Flame Malware: A Forged Microsoft Certificate and Bluetooth Spying

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Flame, also called Flamer or Skywiper, surfaced in 2012 while Iran's Maher Center, Kaspersky Lab and the CrySyS Lab at the Budapest University of Technology and Economics were hunting a different virus wiping files at Iran's oil ministry at the United Nations' request. CrySyS called it arguably the most complex malware ever found. At 20 megabytes it was enormous, built in C++ with Lua scripts so operators could push new modules, protected by five encryption methods and carrying its own SQLite database to catalog stolen files. It recorded microphone audio, screenshots, keystrokes, network traffic and Skype calls, and used Bluetooth to pull contact data from nearby phones.

Flame evaded security software by presenting a forged Microsoft code-signing certificate, created through a chosen-prefix collision against an old Terminal Server licensing certificate still using MD5. It hid with rootkit techniques and backdated its files as far back as 1994. About 1,000 machines were infected, mostly in Iran. The Washington Post reported it was part of Olympic Games, a U.S. and Israeli operation; Iran's CERT pointed to Israel; the U.S. denied responsibility. Kaspersky linked it to the Equation Group, noting a USB-spreading module shared with an early Stuxnet. In June 2012 operators sent a suicide command that erased Flame from infected machines.

• An April 2012 attack linked to Flame led Iranian officials to cut internet links to oil terminals.
• About 65 percent of targets were in the Middle East, including Israel, Palestine, Syria, Lebanon, Saudi Arabia, Sudan and Egypt.
• Flame checked which antivirus product was installed and changed its behavior and file extensions to avoid it.
• In 2019 researchers Juan Andrés Guerrero-Saade and Silas Cutler found Flame 2.0 with new encryption and obfuscation.
• A compiler timestamp the authors failed to scrub showed Flame 2.0 was built around 2014, two years after the supposed shutdown.