Cyberspace espionage has been ratcheted up by a significant notch if this piece, "Flame Thrower" on FP, is correct. We should all be concerned as Governments around the world harness technology to snoop on what their citizens are talking about (via phone) or emailing (via their computer, tablet or smartphone).
The variety of spy tools that Flame employs is astonishing. According to Kaspersky, "of course, other malware exists which can record audio, but key here is Flame's completeness -- the ability to steal data in so many different ways." It also takes snapshots of instant messages and records a user's keystrokes. Flame is remotely controlled through a command and control server and it's highly dynamic. In other words, it has been updated remotely since it was first launched at least as early as March 2010 and its "creators are constantly introducing changes into different modules" which expand its functionality. Now that it has been detected, the Iranian CERT apparently offers infected users a removal tool.
According to the Washington Post, some analysts see the United States and Israel behind Flame. Kaspersky will only go so far as to say that it's likely the work of a nation-state rather than a private entity or hacking group because of the sophistication and the geographic location of the infected systems, For now, the perpetrator's identity remains unknown. Flame was designed to avoid being detected, hiding in large amounts of code and using a programming language unusual for malware. Victims include individuals, private companies, educational institutions, and state-related organizations. Other details are also unclear at this point, however, such as how Flame accesses a system in the first place. Kaspersky considers Flame an operation likely to have been run in tandem with Stuxnet."
Comments