Meet Flame, Son Of Stuxnet

Surprise!  "Hackers" up the ante!  Not really surprising, is it?  They're not really "hackers," either..  IT World.  Whole Thing, plus some comments:

Remember Stuxnet, the malware targeted at the Iranian nuclear industry? Say hello to Flame (Win32.Flame), a 20MB piece of modern cyberwar weaponry.



Detailed by Kaspersky Lab Expert Aleks in a Questions and Answers entry on SecureList, Flame is 20 times larger than Stuxnet and has been floating around the Middle East for two years or more. It is "a backdoor, a Trojan, and it has worm-like features," according to Kaspersky, and reports to about 80 command-and-control domains. Various Flame modules can be initialized on infected systems to change the information gathered.


Flame is able to infect a fully patched Windows 7 system, indicating it leverages a zero-day exploit not yet known to security researchers. The complexity and size of Flame indicates the likely developer was a "government-sponsored entity" according to the Wall Street Journal. Other names for Flame are Flamer, Wiper, Viper, and sKyWIper. It may be the "most complex malware ever found," according to a CrySyS Lab report.


Short sighted comment:

This is an advanced mechanism employed by a state agency. The article isn't overt, but the implication is clearly that this device is of US origin and purpose. Personally, I'm happy to see the US engaging in this sort of behavior. National Defense with low cost and no lives lost!



Andrew Middleton on wired.com

How ya gonna feel there, Andy, when Flame takes out the control systems of that nuclear plant you live downwind from?  How many lives will be lost if, during the middle of summer, entire power grids across the country are taken out, for weeks, even months?  Any cyber weapon we use can ultimately be used against us.  When you design software for cyber attack, that code can be captured, re-created and sent back at us with variants we might not be expecting.

These technologies are Digital Djinn:  They are magnificent powers, and should be treated with utmost respect.  Already though, it's too late.  They're already out in the cyberscape, ready to destroy, waiting to fulfill their programmed purpose, waiting until such time when the order does come.

Technologically Modern Society stands on a precipice much, much shakier than Technologically Modern Society could ever admit.  Most of the world will be oblivious to full on cyber warfare, though:  When it happens, no one will have power, so no one will fully know what's happening..  Besides, they'll probably be more focused on more immediate needs, like life during extended blackout chaos.  But trust me, there will some Episodes of Spectacular-ity during that conflict, that is for sure..

Iran says it has detected second cyber attack

Son of Stuxnet meet the World, World, this is Son of Stuxnet..  From Reuters, via Fark.

Iran has been targeted by a second computer virus in a "cyber war" waged by its enemies, its commander of civil defense said on Monday.

Gholamreza Jalali told the semi-official Mehr news agency that the new virus, called "Stars," was being investigated by experts.

"Fortunately, our young experts have been able to discover this virus and the Stars virus is now in the laboratory for more investigations," Jalali was quoted as saying. He did not specify the target of Stars or its intended impact.

"The particular characteristics of the Stars virus have been discovered," Jalali said. "The virus is congruous and harmonious with the (computer) system and in the initial phase it does minor damage and might be mistaken for some executive files of government organisations."

An observation here..  If Iran continues to stay tight-lipped about what they know regarding Stars, it means either it's having a severe impact on their operating systems, and they're going to let the perpetrators expose themselves by tracking where the leaks originate.  The Cyber War is well underway..

Japan to Stuxnet: How Long Have You Been Standing There?

New cybervirus found in Japan / Stuxnet designed to attack off-line servers via USB memory sticks  From Daily Yomiuri Online.  Excerpts:

Stuxnet, a computer virus designed to attack servers isolated from the Internet, such as at power plants, has been confirmed on 63 personal computers in Japan since July, according to major security firm Symantec Corp.

The virus does not cause any damage online, but once it enters an industrial system, it can send a certain program out of control.

After Stuxnet finds its way onto an ordinary computer via the Internet, it hides there, waiting for a USB memory stick to be connected to the computer, when it transfers itself to the memory stick. When the USB device is then connected to a computer linked to an isolated server, it can enter the system and take control of it.
..
According to the security company, the virus is designed to target a German-made program often used in systems managing water, gas and oil pipelines. The program is used at public utilities around the world, including in Japan.

Was The Japanese Nuclear Crisis Compounded By The Stuxnet Worm?   Room Eight offers the Stuxnet virus as "crazy Pit Bull who didn't mean to attack" Japan, but did.  Horrible, but accidental.

Maybe. This one sounds more curious in a more conspiratorial light.. 10 Germans flee Japan's quake-hit nuclear plant.  Stuxnet targets Siemens equipment, which is German made..

Not to mention this little nugget from Slovenia.  Slovene nuclear plant fails to restart

I'm not sure if any of this can be combined or valid, but with Japan's opaque attitude towards public information, this theory, while thin at the moment, might not be later.  Consider this a bookmark.  If more evidence arises, we'll revisit.