Stuxnet, of hoe de cyberoorlog tot in perfectie is uitgevoerd...

quote:

Flame malware makers send 'suicide' code

The creators of the Flame malware have sent a "suicide" command that removes it from some infected computers.

Security firm Symantec caught the command using booby-trapped computers set up to watch Flame's actions.

Flame came to light after the UN's telecoms body asked for help with identifying a virus found stealing data from many PCs in the Middle East.

New analysis of Flame reveals how sophisticated the program is and gives hints about who created it.

Clean machine
Like many other security firms Symantec has kept an eye on Flame using so-called "honeypot" computers that report what happens when they are infected with a malicious program.

Described as a very sophisticated cyber-attack, Flame targeted countries such as Iran and Israel and sought to steal large amounts of sensitive data.

Earlier this week Symantec noticed that some Flame command and control (C&C) computers sent an urgent command to the infected PCs they were overseeing.

Flame's creators do not have access to all their C&C computers as security firms have won control of some of them.

The "suicide" command was "designed to completely remove Flame from the compromised computer", said Symantec.

The command located every Flame file sitting on a PC, removed it and then overwrote memory locations with gibberish to thwart forensic examination.

"It tries to leave no traces of the infection behind," wrote the firm on its blog.

Analysis of the clean-up routine suggested it was written in early May, said Symantec.

Crypto crash
At the same time, analysis of the inner workings of Flame reveal just how sophisticated it is.

According to cryptographic experts, Flame is the first malicious program to use an obscure cryptographic technique known as "prefix collision attack". This allowed the virus to fake digital credentials that had helped it to spread.

The exact method of carrying out such an attack was only demonstrated in 2008 and the creators of Flame came up with their own variant.

"The design of this new variant required world-class cryptanalysis," said cryptoexpert Marc Stevens from the Centrum Wiskunde & Informatica (CWI) in Amsterdam in a statement.

The finding gives support to claims that Flame must have been built by a nation state rather than cybercriminals because of the amount of time, effort and resources that must have been put into its creation. It is not yet clear which nation created the program.

quote:

CWI-cryptanalist ontdekt nieuwe cryptografische aanvalsvariant in Flame-virus

Cryptanalist Marc Stevens van het Centrum Wiskunde & Informatica (CWI) in Amsterdam, bekend van zijn 'kraak' van de MD5 hash-functie voor https-beveiliging in 2008, heeft deze week het recente Flame-virus geanalyseerd. Hij ontdekte dat voor deze spy malware een compleet nieuwe, tot nu toe onbekende cryptografische aanvalsvariant van zijn eigen MD5-aanval is gebruikt. Stevens analyseerde dit met nieuwe, door hem ontwikkelde forensische software. Aanvankelijk ging de onderzoeker ervan uit dat Flame zijn eigen, in 2009 openbaar gemaakte aanval gebruikte maar dit bleek niet het geval te zijn. "Flame gebruikt een geheel nieuwe variant van een 'chosen prefix collision' aanval om zich voor te doen als een legale beveiligingsupdate van Microsoft. Het maken van zon variant vereist cryptanalyse van wereldniveau," zegt Marc Stevens. "Het is dus zeer belangrijk om te investeren in cryptografisch onderzoek, om deze ontwikkelingen in de praktijk voor te blijven".

Het baanbrekende cryptografie-onderzoek is gedaan in CWI's Cryptology-groep, die onder leiding staat van prof.dr. Ronald Cramer. Deze groep onderzoekt fundamentele cryptografische vragen vanuit een breed wetenschappelijk perspectief, met name vanuit de wiskunde, computerwetenschap en natuurkunde. "Zonder ons fundamenteel wiskundig, cryptografisch onderzoek hadden we deze forensische software niet kunnen ontwikkelen", zegt Ronald Cramer. Het onderzoek van Marc Stevens maakt deel uit van diens promotieonderzoek, waarop hij op 19 juni aan het Mathematisch Instituut van de Universiteit Leiden hoopt te promoveren.
De gedetailleerde technische uitleg van CWI-onderzoeker Marc Stevens volgt onderaan dit bericht.

quote:

U.S., Israel developed Flame computer virus to slow Iranian nuclear efforts, officials say

quote:

The United States and Israel jointly developed a sophisticated computer virus nicknamed Flame that collected critical intelligence in preparation for cyber-sabotage attacks aimed at slowing Iran’s ability to develop a nuclear weapon, according to Western officials with knowledge of the effort.

The massive piece of malware was designed to secretly map Iran’s computer networks and monitor the computers of Iranian officials, sending back a steady stream of intelligence used to enable an ongoing cyberwarfare campaign, according to the officials.

quote:

The emerging details about Flame provide new clues about what is believed to be the first sustained campaign of cyber-sabotage against an adversary of the United States.

quote:

Op dinsdag 31 juli 2012 10:40 schreef UncleScorp het volgende:
Iran nuclear facilities hit by cyber attack that plays AC/DC's Thunderstruck at full volume

As far as malicious computer hacking is concerned, the most recent breach of security at Iran's nuclear facilities may not be very serious... unless you hate the music of Australian rock band AC/DC.
It has been alleged that unidentified computer hackers have forced workers at two of the country’s controversial nuclear facilities to endure AC/DC's hit song Thunderstruck repeatedly - and at full volume - sometimes in the middle of the night.
Of course, there has been no confirmation of the attack from Iran - the evidence stems from a series of e-mails purporting to be from the Atomic Energy Organisation of Iran.

An unnamed Iranian scientist e-mailed Mikko Hypponen, chief research officer for Finnish Internet security firm F-Secure, saying that the facilities at Natanz and Fordo, near Qom, were hit by a worm.
Apart from disabling the automated network at both sites, the malware seemed to have an interesting side effect of blaring out AC/DC at any given moment.
When contacted by MailOnline, Mr Hypponen confirmed that he had received the e-mails and that he had been e-mailing the scientist about the incident over the weekend.
He sent a redacted copy of the e-mail, which said: 'I am writing you to inform you that our nuclear program has once again been compromised and attacked by a new worm with exploits which have shut down our automation network at Natanz and another facility Fordo near Qom.'

Another e-mail made reference to AC/DC's Thunderstruck being played 'on several workstations in the middle of the night with the volume maxed out'.

It's not the first time that the Iranian nuclear programme has been the target of malware.
The destructive Stuxnet worm has now affected around 60 per cent of computers in Iran, and is widely held responsible for wrecking the centrifuge at the Nantaz nuclear facility.
Iran has confirmed that work has halted several times at the facility because of 'technical issues', and use of the centrifuge has dropped by

Stuxnet was thought at first to be the work of Israeli intelligence agency Mossad, but experts have recently turned the finger of suspicion to point at the U.S.
Many experts believe that the future of warfare will heavily rely on a nation's ability to 'spike' their enemies' computer networks.
Recently the Chinese have been suspected over a series of non-threatening incidents - such as the hacking of a U.S. automated sewerage system, or effectively taking command of two Nasa satellites.
Using music as a weapon has long been a trait of the US military, in conflicts including the invasion of Panama in the 1990s.

http://www.dailymail.co.u(...)erstruck-volume.html

quote:

Op dinsdag 31 juli 2012 12:45 schreef Chuck-N0rr1s het volgende: