The infamous Flame virus can infect even secure PCs by tricking them into believing its malicious payload is actually an update from Microsoft.
As we already know, Flame has gained traction by tapping into security certificates for Microsoft’s Terminal Server. Though they appear to be digitally signed by Microsoft, the certificates are actually cooked up by the people behind Flame, thereby tricking PCs into accepting them as legitimate.
Microsoft and Symantec revealed yesterday that the virus can up the ante by using the fake certificates to spoof Microsoft’s own Windows Update service. As such, Windows PCs could receive an update that claims to be from Microsoft but is in fact a launcher for the malware.
Symantec described the method behind Flame’s madness: The virus, also known as Flamer, uses three applications to infect PCs — Snack, Munch, and Gadget. Collectively, this trio can trick PCs into redirecting Internet traffic to an infected computer with a fake Web server,. Once infected, a PC thinks the file that loads Flame is actually a Windows Update from Microsoft.
And as Symantec explained in its blog, spoofing Windows Update is not a trivial matter.
Hijacking Windows Update is not trivial because updates must be signed by Microsoft. However, Flamer bypasses this restriction by using a certificate that that chains to the Microsoft Root Authority and improperly allows code signing. So when a Windows Update request is received, the GADGET module through MUNCH provides a binary signed by a certificate that appears to belong to Microsoft.
The unsuspecting PC then downloads and executes the binary file, believing it to be a legitimate Windows Update file, Symantec added. The binary is not the Flame virus itself but a loader for Flame.
Microsoft also confirmed the risk to Windows Update, explaining that the vulnerability could be used to attack customers who weren’t the focus of the original Flame virus.
“In all cases, Windows Update can only be spoofed with an unauthorized certificate combined with a man-in-the-middle attack,” Microsoft said. The Flame virus itself has employed a man-in-the-middle attack to steal data, listen in on audio conversations, and take shots of screen activity.
Microsoft has already taken action by issuing a Security Advisory on how to block software signed by the unauthorized certificates, releasing an update to block the rogue certificates, and cutting off the ability of the Terminal Server Licensing Service to issue certificates that allow code to be signed.
To further protect its customers, the software giant is promising to harden its Windows Update service.
“We will begin this update following broad adoption of Security Advisory 2718704 in order not to interfere with that update’s worldwide deployment,” Microsoft said. “We will provide more information on the timing of the additional hardening to Windows Update in the near future.”
Some security experts have downplayed the danger of Flame, claiming it’s not as huge a threat as feared.
“As we continue our investigation of Flame, more and more details appear which indicate our initial statement: this is one of the most interesting and complex malicious programs we have ever seen,” Kaspersky said in a blog yesterday.
- ‘Nightmare’ scenario: Flame virus spreads by hijacking Microsoft’s Windows Update (geekwire.com)
- Microsoft ‘hardens’ Windows Update from Flame penetration (go.theregister.com)
- Flame malware used man-in-the-middle attack against Windows Update (nakedsecurity.sophos.com)
IDG News Service – The majority of IT and security professionals believe that Anonymous and hacktivists are among the groups that are most likely to attack their organizations during the next six months, according to the results of a survey sponsored by security vendor Bit9.
Sixty-four percent of the nearly 2,000 IT professionals who participated in Bit9′s 2012 Cyber Security Survey believe that their companies will suffer a cyberattack during the next six months and sixty-one percent of them chose hacktivists as the likely attackers.
Respondents had the option to select up to three groups of attackers who they believe are most likely to target their organizations. The choices were Anonymous/hacktivists, cybercriminals, nation states, corporate competitors and disgruntled employees.
Anonymous was chosen by the largest number of IT professionals overall, but there were some differences based on the type of organization. For example, nation states was the top choice for people working in the government sector, while those working in retail selected cybercriminals as the top threat.
According to Verizon’s 2012 Data Breach Investigations Report, hacktivists stole the largest quantity of data in 2011, but they were responsible for only 3 percent of the total number of breaches.
Respondents choosing hacktivists as a more likely source of cyberattacks than cybercriminals is similar to how most people fear flying more than driving, even though, statistically speaking, it’s far more likely for someone to be involved in a car accident than in a plane crash, said Bit9 chief technology officer Harry Sverdlove.
The truth is that you are less likely to be attacked by Anonymous or hacktivists — depending on what public statements you make — than to be attacked by a cybercriminal enterprise or a nation state, he said.
Despite considering Anonymous the top threat, when selecting the method of attack they are most worried about, 45 percent of respondents chose malware, which is generally associated with cybercrime rather than hacktivism.
Sverdlove believes that the reason why most IT professionals fear attacks from Anonymous is the bad publicity such attacks generate. If you’re attacked by Anonymous the world is going to know because the announcement will be on Pastebin in 24 hours, whereas if you’re attacked by cybercriminals, people might never find out, he said.
Despite this, almost 95 percent of respondents feel that data breaches should be disclosed to customers and the public. Forty-eight percent believe that companies should disclose the breach occurrence as well as what was stolen, while an additional 29 percent believe that companies should also disclose how the breach occurred.
Over half of those surveyed, 54 percent, believe that the most important machines in their business environment are the infrastructure servers. Forty-eight percent selected file and database servers, 46 percent selected Web and application servers and 45 percent chose email servers. Multiple choices were allowed.
When asked on which business machines they believe their cybersecurity protections to be most effective, the surveyed IT professionals chose them in a similar order. Forty percent believe their cybersecurity is strongest on infrastructure servers and only 26 percent believe it’s strongest on endpoint machines.
Sverdlove thinks that respondents over-evaluated the strength of cybersecurity on their Web and database servers. As validated by a recent report from Hewlett-Packard, a lot of companies are far more vulnerable on their servers than IT professionals realize, he said.
HP’s 2011 Top Cyber Security Risks Report, which was published on Wednesday, said that 86 percent of Web applications used by businesses are vulnerable to some type of injection attack that can be exploited by hackers to access internal databases.
More than half of IT professionals who participated in Bit9′s survey believe that implementing best security practices and better security policies can have the biggest impact on the strength of an organization’s cybersecurity. Only 15 percent of respondents felt that better technology will have a better impact and only 6 percent favored government regulation over other actions