Flame: Massive cyber-attack discovered, researchers say • Hacker News Board

Re: Flame: Massive cyber-attack discovered, researchers say

#11

Post by davidandgoliath » Mon, May 28, 2012, 3:18 PM UTC

LiquidSummer wrote: post #7

I'm fed up by these technically lacking stories that don't give you the details but tell you that its "complex". While I realise that the BBC website is aimed towards the general public I think that it would be beneficial to include at least some technical details.

If you're fed up with that, avoid the mainstream media & delve into the blog post linked up above :)

Re: Flame: Massive cyber-attack discovered, researchers say

#12

Post by thursley » Mon, May 28, 2012, 3:19 PM UTC

More technical details (pdf) on: http://www.crysys.hu/skywiper/skywiper.pdf

Although the naming differs it has been noted on several blogs that it is the same malware.

Re: Flame: Massive cyber-attack discovered, researchers say

#13

Post by zby » Mon, May 28, 2012, 3:20 PM UTC

LiquidSummer wrote: post #7

I'm fed up by these technically lacking stories that don't give you the details but tell you that its "complex". While I realise that the BBC website is aimed towards the general public I think that it would be beneficial to include at least some technical details.

Or links to sources - this is the web for god's sake!

Re: Flame: Massive cyber-attack discovered, researchers say

#14

Post by LiquidSummer » Mon, May 28, 2012, 3:21 PM UTC

tlack wrote: post #10

I'd love to know more about the command and control servers. If any of them involve paid hosting that might help to out the guilty party.

Highly unlikely that that will happen, simply because even the smaller virus writers take precaution when buying servers, they usually do it using stolen credit cards that are not hard to acquire. In addition, the it also depends whether the hosting companies are willing to assist people with the investigation.

Re: Flame: Massive cyber-attack discovered, researchers say

#15

Post by LiquidSummer » Mon, May 28, 2012, 3:23 PM UTC

davidandgoliath wrote: post #11

LiquidSummer wrote: post #7

I'm fed up by these technically lacking stories that don't give you the details but tell you that its "complex". While I realise that the BBC website is aimed towards the general public I think that it would be beneficial to include at least some technical details.

If you're fed up with that, avoid the mainstream media & delve into the blog post linked up above :)

Haha! yeah I just finished reading the kinda-more-informative analysis (http://www.securelist.com/en/blog/208193522/The_Flame_Questi...). Seems very interesting. I wish that they would share the samples so other hobbyists could also see what it is like

Re: Flame: Massive cyber-attack discovered, researchers say

#16

Post by LiquidSummer » Mon, May 28, 2012, 3:26 PM UTC

swatkat wrote: post #3

Kaspersky blog has more info: http://www.securelist.com/en/blog/208193522/The_Flame_Questi...

>At the moment, we haven’t seen use of any 0-days; however, the worm is known to have infected fully-patched Windows 7 systems through the network, which might indicate the presence of a high risk 0-day.

I really want to know what that 0day is, I can't comprehend how hard it would be to find a 0day remote execution on a Windows system

Re: Flame: Massive cyber-attack discovered, researchers say

#17

Post by LiquidSummer » Mon, May 28, 2012, 3:38 PM UTC

thursley wrote: post #12

More technical details (pdf) on: http://www.crysys.hu/skywiper/skywiper.pdf Although the naming differs it has been noted on several blogs that it is the same malware.

I always hesitate a little bit when I open a pdf, specially when it is one on malware

Re: Flame: Massive cyber-attack discovered, researchers say

#18

Post by btipling » Mon, May 28, 2012, 3:44 PM UTC

LiquidSummer wrote: post #16

swatkat wrote: post #3

Kaspersky blog has more info: http://www.securelist.com/en/blog/208193522/The_Flame_Questi...

>At the moment, we haven’t seen use of any 0-days; however, the worm is known to have infected fully-patched Windows 7 systems through the network, which might indicate the presence of a high risk 0-day. I really want to know what that 0day is, I can't comprehend how hard it would be to find a 0day remote execution on a Windows system

The exploit might not be part of the package. It could be that the exploit installs flame and then uninstalls or removes traces of itself. 0days are very valuable, it makes sense to remove it if it has served its purpose.

Some exploits like those delivered via browsers attempt to execute code in privileged contexts without any file i/o. There might never have been anything to remove.

Re: Flame: Massive cyber-attack discovered, researchers say

#19

Post by pjin » Mon, May 28, 2012, 3:52 PM UTC

mkr-hn wrote: post #9

swatkat wrote: post #3

Kaspersky blog has more info: http://www.securelist.com/en/blog/208193522/The_Flame_Questi...

The LUA makes me wonder if the creator could be identified by their coding style.

From the Kaspersky article, Flame ships with a Lua VM, sqlite3, zlib, libbz2, and an SSL library (probably OpenSSL?), and these and more apparently result in its unusually large size (almost 20 MB).

Sounds almost like "lean malware" written by a relatively small team using easily available tools and libraries.

Re: Flame: Massive cyber-attack discovered, researchers say

#20

Post by jacquesgt » Mon, May 28, 2012, 3:59 PM UTC

vecinu wrote: post #6

I assume we are going to see a complicated and interesting dissection a la Stuxnet? The Stuxnet TED talk [0] was really interesting, I ended up giving a talk to my department at work afterwards. [0] - http://www.youtube.com/watch?v=CS01Hmjv1pQ

Here's a much deeper and more technical presentation Ralph Langner gave on Stuxnet.

http://vimeopro.com/s42012/s4-2012/video/35806770