' helps business even if they are wrong about the details on occasion.
The InfoSec industry unfortunately is 99% scaremongers and wannabe spies.
Re: Flame: Massive cyber-attack discovered, researchers say
#79Earlier quoted context omitted.
Use chrome! It's probably more secure than downloading the PDF and opening it with Adobe software.
Adobe Reader X actually has a decent sandbox ... but you're generally correct, I would trust chrome more.
Wow, I take back my statement. I have more respect for Adobe now.