Page 1 of 2
The use of multiple encryption techniques, four different protocols and a systematic deletion of sensitive data has emerged as the latest evidence that the Flame malware is a weapon in a high-stakes game of spy vs. spy.
Images from two command-and-control servers supporting W32.Flamer have been accessed and investigated through a joint industry effort that included representatives from Kaspersky Lab, the ITU’s IMPACT Alliance, CERT-Bund/BSI and Symantec.
The investigators now believe that the command-and-control system to support this highly sophisticated and weaponized software has been in development since December 2006 by a group of at least four different individuals who were highly skilled, well funded and very likely to be working in the service of nation-states pursuing targets in the Middle East.
[Related: How To Guard Against Virus Attacks]
"We don't have any definitive proof of which group it might be," said Kevin Haley, a director at Symantec Security Response. "But the kind of sophistication in the kind of resources, and the fact that this is narrowly targeted tends to indicate that this is being used for espionage, which suggests that there is a nation-state involved."
The investigators further believe that the same C&C servers were also used in malware attacks that did not involve Flame and that multiple encryption techniques were in use. It has also become clear that the group took a very systematic approach to removing information from the servers in the event that their own security might be breached.
"While the authors went to great lengths to remove things from the server on a scheduled basis, we actually found a log file of work done on the machine," explained Haley. "We see entries as far back as 2006, and we see four different names being used."
The names are actually aliases, according to the report. D***, H*****, O******, and R*** apparently worked on the code at various times and under various capacities, going back for the last six years.
One of the servers under scrutiny was set up on March 25, 2012, while the other was set up on May 18, 2012. In each case, the servers began pinging Flame-infected computers only a few hours after being set up. Within a few weeks, they had established control of what is characterized as "a few hundred computers." Symantec reports that the March server collected almost 6 GB of data from compromised computers in approximately one week, whereas the May server received just 75 MB of data and was apparently used solely to distribute one command module to the compromised computers.
