‘Flame’ raises spyware to new levels, but who’s behind it?
Connecting state and local government leaders
The sophisticated malware, also called Flamer or sKyWIper, is conducting "old-school espionage" and is apparently the work of a team working full time for months or years.
Researchers in the United States and Europe have identified a sophisticated piece of spyware that appears to be targeting a small number of individuals primarily in the Middle East and is intended to gather a broad range of information.
The malware, variously called Flame, Flamer and sKyWIper by different organizations, appears to be a “full-featured spying program,” said Orla Cox, senior security operations manager for Symantec Security Response. Rather than concentrating on a particular kind of data, such as intellectual property or financial information, “it’s more like old-school espionage.”
Analysis of the complex malware is only beginning, but to date neither its authors nor its purpose have been identified. Cox would say only that the authors appear to be well-funded and well-resourced.
Related coverage:
Stuxnet, Duqu tip of the iceberg; more attacks on tap, researchers say
“It’s huge by malware standards,” with some elements as large as 20 megabytes, she said. “It wouldn’t be the work of one person. Obviously you have a team of people working full-time on this,” for months or years. This suggests that it could be the product of a nation, but “it would be hard to point a finger.”
Researchers at CrySyS Lab at the Budapest University of Technology and Economics, who did much of the early research on what they call sKyWIper, said they believe that, based on internal evidence and malware reports, some portions of the program could have been operational for as long as five to eight years. Some elements were identified as long ago as December 2007 in Europe, then April 2008 in the United Arab Emirates, and March 2010 in Iran.
Comparisons with Stuxnet and Duqu have been made, but CrySyS researchers said they are probably not the work of the same authors.
“sKyWIper and Duqu (Stuxnet) have many differences, and it seems plausible that sKyWIper was not made by the same developer team,” they wrote in their initial report. “However, we cannot exclude the possibility that the attackers hired multiple independent development teams for the same purpose, and sKyWIper and Duqu are two independent implementations developed for the same requirement specifications.”
One of the greatest differences between Stuxnet and Flamer/sKyWIper is that Stuxnet targeted specific hardware and was used to sabotage Iranian nuclear development facilities, and Flamer only gathers information. It can leverage almost all of a compromised computer’s functions for this, from keystroke logging and screen captures to audio and video recording using a computer’s microphone and cameras.
Flamer is too big to be analyzed quickly, and researchers have only developed a broad view of its capabilities and uses. “Much more work is needed to fully understand the details of the operation of the malware,” Hungarian researchers wrote. “However, as much debug/symbol information remains in the code, a detailed analysis seems to be feasible with additional resources and time.”
Although Flamer looks to have been in the wild for years, the number of infections appears to be in the hundreds, which suggests a highly selective use, Cox said. Its purpose is not known, but it appears to have targeted individuals rather than organizations, and many of the infections seem to be on home computers rather than on computers within an enterprise.
Not enough is known about the victims to explain know why they were targeted or how the malware is being spread, Cox said.
“Typically, for something this targeted, you’d expect it came through an e-mail or a USB key,” she said. But although Flamer appears to be capable of spreading through removable drives and USB-connected devices, the original infection route has not been found.
Symantec has identified primary target areas as the Palestinian West Bank, Hungary, Iran and Lebanon, although there also have been reports of infections in Austria, Russia, Hong Kong and the United Arab Emirates. Researchers speculate that the secondary infection reports might be from infected laptops being carried into other countries.
Although the discovery of Flamer/sKyWIper follows Stuxnet and Duqu, it does not necessarily indicate a significant move toward state-sponsored cyber espionage or cyber warfare, Cox said.
“I don’t think that we can say there is an explosion,” she said. “It’s only one per year” that has been discovered. “It certainly is still the exception.”
On the other hand, someone is investing considerable time and effort to produce tools for clandestine activities in cyberspace.