Earlier this month, tech headlines were focused on the Flame malware. Now the fuss has largely died down as it appears that this espionage malware only infected a few hundred computers. “Currently, based on what is known about Flame, it would be safe to say that the average user should lose no sleep worrying about it,” advised strategic information security consulting company help AG. “Flame wasn't as distributed as initially feared. If the user is running an updated antivirus and follows the normal practices, he will be safe. Of course, this leaves out some users particularly those users who use pirated software and such, because such software cannot be updated with the latest security patches.” This doesn't mean that the Flame threat wasn't sophisticated. It just didn't spread as rapidly as originally feared. Nicolai Solling, director of Technology Services at help AG explained that the Flame virus, which was actually an attack toolkit, gained entry to computers running Windows by exploiting a vulnerability of the Windows Update Service. That's the service which fixes bugs in Microsoft's code. “All updates provided for Windows require a security certificate signed by Microsoft,” said Solling. “However, by providing a signed security certificate that appeared to belong to Microsoft, the Flame virus bypassed this restriction. The unsuspecting PC then proceeded to download what appeared to be a genuine Windows update, which was in fact the loader for the Flame virus.” Once Flame gained access to a computer, it would quietly harvest data off the infected machine. Cyber criminals could gain the ability to take screenshots, listen in to conversations though the system microphone or even capture video though an attached webcam. While the Flame malware was unusual in the method it used to gain access to a computer, it didn't succeed because according to Solling, many organizations didn't have the “environment” where Flame could be installed. Bruce Schneier's blog “Schneier on Security” discussed the fact that security companies had samples of the Flame Malware at least two years ago but they did nothing to halt its slow, stealthy spread. “It was never a priority to understand – and then write signatures to detect – the Flame samples because they were never considered a problem,” wrote Schneier. “Maybe they were classified as a one-off. Or as an anomaly. I don't know, but it seems clear that conventional non-military malware writers that want to evade detection should adopt the propagation techniques of Flame, Stuxnet, and DuQu.”
