New Serious threat – Wormw32Flame
What is described as the most sophisticated cyber weapon to date, Worm.Win32.Flame threat has been discovered on the loose in several middle eastern countries and Russia.
This virus appears to have Swiss Army Knife like tools that allow it to evolve and change to deal with any situation. Researchers are indicating that it was likely built by the same nation-state responsible for the Stuxnet virus that targeted Iran’s nuclear power plant in 2010. But this new weapon is twenty times the size of than Stuxnet and far more powerful.
The viruses prime goal is to capturing data from a machine. To accomplish that task, this made up of several modules designed to accomplish specific tasks. As examples:
-
It can record your keystrokes.
-
It can record from the microphone on your computer. Turning the computers microphone on to record nearby conversations.
-
It can take screen shots.
-
It sends all information captured to a remote computer for someone to siphon off. It makes the computer or mobile device both a transmitter and receiver, using wireless Blue Tooth connection to obtain fresh commands and/or pull the address book information out of nearby cell phones.
-
It can be turned into a drive shredder, by removing the entire content of a hard drive.
-
It can grow and change, having the ability to be reconfigured with new modules, turning the infected PC or industrial control system into whatever tool a spy dreams up.
While experts have indicated that there are no similarities in code between Stuxnet and it’s successor Duqu, the authors may have had access to common resources and tools. It’s currently estimated that there may be hundreds of unknown modules.
The Flame attack is broad based, having been detected in Hungary, Iran, and Lebanon, Austria, Russia, Hong Kong, and the United Arab Emirates, as well the Palestinian West Bank.
Rather that targeting a company, it also appears to target individuals. Many of the compromised computers appear to be personal systems being used from home Internet connections.
Researchers indicate that it will take months or possibly years to fully dissect the massive program, which uses a database to store information rather than a simple text file
Detecting infections could be an issue, because at least one known Flame module is an incredibly smart uninstaller, which lets the cyber weapon carefully extract itself from a computer before cleaning out all traces of itself. This means that you may have no idea if any machine was previously infected
At this point it’s not clear as to what specific kinds of protection common Anti-Virus and Anti-Malware programs are going to have to protect against this new threat. However, it clearly indicates a need to make sure that all computers on your network and home systems that access your business are properly protected by having the latest security service packs and Anti-virus/Anti-malware installed.