A new, unprecedented computer virus called “Flame”
(or “sKyWIper”) has hit Iran, the West Bank, and other Middle Eastern
locations. It is already considered one of the most sophisticated cyber weapons
ever unleashed. Internet security company Kaspersky said Monday that Flame was
the “most complex piece of malicious software discovered to date.” The cyber-espionage worm, designed to
collect and delete sensitive information, is said to have 20 times as much code
as Stuxnet, which attacked an Iranian uranium enrichment facility (and some
16,000 computers), causing centrifuges to fail. Iran blamed Israel and the US
for its creation. Flame is also believed
to contain an element that was used in Stuxnet. Kaspersky said the Flame
malware may have been lurking inside thousands of computers across the Middle
East for between five and eight years. The creator of the virus is not yet
known. . . . . . The country with the largest number of machines infected by
Flame is believed to be Iran, following by the West Bank, and Sudan and Syria
after that. Lebanon, Saudi Arabia, and Egypt have also been affected.
Source site: the Times of Israel here.
_______________________________
In a PDF technical report on the virus, the University of Budapest gave us this excerpt in its larger report found here.
Our first insight suggests that sKyWIper is another
info-stealer malware with a modular structure incorporating multiple
propagation and attack techniques, but further analysis may discover components
with other functionalities. In addition, sKyWIper may have been active for as
long as five to eight years, or even more. sKyWIper uses compression and
encryption techniques to encode its files. . . . . . . . . . sKyWIper has very
advanced functionality to steal information and to propagate. Multiple exploits
and propagation methods can be freely configured by the attackers. Information gathering
from a large network of infected computers was never crafted as carefully as in
sKyWIper. The malware is most likely capable to use all of the computers’
functionalities for its goals. It covers all major possibilities to gather
intelligence, including keyboard, screen, microphone, storage devices, network,
wifi, Bluetooth, USB and system processes.
The results of our technical analysis support the
hypotheses that sKyWIper was developed by a government agency of a nation state
with significant budget and effort, and it may be related to cyber warfare
activities. sKyWIper is certainly the most sophisticated malware we encountered
during our practice; arguably, it is the most complex malware ever found.
No comments:
Post a Comment