Flame (malware)

Flame (a.k.a. Da Flame) was identified in May 2012 by the MAHER Center of the Iranian National CERT, Kaspersky Lab and CrySyS Lab (Laboratory of Cryptography and System Security) of the Budapest University of Technology and Economics when Kaspersky Lab was asked by the United Nations International Telecommunication Union to investigate reports of a virus affecting Iranian Oil Ministry computers.{{cite news | title=Meet 'Flame,' The Massive Spy Malware Infiltrating Iranian Computers | first=Kim | last=Zetter | url=https://www.wired.com/threatlevel/2012/05/flame/ | newspaper=Wired | date=28 May 2012 | access-date=29 May 2012 | archive-url=https://web.archive.org/web/20120530213153/http://www.wired.com/threatlevel/2012/05/flame/ | archive-date=30 May 2012 | url-status=live}} As Kaspersky Lab investigated, they discovered an MD5 hash and filename that appeared only on customer machines from Middle Eastern nations. After discovering more pieces, researchers dubbed the program "Flame" after one of the main modules inside the toolkit {{mono|[FROG.DefaultAttacks.A-InstallFlame]}}.

According to Kaspersky, Flame had been operating in the wild since at least February 2010. CrySyS Lab reported that the file name of the main component was observed as early as December 2007. However, its creation date could not be determined directly, as the creation dates for the malware's modules are falsely set to dates as early as 1994.

Computer experts consider it the cause of an attack in April 2012 that caused Iranian officials to disconnect their oil terminals from the Internet.{{cite news | title=Computer Worm That Hit Iran Oil Terminals 'Is Most Complex Yet' | first=Nick | last=Hopkins | url=https://www.theguardian.com/world/2012/may/28/computer-worm-iran-oil-w32flamer | newspaper=The Guardian | date=28 May 2012 | access-date=29 May 2012 | archive-url=https://web.archive.org/web/20120531004924/http://www.guardian.co.uk/world/2012/may/28/computer-worm-iran-oil-w32flamer | archive-date=31 May 2012 | url-status=live}} At the time the Iranian Students News Agency referred to the malware that caused the attack as "Wiper", a name given to it by the malware's creator.{{cite news | title=Facing Cyberattack, Iranian Officials Disconnect Some Oil Terminals From Internet | first=Thomas | last=Erdbrink | url=https://www.nytimes.com/2012/04/24/world/middleeast/iranian-oil-sites-go-offline-amid-cyberattack.html | newspaper=The New York Times | date=23 April 2012 | access-date=29 May 2012 | archive-url=https://web.archive.org/web/20120531000136/http://www.nytimes.com/2012/04/24/world/middleeast/iranian-oil-sites-go-offline-amid-cyberattack.html?_r=1 | archive-date=31 May 2012 | url-status=live}} However, Kaspersky Lab believes that Flame may be "a separate infection entirely" from the Wiper malware. Due to the size and complexity of the program—described as "twenty times" more complicated than Stuxnet—the Lab stated that a full analysis could require as long as ten years.

On 28 May, Iran's CERT announced that it had developed a detection program and a removal tool for Flame, and had been distributing these to "select organizations" for several weeks. After Flame's exposure in news media, Symantec reported on 8 June that some Flame command and control (C&C) computers had sent a "suicide" command to infected PCs to remove all traces of Flame.{{cite web | url=https://www.bbc.co.uk/news/technology-18365844 | title=Flame malware makers send 'suicide' code | date=8 June 2012 | work=BBC News | access-date=8 June 2012 | archive-date=24 August 2012 | archive-url=https://web.archive.org/web/20120824202112/http://www.bbc.co.uk/news/technology-18365844 | url-status=live }} All copies of the program and any related files were deleted.{{Cite web |title=Flame |url=https://www.radware.com/security/ddos-knowledge-center/ddospedia/flame/#:~:text=In%20June%202012,%20many%20of,on%20all%20Flame-infected%20machines. |access-date=2024-09-25 |website=www.radware.com}}

According to estimates by Kaspersky in May 2012, initially Flame had infected approximately 1,000 machines, with victims including governmental organizations, educational institutions and private individuals. At that time the countries most affected were Iran, Israel, the Palestinian Territories, Sudan, Syria, Lebanon, Saudi Arabia, and Egypt.

A sample of the Flame malware is available at [https://github.com/phoenixlzx/flame-sourcecode GitHub].

Flame is an uncharacteristically large program for malware at 20 megabytes. It is written partly in the Lua scripting language with compiled C++ code linked in, and allows other attack modules to be loaded after initial infection.{{cite web | url=http://blog.fireeye.com/research/2012/05/flamerskywiper-analysis.html | title=Flamer/sKyWIper Malware: Analysis | last=Kindlund | first=Darien | date=30 May 2012 | publisher=FireEye | access-date=31 May 2012 | archive-url=https://web.archive.org/web/20120602005310/http://blog.fireeye.com/research/2012/05/flamerskywiper-analysis.html | archive-date=2 June 2012 | url-status=live}} The malware uses five different encryption methods and an SQLite database to store structured information. The method used to inject code into various processes is stealthy, in that the malware modules do not appear in a listing of the modules loaded into a process and malware memory pages are protected with READ, WRITE and EXECUTE permissions that make them inaccessible by user-mode applications. The internal code has few similarities with other malware, but exploits two of the same security vulnerabilities used previously by Stuxnet to infect systems.{{efn|MS10-061 and MS10-046}} The malware determines what antivirus software is installed, then customises its own behaviour (for example, by changing the filename extensions it uses) to reduce the probability of detection by that software. Additional indicators of compromise include mutex and registry activity, such as installation of a fake audio driver which the malware uses to maintain persistence on the compromised system.

Flame is not designed to deactivate automatically, but supports a "kill" function that makes it eliminate all traces of its files and operation from a system on receipt of a module from its controllers.

Flame was signed with a fraudulent certificate purportedly from the Microsoft Enforced Licensing Intermediate PCA certificate authority.{{cite web | url=http://blogs.technet.com/b/msrc/archive/2012/06/03/microsoft-releases-security-advisory-2718704.aspx?Redirected=true | title=Microsoft releases Security Advisory 2718704 | publisher=Microsoft | date=3 June 2012 | access-date=4 June 2012 | archive-date=7 June 2012 | archive-url=https://web.archive.org/web/20120607215605/http://blogs.technet.com/b/msrc/archive/2012/06/03/microsoft-releases-security-advisory-2718704.aspx?Redirected=true | url-status=live }} The malware authors identified a Microsoft Terminal Server Licensing Service certificate that inadvertently was enabled for code signing and that still used the weak MD5 hashing algorithm, then produced a counterfeit copy of the certificate that they used to sign some components of the malware to make them appear to have originated from Microsoft. A successful collision attack against a certificate was previously demonstrated in 2008,{{cite conference | url=http://www.win.tue.nl/hashclash/rogue-ca/ | title=MD5 considered harmful today: creating a rogue CA certificate | last1=Sotirov | first1=Alexander | last2=Stevens | first2=Marc | last3=Appelbaum | first3=Jacob | last4=Lenstra | first4=Arjen | last5=Molnar | first5=David | last6=Osvik | first6=Dag Arne | last7=de Weger | first7=Benne | date=30 December 2008 | event=25th Annual Chaos Communication Congress in Berlin | access-date=4 June 2011 | archive-date=25 March 2017 | archive-url=https://web.archive.org/web/20170325033522/http://www.win.tue.nl/hashclash/rogue-ca/ | url-status=live }}

but Flame implemented a new variation of the chosen-prefix collision attack.{{cite web | url=http://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-cryptographic-attack-variant-in-flame-spy-malware | title=CWI Cryptanalist Discovers New Cryptographic Attack Variant in Flame Spy Malware | first=Marc | last=Stevens | publisher=Centrum Wiskunde & Informatica | date=7 June 2012 | access-date=9 June 2012 | archive-url=https://web.archive.org/web/20170228155805/http://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-cryptographic-attack-variant-in-flame-spy-malware | archive-date=2017-02-28}}

{{clear}}

Like the previously known cyber weapons Stuxnet and Duqu, it is employed in a targeted manner and can evade current security software through rootkit functionality. Once a system is infected, Flame can spread to other systems over a local network or via USB stick. It can record audio, screenshots, keyboard activity and network traffic. The program also records Skype conversations and can turn infected computers into Bluetooth beacons which attempt to download contact information from nearby Bluetooth enabled devices. This data, along with locally stored documents, is sent on to one of several command and control servers that are scattered around the world. The program then awaits further instructions from these servers.

Unlike Stuxnet, which was designed to sabotage an industrial process, Flame appears to have been written purely for espionage.{{cite news | title=New Massive Cyber-Attack an 'Industrial Vacuum Cleaner for Sensitive Information' | first=Reuven | last=Cohen | url=https://www.forbes.com/sites/reuvencohen/2012/05/28/new-massive-cyber-attack-an-industrial-vacuum-cleaner-for-sensitive-information/ | newspaper=Forbes | date=28 May 2012 | access-date=29 May 2012 | archive-url=https://web.archive.org/web/20120531015321/http://www.forbes.com/sites/reuvencohen/2012/05/28/new-massive-cyber-attack-an-industrial-vacuum-cleaner-for-sensitive-information/ | archive-date=31 May 2012 | url-status=live}} It does not appear to target a particular industry, but rather is "a complete attack toolkit designed for general cyber-espionage purposes".{{cite news | title=Massive 'Flame' Malware Stealing Data Across Middle East | first=Chloe | last=Albanesius | url=https://www.pcmag.com/article2/0,2817,2404951,00.asp | newspaper=PC Magazine | date=28 May 2012 | access-date=29 May 2012 | archive-url=https://web.archive.org/web/20120530184457/http://www.pcmag.com/article2/0,2817,2404951,00.asp | archive-date=30 May 2012 | url-status=live}}

Using a technique known as sinkholing, Kaspersky demonstrated that "a huge majority of targets" were within Iran, with the attackers particularly seeking AutoCAD drawings, PDFs, and text files.{{cite web | url=https://www.bbc.com/news/technology-18324234 | title=Flame: Attackers 'sought confidential Iran data' | author=Lee, Dave | date=4 June 2012 | work=BBC News | access-date=4 June 2012 | archive-date=4 June 2012 | archive-url=https://web.archive.org/web/20120604181833/http://www.bbc.com/news/technology-18324234 | url-status=live }} Computing experts said that the program appeared to be gathering technical diagrams for intelligence purposes.

A network of 80 servers across Asia, Europe and North America has been used to access the infected machines remotely.{{cite news | title=Flame virus: Five facts to know | url=https://www.indiatimes.com/internet/flame-virus-five-facts-to-know-25730.html | newspaper=The Times of India | agency=Reuters | date=29 May 2012 | access-date=30 May 2012 | archive-url=https://archive.today/20240526001855/https://www.webcitation.org/6834SlYre?url=http://articles.timesofindia.indiatimes.com/2012-05-29/security/31887318_1_stuxnet-flame-kaspersky-lab | archive-date=26 May 2024 | url-status=live}}

On 19 June 2012, The Washington Post published an article claiming that Flame was jointly developed by the U.S. National Security Agency, CIA and Israel's military at least five years prior. The project was said to be part of a classified effort code-named Olympic Games, which was intended to collect intelligence in preparation for a cyber-sabotage campaign aimed at slowing Iranian nuclear efforts.{{Cite news | url=https://www.washingtonpost.com/world/national-security/us-israel-developed-computer-virus-to-slow-iranian-nuclear-efforts-officials-say/2012/06/19/gJQA6xBPoV_story.html | title=U.S., Israel developed Flame computer virus to slow Iranian nuclear efforts, officials say | newspaper=The Washington Post | date=19 June 2012 | access-date=20 June 2012 | author=Nakashima, Ellen | archive-date=18 July 2012 | archive-url=https://web.archive.org/web/20120718101813/http://www.washingtonpost.com/world/national-security/us-israel-developed-computer-virus-to-slow-iranian-nuclear-efforts-officials-say/2012/06/19/gJQA6xBPoV_story.html | url-status=live }}

According to Kaspersky's chief malware expert, "the geography of the targets and also the complexity of the threat leaves no doubt about it being a nation-state that sponsored the research that went into it." Kaspersky initially said that the malware bears no resemblance to Stuxnet, although it may have been a parallel project commissioned by the same attackers.{{cite news | title=Flame Virus: Who is Behind the World's Most Complicated Espionage Software? | url=https://www.telegraph.co.uk/technology/news/9296827/Flame-virus-who-is-behind-the-worlds-most-complicated-espionage-software.html | newspaper=The Daily Telegraph | date=29 May 2012 | access-date=29 May 2012 | archive-url=https://web.archive.org/web/20120531044449/http://www.telegraph.co.uk/technology/news/9296827/Flame-virus-who-is-behind-the-worlds-most-complicated-espionage-software.html | archive-date=31 May 2012 | url-status=live}}

After analysing the code further, Kaspersky later said that there is a strong relationship between Flame and Stuxnet; the early version of Stuxnet contained code to propagate via USB drives that is nearly identical to a Flame module that exploits the same zero-day vulnerability.{{cite web | url=http://www.kaspersky.com/about/news/virus/2012/Resource_207_Kaspersky_Lab_Research_Proves_that_Stuxnet_and_Flame_Developers_are_Connected | title=Resource 207: Kaspersky Lab Research Proves that Stuxnet and Flame Developers are Connected | date=11 June 2012 | publisher=Kaspersky Lab | access-date=13 June 2012 | archive-date=16 November 2021 | archive-url=https://web.archive.org/web/20211116092936/https://www.kaspersky.com/about/press-releases | url-status=live }}

Iran's CERT described the malware's encryption as having "a special pattern which you only see coming from Israel".{{cite news | title=Iran Confirms Attack by Virus That Collects Information | first=Thomas | last=Erdbrink | url=https://www.nytimes.com/2012/05/30/world/middleeast/iran-confirms-cyber-attack-by-new-virus-called-flame.html?_r=1&hp | newspaper=The New York Times | date=29 May 2012 | access-date=30 May 2012 | archive-url=https://web.archive.org/web/20120606185713/http://www.nytimes.com/2012/05/30/world/middleeast/iran-confirms-cyber-attack-by-new-virus-called-flame.html?_r=2&hp | archive-date=6 June 2012 | url-status=live}} The Daily Telegraph reported that due to Flame's apparent targets—which included Iran, Syria, and the West Bank—Israel became "many commentators' prime suspect". Other commentators named the U.S. as possible perpetrators. Richard Silverstein, a commentator critical of Israeli policies, claimed that he had confirmed with a "senior Israeli source" that the malware was created by Israeli computer experts. The Jerusalem Post wrote that Israel's Vice Prime Minister Moshe Ya'alon appeared to have hinted that his government was responsible, but an Israeli spokesperson later denied that this had been implied.{{cite news | url=https://www.washingtonpost.com/business/technology/flame-cyberweapon-written-using-gamer-code-report-says/2012/05/31/gJQAkIB83U_story.html | title=Flame cyberweapon written using gamer code, report says | author=Tsukayama, Hayley | date=31 May 2012 | newspaper=The Washington Post | access-date=31 May 2012 | archive-date=2 June 2012 | archive-url=https://web.archive.org/web/20120602061626/http://www.washingtonpost.com/business/technology/flame-cyberweapon-written-using-gamer-code-report-says/2012/05/31/gJQAkIB83U_story.html | url-status=live }} Unnamed Israeli security officials suggested that the infected machines found in Israel may imply that the virus could be traced to the U.S. or other Western nations.{{cite news | last1=Dareini | first1=Ali Akbar | last2=Murphy | first2=Dan | last3=Satter | first3=Raphael | last4=Federman | first4=Josef | date=May 30, 2012 | title=Iran: 'Flame' virus fight began with oil attack | language=en | work=Yahoo! News | agency=Associated Press | url=https://www.yahoo.com/news/iran-flame-virus-fight-began-oil-attack-184818332--finance.html }} The U.S. has officially denied responsibility.{{cite news | url=https://www.bbc.co.uk/news/technology-18277555 | title=Flame: Israel rejects link to malware cyber-attack | work=BBC News | date=31 May 2012 | access-date=3 June 2012 | archive-date=5 June 2014 | archive-url=https://web.archive.org/web/20140605045350/http://www.bbc.co.uk/news/technology-18277555 | url-status=live }}

A leaked NSA document mentions that dealing with Iran's discovery of FLAME is an NSA and GCHQ jointly-worked event.{{cite web | url=https://s3.amazonaws.com/s3.documentcloud.org/documents/1150433/lobban-nsa-visit-precis.pdf#page=3 | title=Visit Précis: Sir Iain Lobban, KCMG, CB; Director, Government Communications Headquarters (GCHQ) 30 April 2013 – 1 May 2013 | access-date=1 May 2014 | archive-date=2 May 2014 | archive-url=https://web.archive.org/web/20140502033350/https://s3.amazonaws.com/s3.documentcloud.org/documents/1150433/lobban-nsa-visit-precis.pdf#page=3 | url-status=live }}

• Cybercrime
• Cyberwarfare
• Cyber security standards
• Cyberterrorism
• Digital privacy
• Operation High Roller

{{notelist}}

{{reflist|30em}}

{{Hacking in the 2010s}}

{{Malware}}

Category:2012 in computing

Category:Rootkits

Category:Privilege escalation exploits

Category:Cyberwarfare

Category:Espionage scandals and incidents

Category:Exploit-based worms

Category:Cyberwarfare in Iran

Category:Cyberattacks on energy sector

Category:Spyware

Category:Hacking in the 2010s