Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Flame Burns a Little Brighter

Posted June 4, 2012    BeyondTrust Research Team

Did you know that Microsoft’s Terminal Server Licensing Service (we’ll call it TSLS for convenience) generated certificates that could be used to sign code? No? Neither did Redmond. Flame leveraged a “0day” (zero day) within TSLS to sign its own code, allowing it to appear as if the code came from Microsoft. This allowed Flame to propagate itself in a network by fooling other machines into believing it was serving Windows Update packages, when in actuality, it was serving up Microsoft signed versions of Flame. More details follow… but first, here is some actionable intelligence:

What does this mean for you and your organization? Apply this fix (Bulletin, Patch) immediately. Unless the patch is applied, your machines may end up trusting malicious code. Retina provides detection for the vulnerable certificates via audit 16497 – Microsoft Revocation of Fraudulent Certificates (2718704).

What does this mean for Flame? It is the first confirmed 0day used by Flame. Albeit, this 0day does not grant an attacker the ability to remotely control a machine with the use of a malformed packet or PDF. However, the use of this vulnerability shows sophistication and access to undisclosed exploitable bugs that may hint at the overall cleverness of Flame. Flame has moved beyond the realm of exploiting known flaws, to the fertile lands of 0day.

So how did this all go down? Well that is a very interesting, yet brief, tale. It all starts with an infected machine on a network. We’ll call that infected box… “Machine A”. Machine A is infected and is looking for opportunities to infect other machines on its network. It sets up a server by the name of “MSHOME-F3BE293C” and starts listening to WPAD requests sent by machines set to automatically configure its proxy settings (Internet Properties –>Connections –>LAN Settings–>Automatically detect settings).

By listening and replying to WPAD requests, the infected machine can point other machines to its proxy configuration file (PAC); effectively, an attacker can then dictate that traffic pass through the infected machine. Once it falsely declares itself as the proxy for the domain, other unwitting (and currently uninfected) machines start routing traffic through Machine A. When Machine A eventually sees some Windows Update queries come across its desk, it replies with a fake update that proceeds to download Flame and *BLAM*, the infection spreads.

By leveraging WPAD weaknesses (which are no stranger to WPAD, see and Microsoft signed executables, Flame was able to redirect traffic and then subsequently push malicious code onto target machines without any warnings or prompts, because MS code is to be trusted implicitly… Flame may potentially be more sophisticated and refined than its massive size may lead some to believe. Granted, Flame is still being analyzed, and from all estimates there is a long way to go, so stay tuned.

, , ,

Leave a Reply

Additional articles


October 2015 Patch Tuesday

Posted October 13, 2015    BeyondTrust Research Team

This month’s Patch Tuesday is on the lighter side, offering up six bulletins and 33 vulnerabilities in total. The critical bulletins to watch out for involve IE, JScript/VBScript, and Windows Shell.


Retina CS Vulnerability Management Solution Gets Primetime Award for Innovation

Posted October 12, 2015    Sandi Green

Analyst firm Frost & Sullivan presented BeyondTrust with the 2015 award for ‘Best Practices in Enabling Technology Leadership in the Vulnerability Management Industry.

, ,

Answering the age-old question, ‘What’s plugged into my network?’

Posted October 9, 2015    Alejandro DaCosta

“What’s plugged into my network?” is a question I hear frequently from security administrators. And, really, it’s no surprise why. No longer do we have to account just for the physical servers in our datacenters, workstations and a few network devices. Now we need to keep track of roaming laptops, dynamic virtual systems, off-site cloud deployments and BYOD.