Scant Brain Power Behind Massive DDoS Attack

It may be the most disturbing thing about last week's historic denial of service attack on a Dutch anti-spam organization -- the fact that the technology involved wasn't that complicated. That's one of the findings of security professionals studying the attack methods used on Spamhaus, along with the knowledge that the hackers used the Internet's own structure to extend their assaults on the group.

One of the largest denial of service attacks in the history of the Internet didn't take rocket science to execute. The offensive was conducted over several days last week after the anti-spam group Spamhaus placed a Dutch hosting service, located in a former NATO bunker, on a blacklist reserved for spammers.

A group calling itself STOPhaus is claiming responsibility for the series of attacks which, at their height, reached bandwidths of 300 Gbps. A 10 Gbps attack will bring most websites down.

To reach those bandwidth levels, the attackers exploited the Internet's architecture and the Domain Naming System to expand the scope of their assaults. They essentially used open servers used to resolve DNS addresses on the Internet like megaphones to amplify their attacks.

The technique was used earlier this year in a series of attacks on U.S. financial websites.

Perl Used By Swine?

Despite the magnitude of the onslaughts, security experts said they can be launched with a relatively low level of technical knowledge. "The technique isn't particularly difficult," said Matthew Prince, co-founder and CEO of Cloudflare. Prince's company came to Spamhaus's aid when the attacks threatened to overwhelm its website.

"The amount of code you'd need to write to launch this attack can almost be done in a line of Perl," Prince told TechNewsWorld. The most difficult part of the campaign is finding open resolvers to use in your attack because it requires scanning billions of IP addresses.

"It takes a lot of reconnaissance, but not a whole lot of technology itself," Henry Stern, a threat researcher with Cisco told TechNewsWorld. That reconnaisance may have gotten easier. A group calling itself the Open DNS Resolver Project has published a list of 27 million open or semi-open resolvers on the Net. The group's intentions are good ones; it wants server operators to check their IP addresses at the site and restrict access to any of their servers they find on the list.

---

Blowfish12@2013 blowfish12.tk Author: Sudharsun. P. R.

Related articles

• Largest-Ever DDoS Campaign Demonstrates Danger of New Attack Method (eweek.com)
• Largest-Ever DDoS Attack on Internet Blacklist Maintainer Spamhaus Tops 300 Gbp (leaksource.wordpress.com)
• Spamhaus Attacks Expose Huge Open DNS Server Dangers (cio.com)
• The DDoS Attack That Almost Broke the Internet, Didn't Even Break the Site It Targeted (news.softpedia.com)
• Scant Brain Power Behind Massive DDoS Attack (technewsworld.com)

Fact for the Day: 4.1.2013

The first known cell phone virus, Cabir.A, appeared in 2004.

---

Blowfish12@2013 blowfish12.tk Author: Sudharsun. P. R. Courtesy: Wikipedia

[virus] Fake Android app can launch DDoS attacks from your phone

Researchers at Doctor Web found a new trojan app in the Google Play store that can launch distributed denial of service attacks when opened.

Android.DDoS.1.origin, as it’s called, is Russian and disguises itself as the Google Play icon once downloaded. When opened, the app takes its victims to the actual Google Play store so as to distract the user. In the background, however, it searches for its command and control server — and if a connection is made, the app sends the infected phone’s number to the criminals. These hackers then administer commands to the app via text messages.

Commands include launching a DDoS attack or sending other text messages. Doctor Web suggests that the text message function could be used to spam others in the phone’s contact list, prompting them to either download the app or something else the hackers are pushing.

Nowadays when we think of DDoS attacks, we often are reminded of Anonymous, the hacker collective that launches a number of these attacks in the name of political protest. We’ve seen DDoS attacks take down a number of important websites including the CIA’s, financial institutions, and others. These attacks send large amounts of traffic toward a certain website’s servers in an attempt to overload the system and shut it down.

With this app, however, hackers with DDoS intentions are roping in innocent bystanders to do the dirty work. This isn’t the first time we’ve seen a campaign like this. In the case of the CIA website’s take down, Anonymous was accused of distributing links on Twitter to low-orbit-ion-canons (LOIC). These “cannons” send thousands of packets of information to a targeted server per second. When the Twitter links were clicked on, unsuspecting visitors would suddenly be roped into the attack.

Doctor Web goes on to say that the app can cause the phone to perform poorly, and can actually run up the owner’s bill by texting premium numbers.

---

Blowfish12@2012 blowfish12.tk Author: Sudharsun. P. R.

Related articles

• New Android Malware Can Launch DDoS Attacks From Your Smartphone (thedroidguy.com)


• New Android malware uses Google Play icon to trick users, conduct DDoS attacks and send spam texts (thenextweb.com)


• HSBC Gets Hit By DDoS Attack (misco.co.uk)


• DDoS Attack Against Banks to Continue into the New Year (securitybistro.com)


• New Android Malware Uses Google Play Icon To Trick Users (mobile.slashdot.org)


• WordPress Pingback Vulnerability Serves DDoS attack feature (engineeringevil.com)


• Bank Regulator issues informative alert on DDoS attacks (blogs.gartner.com)


• WordPress Pingback Vulnerability Can Be Leveraged in DDoS Attacks (ehackingnews.com)


• [Resolved] Minor DDoS attack (easydns.org)

Iran nuclear facilities 'Thunderstruck' by AC/DC malware

In 2010, Iran's nuclear facilities were infiltrated by Stuxnet, the centrifuge-wrecking malware allegedly cooked up by the US government. Now they seem to have been hit again by a bizarre attack forcing nuclear plant workstations to pump the song Thunderstruckby heavy metal band AC/DC through the speakers at full volume.

News of the attack comes from Mikko Hypponen, chief research officer at Finnish computer security firm F-Secure, who says he recently received a series emailsfrom a scientist working at the Atomic Energy Organization of Iran (AEOI):

"I am writing you to inform you that our nuclear program has once again been compromised and attacked by a new worm with exploits which have shut down our automation network at Natanz and another facility Fordo near Qom."

The Iranian scientist goes on to say that they believe the attackers used Metasploit, a common hacking tool which provides a variety of ways to penetrate supposedly secure networks. "There was also some music playing randomly on several of the workstations during the middle of the night with the volume maxed out," says the scientist. "I believe it was playing 'Thunderstruck' by AC/DC."

While the US military has used heavy metal music as a weapon in the past it seems unlikely that a Stuxnet-like stealth attack would announce its presence with a few blasting power chords, suggesting the hit is more likely the work of a thrill-seeking hacker. Hypponen says he has been unable to verify any details of the attack, but has confirmed that the emails were sent and received from within the AEOI.

---

Blowfish12@2012 blowfish12.tk Author: Sudharsun. P. R.

Related articles

• Emails from Iran - F-Secure Weblog : News from the Lab (f-secure.com)


• US and Israel developed Flame, says official (blowfish12.wordpress.com)


• Flame: 'Most complex' cyber-attack ever discovered (zdnet.com)


• Experts: U.S. Cyber War on Iran Has Just Begun (israelnationalnews.com)


• Philippines news Cyber war on Iran has only just begun (technology.inquirer.net)


• Development timeline key to linking Stuxnet, Flame malware (networkworld.com)


• New 'Mahdi malware' cyber spy attack on Iran disclosed (latimesblogs.latimes.com)


• Stuxnet exposing Obama's cyber-war hypocrisy! (english.pravda.ru)


• Iran Nuclear Facilities 'Under Massive Cyber Attack (warsclerotic.wordpress.com)


• Sorry, Iran. I Didn't Mean to Invade You - Daily Beast (thedailybeast.com)

Virtual germ created on computer for first time

In a move that promises to bring the advantages of computer aided design (CAD) to genetic engineers, the first computer model of a complete bacterium has been produced in the US. It means researchers will soon be able to modify models of an organism's genome on a computer screen - or create artificial lifeforms - without the risks of undertaking wet biology in secure biosafety labs.

The pathogen is called Mycoplasma genitalium, a bacterium implicated in a number of urethral and vaginal infections. The bug was ripe for modelling say researchers at Stanford University in California, because it has the smallest genome of any free-living organism, with just 525 genes. By contrast, the popular lab pathogen E. colihas 4288 genes.

The modelling was undertaken by bioengineer Markus Covert and colleagues. To get the raw data for their model, they undertook an exhaustive literature review - spanning 900 research papers - to allow them to program into their model some 1900 experimentally observed behaviours and molecular interactions that M. genitaliumcan take part in during its life cycle.

In software terms, they found the behaviours of the 525 genes could be described by 28 algorithms, each governing the behaviour of a software module modelling a different biological process. "These modules then communicated with each other after every time step, making for a unified whole that closely matched M. genitalium's real-world behaviour," claims the Stanford team in a statement. Their research appears in the journal Cell (doi: 10.1016/j.cell.2012.05.044).

Such models will ultimately give biologists the freedom to undertake "what if" scenarios common in regular engineering - changing parameters in a genome design, say, like a civil engineer adjusts the width of a bridge deck on a computer to see what happens. As well as being experimentally useful, allowing artificial organisms and synthetic lifeforms to be created virtually (harming no-one), they could also boost biosafety by preventing accidental creations of lethal pathogens. In 2001, for instance, researchers in Australia accidentally created a lethal strain of mousepox.

In a commentary article in Cell, systems biologists Peter Freddolino and Saeed Tavazoie of Columbia University say they hope the work will soon be extended to more commonly used lab bugs like E. coli- but also warn that the technique's accuracy has yet to be demonstrated. It is unclear, they say, "how well overall behaviors will be predicted from a collection of separately obtained parameters" gleaned from hundreds of research papers.

But the US National Institutes of Health, which funded the modelling work, is excited. It believes the model a major step towards finding "new approaches for the diagnosis and treatment of disease", says James Anderson, an NIH program director.

---

Blowfish12@2012 blowfish12,tk Author: Sudharsun. P. R.

Related articles

• Researchers Build First Complete Computer Model of an Organism (techie-buzz.com)


• Stanford and Venter Institute Simulate an Entire Organism With Software (nytimes.com)


• Stanford Researchers Create World's First Complete Computer Model of an Organism (sciencespacerobots.com)


• Scientists recreate life with first organism computer model (news.techeye.net)


• Meet the first organism to be entirely modeled on a computer (dvice.com)


• Bio-boffins create world's first digital STD (go.theregister.com)


• Stanford scientists design first virtual organism (blacklistednews.com)


• Sexually Transmitted Bacteria Become 1st Complete 'Virtual Organism' (livescience.com)

Fact for the day: 16-07-2012

In 1988 Electronic Arts became the first major publisher to release an 'online' multiplayer game. Dan Bunten's Modem Wars allowed two players to sit at their own computer and play over a telephone line.

While games such as Doom, Marathon, Quake, Duke Nukem 3D and GoldenEye 007 may have defined the first-person shooter genre, the first documented 'first person shooter 3D multiplayer networked game' was called Spasim (space + simulation = Spasim). It appeared in 1974 and could be played by up to 32 people.

It is believed that Subash Ghai's film Taal was the first Bollywood movie to be widely promoted on the internet.

The first internet worm was created by Robert Morris, Jr, and attacked more than 6,000 internet hosts.

---

Blowfish12@2012 blowfish12.tk Author: Sudharsun. P. R.

Related articles

• Question of the day: 14-07-2012 (blowfish12.wordpress.com)


• Question for the day: 13-07-2012 (blowfish12.wordpress.com)


• Question for the day: 12-07-2012 (blowfish12.wordpress.com)


• Question for the day: 9-07-2012 (blowfish12.wordpress.com)


• Quote for the day: 9-07-2012 (blowfish12.wordpress.com)


• Question for the day: 12-07-2012 (blowfish12.wordpress.com)


• Quote for the day: 6-07-2012 (blowfish12.wordpress.com)


• Question for the day: 6-07-2012 (blowfish12.wordpress.com)


• Quote for the day: 5-07-2012 (blowfish12.wordpress.com)


• Reality Check: First-Person Shooters Are Not Really Ruining Gaming [Opinion] (kotaku.com)

Fact for the day: 8-07-2012

Grace Hopper, a woman Admiral in the navy, was the inventor of COBOL. Admiral Hopper wrote COBOL to be a programming language for general business use. It was supposed to be easier to understand than either Fortran or assembly language.

The name 'worm' appeared in the 1970 movie 'Shockwave Rider' to describe a program that propagates itself through a computer network.

Apple based their Lisa (later Macintosh) operating system on work done on graphical user interface at PARC which was run by Xerox. It was here that idea of the desktop and the mouse as we have it today was created.

Estimates suggest as much as 50 percent of the power used in desktop PCs is wasted as heat and expelled through fans on the power supply.

All the three founders of Apple Inc - Steve Jobs, Steve Wozniak and Ronald Wayne - worked at Atari before creating Apple.

---

Blowfish12@2012 blowfish12.tk Author: Sudharsun. P. R.

Related articles

• COBOL moving words (daniweb.com)


• Grace Hopper and the Invention of the Information Age by Kurt W Beyer - review (guardian.co.uk)


• Brief History (mainframesupport.wordpress.com)


• Quote for the day: 7-07-2012 (blowfish12.wordpress.com)


• Question for the day: 7-07-2012 (blowfish12.wordpress.com)


• Retrieve data from a txt file in cobol (daniweb.com)


• Scala Less Popular Than COBOL: Programming In The Real World (nerds-central.blogspot.com)


• grace hooper (kjmmyblog.wordpress.com)


• Quote for the day: 6-07-2012 (blowfish12.wordpress.com)


• Ten Development Environments That Won't Go Away (news.dice.com)

Thousands to lose web access Monday from virus shut-down

Hundreds of thousands of people will likely be kicked off the Internet next week when the FBI shuts down servers hosting the “DNSChanger” virus.

The group behind the DNSChanger virus, which affected some 4 million computers around the world, was shut down in November by the FBI, but the virus still persists on many PCs. In the last stage of the FBI’s Operation Ghost Click, it will shut downtemporary DNS servers on Monday, July 9. When those servers are shut down, it will kick off anyone who still has the DNSChanger virus on his or her machine.

There are still an estimated 275,000 infections around the world, a considerable drop from the 650,000 machines that were still infected in November. The drop can be attributed to efforts by the FBI and computer security companies, which have prompted people to check for the virus and remove it.

If you are concerned about your computer having the virus, Trend Micro has instructions for both PC and Mac users to check for it.

---

Blowfish12@2012 blowfish12.tk Author: Sudharsun. P. R.

Related articles

• FBI to kill servers supporting DNSChanger virus victims (slashgear.com)


• Thousands to lose web access Monday from virus shut-down (venturebeat.com)


• 'Internet doomsday' due on Monday, claims FBI (telegraph.co.uk)


• Thousands could lose internet access July 9 due to virus (cbc.ca)


• Thousands could lose internet access July 9 due to virus (cbc.ca)


• Will you lose Internet July 9 due to virus? (wnd.com)


• Thousands At Risk Of Losing Internet Access July 9 (huffingtonpost.ca)


• PSA: Thousands of DNSChanger malware victims could be knocked offline next week (theverge.com)


• Thousands of people could lose Internet access on July 9th (neowin.net)


• DNSChanger victims to lose internet on Monday (h-online.com)

The dark side of QR codes

Quick response codes are everywhere -- magazines, take-out menus, and the sides of bus stops. But this marketing tool could be just the opportunity hackers are looking for.

There's a pretty good chance you've scanned a QR code with your smartphone. QR is short for "quick response." Hidden in those lines are embedded code only your smartphone can read that points it to a new location on the Web. Online marketing gurus are singing the digital praises for the inexpensive cost with maximum return on investment.

The real estate industry is one example. Agents are able to market their hottest properties and themselves by embedding QR codes into their signs and brochures. QR design companies say they're seeing exponential growth in their business over the past two years. But security experts say not so fast.

Taking your smartphone to a new site certainly can seem cool if you trust the source. But experts believe it's just a matter of time before hackers are able to hijack this clever code, taking you someplace you didn't plan on going. The results could be a nasty virus, botnet, or malicious code that records your personal information, your location, even your bank account numbers.

Your best defense, use common sense. Don't scan QR codes randomly found on the street or buildings. If you have to ask yourself who might have made this code, it's probably best to pass.

---

Blowfish12@2012 blowfish12.tk Author: Sudharsun. P. R.

Related articles

• The dark side of QR codes (news.cnet.com)


• Finally, a clever use of the QR code (kutenda.com)


• Hackers using QR codes to push Android malware (zdnet.com)


• Are you sick of QR codes too? (adigaskell.org)


• Is it Time For You to Add A QR Code? (grasshopper.com)


• What is a QR Code and How is it Being Used? (mycricket.com)


• You can have a headstone with a QR code on it! (elkrapidslive.com)


• I've never once used a QR code. Seeing so many of them... (monkeymace.com)


• shortformblog: To people who think QR codes are a fad: This... (kantrowitz.tumblr.com)

Security tokens busted in a matter of minutes

RSA has responded with a blog post describing the research as an "academic exercise" and "not a useful attack". The security firm says the attack does not impact the one-time password aspect of its tokens (the six-digit number mentioned in the story below) but only the USB smartcard aspect, which is used to store cryptographic keys. RSA also says that the attack requires knowledge of the users smartcard PIN, in which case the system has already been compromised and the attack is unnecessary..

Original story

Some security tokens designed to protect computer systems, like RSA's SecurID 800 system, are now just plain old tokens - for now. Team Prosecco, a group of cryptographers based at the French National Institute for Research in Computer Science and Control, have figured out a way to extract the secret key from such tokens in just 13 minutes, effectively rendering them useless. The attack also works against older versions of the Estonian national ID card, allowing the team to forge a digital signature in around 48 hours.

The tokens are designed to provide more security than a fixed password alone can. They regularly generate a new six-digit number based on an initial starting number provided by RSA or another security firm, and users must input this number along with their password when logging in. Many tokens are stand-alone devices, but some like the SecurID 800 can be plugged into a computer via USB so that users don't have to enter the number themselves.

It is these USB tokens that have been cracked, using a technique called a "padding oracle attack", which essentially involves slightly modifying the encrypted text thousands of times. If the system views this extra padding as a valid encryption, the attacker can learn something about the original text until eventually they know the whole thing.

This kind of attack was first proposed in 1998 but until now was thought too slow to be practical, requiring 215,000 attempts to crack 1024-bit encryption. Now Team Prosecco have worked out a way to cut that number to just 9400, which takes about 13 minutes.

The researchers will present their attack at the CRYPTO 2012 conference in Santa Barbara, California, next month, but they have already informed the affected security token manufacturers, who are in the process of fixing the flaw. It is the latest in a series of troubles for RSA, which last year had to recall its tokens after hackers breached its internal network and stole secret information related to the system.

---

Blowfish12@2012 blowfish12.tk Author: Sudharsun. P. R.

Related articles

• Security tokens busted in a matter of minutes (newscientist.com)


• RSA CTO: It's Not True, SecurID 800 Token Not Cracked (news.softpedia.com)


• Security tokens busted in a matter of minutes (newscientist.com)


• Crypto boffins: RSA tokens can be cracked in 13 MINUTES (go.theregister.com)


• Don't Believe Everything You Read...Your RSA SecurID Token is Not Cracked (blogs.rsa.com)


• RSA says that its tokens are secure (h-online.com)


• Scientists crack RSA SecurID 800 tokens, steal cryptographic keys (arstechnica.com)


• Still Not Cracked: a further dive into the PKCS #1 v1.5 vulnerability (blogs.rsa.com)


• RSA says SecurID token information was stolen by a nation (zdnet.com)


• Researchers break RSA SecurID 800 token in 13 minutes (net-security.org)

Banking outage gives tiny glimpse of cybergeddon

Britons have been spitting blood this past weekend after a botched banking software upgrade at the UK government-owned Royal Bank of Scotland denied hundreds of thousands of people access to banking services. Customers of RBS and its NatWest and Ulster Bank subsidiaries have not been able to check their account balances or make major payments - such as deposits on houses - leaving some homeless.

While it is not yet clear why the software upgrade failed - or whether it was the fault of an off-shored computer facility in India - what is certain is that the episode has given us just a tiny taste of a nightmare scenario long feared by cyber security experts who advise western governments: What happens if there is an extended, simultaneous attack on all of the banks?

I was recently talked through this scenario by a source familiar with international deliberations on cyber defense. Imagine, the source said, that an attacker manages to disable the communications lines, or routers, linking a nation's banks, ATMs and the point-of-sale debit/credit card terminals in supermarkets and garages. Suddenly, as few of us carry much cash these days, people cannot buy day-to-day essentials like food and fuel. "The big concern is that Hurricane Katrina style riots could break out on a mass scale as people take to looting," the source said.

Particularly susceptible communications networks have already been identified by some governments and fixes put in place, the source said, patching, for example, vulnerabilities that came to light in the UK national telecommunications network during Tony Blair's time in office.

However, the arrival of the reprogrammable computer worms Stuxnet, Duqu and Flame now pose a fresh cyber risk. These can attack industrial or financial infrastructure in a step-by-step fashion, overcoming multiple layers of security as they go by wielding different software "payloads" at the right time. Devised initially by US and Israeli intelligence to slow Iran's nuclear program, these threats got into the wild and now provide attackers with handy cyber attack "construction kits".

Continued forensic examination of these worms by antivirus firms should find ways to disable attacks based on them. But for how long can an American firm like Symantec, say, continue to reveal threat confounding measures when it is clear that a US intelligence organization is partly behind the threat? Last week, at the Adaptive and Resilient Complex Systems conference at the Royal Society in London, I asked Patricia Titus, Chief Information Security Officer at Symantec that very question.

"It's our job - and we will continue to do it until we are told to cease and desist,"  she said.

---

Blowfish12@2012 blowfish12.tk Author: Sudharsun. P. R.

Related articles

• Banking outage gives tiny glimpse of cybergeddon (newscientist.com)


• Banking outage gives tiny glimpse of cybergeddon (newscientist.com)


• NatWest, RBS and Ulster Bank customers vent their fury as 'computer glitch' drags into sixth day (independent.co.uk)


• NatWest getting 'back to normal' (bbc.co.uk)


• Not so 'helpful banking' - the Natwest / RBS / Ulster Bank fiasco (itv.com)


• Royal Bank of Scotland-Nat West computer glitch: Computer says no - Telegraph.co.uk (telegraph.co.uk)


• Life's a glitch, then you cry (nzherald.co.nz)


• VIDEO: NatWest branches will open Sunday (bbc.co.uk)


• NatWest delays to continue over the weekend (telegraph.co.uk)


• This might be a bad day for the banks (itv.com)

US and Israel developed Flame, says official

Mega-malware Flame was indeed created by US and Israeli spies to sabotage Iran's nuclear efforts, according to a report in the The Washington Post. Flame's nation-state origins were suspected ever since its discovery last month, and now an unnamed US intelligence official has confirmed that the virus, along with its partner Stuxnet, is part of a continuing cyber-assault on Iran.

It is now all but certain that the design of Stuxnet - fully sanctioned by President Barack Obama, according to a New York Times report earlier this month, and used to damage the centrifuges in Iran's nuclear plants - was informed by intelligence gathered via Flame, which experts have also confirmed could have been developed only by world-class cryptographers. The Post's source also says that the US National Security Agency, the CIA and Israeli military continue the development of new cyber weapons to this day:

The US and Israel don't always act together though, it seems. Flame was unearthed only after a unilateral Israeli attack on Iranian oil facilities in April, leading Iran to investigate and discover the malware. The Post reports that US officials were "dismayed" at its partner's actions.

---

Blowfish12@2012 blowfish12.tk Author: Sudharsun. P. R.

Related articles

• Confirmed: Flame created by US and Israel to slow Iranian nuke program (arstechnica.com)


• Flame malware developed by US, Israel to slow Iranian nuclear efforts (slashgear.com)


• Leak: Usa, Israel Created 'Flame' Virus Aimed at Iran (investmentwatchblog.com)


• US, Israel Behind Flame Malware (it.slashdot.org)


• US and Israel developed Flame malware to attack Iranian nuclear program (theverge.com)


• U.S., Israel developed Flame computer virus to slow Iranian nuclear efforts, officials say - The Washington Post (warsclerotic.wordpress.com)


• U.S., Israel Developed Flame Computer Virus (cryptogon.com)


• Report: Current malware against Iran much more sophisticated than Flame (ifaynsh.wordpress.com)


• Stuxnet cyberattack by US a 'destabilizing and dangerous' course of action, security expert Bruce Schneier says (mbcalyn.com)


• Flame virus 'created by US and Israel as part of intensifying cyber warfare' (mytechnologyworld9.blogspot.com)

Flame cyber weapon is tied to Stuxnet program

The game appears to be up for the US and Israeli intelligence agencies who created the potent Stuxnet worm and Duqu trojan: analysis by software engineers at Kaspersky Lab in Moscow shows they also created Flame, the powerful espionage software that has mainly been infecting computers in Iran.

Kaspersky Lab, which was commissioned by the UN to investigate the cause of massive document losses in a raft of Middle Eastern computer networks, identified Flame last week. In a bulletin issued today, Kaspersky says that a module from Stuxnet, known as "Resource 207" is actually a Flame plugin that allows the malicious code to spread via USB devices. "The code of the USB drive infection mechanism is identical in Flame and Stuxnet," says Kaspersky.

Coming soon after the New York Timesdetailed classified White House meetings that confirmed the US is behind Stuxnet, this is a further embarrassment for the Obama administration, which is now seen to be preaching cyber security defense at home while deploying a battery of offensive cyber threats abroad - and ones that undermine the software integrity of America's software champion, Microsoft, to do so.

Flame works by using crypto logical skullduggery to scupper Microsoft's update system. And Stuxnet used vulnerabilities in Microsoft operating systems that, ordinarily, would be reported to Microsoft, repaired and sent out to millions of users as an update patch. Worse, perhaps, a coding error (the US reportedly blames Israel and vice versa) allowed Stuxnet to escape into the wild and reveal its existence - which a secret cyber weapon should of course not do.

It means the taxpayer-funded US National Security Agency is working at odds with the Department of Homeland Security, which is attempting to bolster online defenses. Only last week, US homeland security secretary Janet Napolitano met industrialists at the White House to "discuss DHS's current efforts to secure cyberspace".

Napolitano says the DHS is "working with partners at universities and the private sector...to protect against evolving cyber threats". Whether those threats will be variants of this new breed of home-grown cyber weapon remains to be seen.

---

Blowfish12@2012 blowfish12.tk Author: Sudharsun. P. R.

Related articles

• Flame cyberweapon is tied to Stuxnet program (newscientist.com)


• Flame and Stuxnet virus makers 'co-operated at least once' (telegraph.co.uk)


• Some Flame code found in Stuxnet virus (stuff.co.nz)


• Researchers Find Link Between Flame and Stuxnet (israelnationalnews.com)


• Flame And Stuxnet: Two Cyber Weapons Unleashed By Same Master (eurasiareview.com)


• Flame cyberweapon is tied to Stuxnet program (newscientist.com)


• You: Flame virus linked to Stuxnet (nation.com.pk)


• Kaspersky Lab: Same Countries Behind Stuxnet And Flame Malware (forbes.com)


• Flame virus, most sophisticated malicious code ever seen, was developed by U.S. government (antioligarch.wordpress.com)


• Security researchers discover link between Stuxnet and Flame (computerworld.co.nz)

Flame virus used world-class cryptographic attack

The recently discovered computer worm Flame could have been created only by "world-class" cryptographers, say experts in the field who have discovered that the malware uses a previously unseen cryptographic attack.

Flame installs itself on a target computer by hijacking the Windows Update system. Normal updates are signed with a digital certificatethat verifies their origin, but Flame's creators were able to fake their own certificate.

Such certificates are signed by a hash algorithmthat converts any digital data into a short sequence of characters. It isn't possible to recover the original data from this sequence, but it can be used to verify it, allowing the hash sequence to act as a virtual "signature". Crucially, it should be very difficult to discover two pieces of data that convert to the same hash sequence - otherwise someone can perform a "collision attack", generating a spoof hash sequence without knowing the original data.

That's exactly what Flame's authors have done, though it isn't the first time the feat has been achieved. In 2008 cryptographer Mark Stevens and colleagues showed that the oft-used MD5 hash algorithm is vulnerable to collision attacks - a feat that required 200 PlayStation 3consoles to crunch through the numbers to find a match.

Now Stevens and others have analyzed Flame's code and discovered it uses a previously unseen variant of the attack, probably developed before his research was published, allowing the attackers to calculate the exact hash sequence used by Microsoft'supdate system.

"The results have shown that not our published chosen-prefix collision attackwas used, but an entirely new and unknown variant," says Stevens. "This has led to our conclusion that the design of Flame is partly based on world-class cryptanalysis."

Whoever designed Flame, they are now trying to cover their tracks. Antivirus firm Symantec that computers infected with Flame have received a "suicide" update module designed to completely remove the worm. It appears that this module was created on 9 May, just a few weeks before the malware became publicly known.

---

Blowfish12@2012 blowfish12.tk Author: Sudharsunpr@live.in

Related articles

• Flame virus used world-class cryptographic attack (newscientist.com)


• Flame virus used world-class cryptographic attack (newscientist.com)


• Flame virus used world-class cryptographic attack (wnd.com)


• CWI cryptanalist discovers new cryptographic attack in Flame spy malware (cwi.nl)


• Crypto breakthrough shows Flame was designed by world-class scientists (arstechnica.com)


• Flame - oversights and expertise made for Windows Update worst case scenario (h-online.com)


• Analysis: Flame virus created by 'world-class' hackers, and Microsoft had means to prevent it (geekwire.com)


• Experts Name Flame's MD5 Chosen-Prefix Collision Attack "Unknown" (news.softpedia.com)


• Flame malware makers send 'suicide' code - BBC News (bbc.co.uk)


• Flame named a cryptographic marvel; Infected PCs commit suicide (slashgear.com)