Iran Computers Hit By New Malware: Meet Flame!

Wired Threat Level introduces newest computer malware: "Flame". "Kaspersky [Lab] discovered the malware about two weeks ago after the United Nations’ International Telecommunications Union asked the Lab to look into reports in April that computers belonging to the Iranian Oil Ministry and the Iranian National Oil Company had been hit with malware that was stealing and deleting information from the systems," reveals article.  The inevitable tendency is to compare to Stuxnet and DuQu previous malware that likewise attacked Iran computer networks.

Threat Level compares similarities and differences of Stuxnet and DuQu to Flame:

"Stuxnet and DuQu were made of compact and efficient code that was pared down to its essentials. Flame is 20 megabytes in size, compared to Stuxnet’s 500 kilobytes, and contains a lot of components that are not used by the code by default, but appear to be there to provide the attackers with options to turn on post-installation. 'It was obvious DuQu was from the same source as Stuxnet. But no matter how much we looked for similarities [in Flame], there are zero similarities,' [ chief security expert at Kaspersky Lab, Alexander] Gostev said. “Everything is completely different, with the exception of two specific things.”

"One of these is an interesting export function in both Stuxnet and Flame, which may turn out to link the two pieces of malware upon further analysis, Gostev said. The export function allows the malware to be executed on the system. Also, like Stuxnet, Flame has the ability to spread by infecting USB sticks using the autorun and .lnk vulnerabilities that Stuxnet used. It also uses the same print spooler vulnerability that Stuxnet used to spread to computers on a local network. This suggests that the authors of Flame may have had access to the same menu of exploits that the creators of Stuxnet used."

Threat Level implies current computer worm, Flame is another large project that requires state backing: "a massive, highly sophisticated piece of malware has been newly found infecting systems in Iran and elsewhere and is believed to be part of a well-coordinated, ongoing, state-run cyberespionage operation."

cyberwars: duqu virus strikes iran

Golemreza Jalali, head of Iran's civil defense, concedes Iran is "...in the initial phase of fighting the Duqu virus," according to a Sydney Morning Herald article (SMH). "Symantec, the computer security firm, which has led investigations into Stuxnet and Duqu, said the new virus seemed to be intended to gain remote access to computer systems." The SMH article adds, "'...authors had access to the Stuxnet source code,' Symantec said. 'The attackers are looking for information such as design documents that could help mount an attack on an industrial control facility. Duqu is essentially the precursor to a Stuxnet-like attack.'" Is it a softening up preparatory phase - a prelude to war? The megalomaniac Israeli leaders want to attack even as a majority in Israel are against it!