Flame: Massive cyber-attack discovered, researchers say
Published: 28th May 2012 14:17:05
A complex targeted cyber-attack that collected private data from countries such as Israel and Iran has been uncovered, researchers have said.
Russian security firm Kaspersky Labs told the BBC they believed the malware, known as Flame, had been operating since August 2010.
The company said it believed the attack was state-sponsored, but could not be sure of its exact origins.
They described Flame as "one of the most complex threats ever discovered".
Research into the attack was carried out in conjunction with the UN's International Telecommunication Union.
In the past, targeted malware - such as Stuxnet - has targeted nuclear infrastructure in Iran.
Others like Duqu have sought to infiltrate networks in order to steal data.
This new threat appears not to cause physical damage, but to collect huge amounts of sensitive information, said Kaspersky's chief malware expert Vitaly Kamluk.
"Once a system is infected, Flame begins a complex set of operations, including sniffing the network traffic, taking screenshots, recording audio conversations, intercepting the keyboard, and so on," he said.
More than 600 specific targets were hit, Mr Kamluk said, ranging from individuals, businesses, academic institutions and government systems.
Iran's National Computer Emergency Response Team posted a security alert stating that it believed Flame was responsible for "recent incidents of mass data loss" in the country.
Mr Kamluk said the size and sophistication of Flame suggested it was not the work of independent cybercriminals, and more likely to be government-backed.
He explained: "Currently there are three known classes of players who develop malware and spyware: hacktivists, cybercriminals and nation states.
"Flame is not designed to steal money from bank accounts. It is also different from rather simple hack tools and malware used by the hacktivists. So by excluding cybercriminals and hacktivists, we come to conclusion that it most likely belongs to the third group."
Among the countries affected by the attack are Iran, Israel, Sudan, Syria, Lebanon, Saudi Arabia and Egypt.
"The geography of the targets and also the complexity of the threat leaves no doubt about it being a nation-state that sponsored the research that went into it," Mr Kamluk said.
The malware is capable of recording audio via a microphone, before compressing it and sending it back to the attacker.
It is also able to take screenshots of on-screen activity, automatically detecting when "interesting" programs - such as email or instant messaging - were open.
Kaspersky's first recorded instance of Flame is in August 2010, although it said it is highly likely to have been operating earlier.
Prof Alan Woodward, from the Department of Computing at the University of Surrey said the attack is very significant.
"This is basically an industrial vacuum cleaner for sensitive information," he told the BBC.
He explained that unlike Stuxnet, which was designed with one specific task in mind, Flame was much more sophisticated.
"Whereas Stuxnet just had one purpose in life, Flame is a toolkit, so they can go after just about everything they can get their hands on."
Once the initial Flame malware has infected a machine, additional modules can be added to perform specific tasks - almost in the same manner as adding apps to a smartphone.
At 23:35:48 in WorldA young girl offered US First Lady Michelle Obama her father's CV during questions at the White House's Take Our Daughters and Sons to Work Day.
At 23:12:26 in SportFormula 1 boss Bernie Ecclestone made his first appearance in a Munich court on Thursday, accused of giving a £27.5m ($45m, 33m euros) bribe to a German banker.
At 22:51:02 in EntertainmentA village museum in East Sussex will go up against Tate Britain and the new £35m Mary Rose Museum in a contest to be named the UK's museum of the year.
At 22:42:55 in BusinessBarclays agreed to a $280m (£167m) settlement with the US Federal Housing and Finance Authority (FHFA).
At 22:30:17 in EnglandThe government says it is making "urgent inquiries" into reports Whitehall computers were used to make insulting comments about the Hillsborough disaster.
At 22:22:33 in HeadlinesRussia and the US have accused each other of failing to de-escalate the crisis in Ukraine after Kiev launched raids on pro-Moscow separatists.
At 22:19:49 in SportWorld number one Rafael Nadal booked his place in the quarter-finals of the Barcelona Open with a 6-3 6-3 win over Croatian Ivan Dodig.
At 22:13:15 in SportFormer Rangers, Hearts and Scotland defender Sandy Jardine has died at the age of 65.
At 22:00:20 in PoliticsThe zero-hours contract - alongside the payday loan and the bad bank - has gained a kind of totemic significance in the public imagination.
At 22:00:03 in ScotlandScottish independence would leave working people north and south of the border worse off, Ed Miliband has claimed.
Harvard CitationBBC News, 2012. Flame: Massive cyber-attack discovered, researchers say [Online] (Updated 28th May 2012)
Available at: http://www.ukwirednews.com/news/1431353/Flame-Massive-cyber-attack-discovered-researchers-say [Accessed 25th Apr 2014]
News In Other Categories
Skin grown in the laboratory can replace animals in drug and cosmetics testing, UK scientists say.
A village museum in East Sussex will go up against Tate Britain and the new £35m Mary Rose Museum in a contest to be named the UK's museum of the year.
A young girl offered US First Lady Michelle Obama her father's CV during questions at the White House's Take Our Daughters and Sons to Work Day.
Scottish independence would leave working people north and south of the border worse off, Ed Miliband has claimed.
Ten candidates will be vying for three European parliament seats in Northern Ireland, it has been confirmed.